Replace a server fleet with an event-driven control plane
Traditional RADIUS deployments combine network listeners, authentication logic, mutable state, accounting, and archives in long-running servers. The reference architecture separates those responsibilities across managed AWS services while UDP Gateway provides the global packet ingress and response path.
Network access servers → Proxylity UDP Gateway → Step Functions and DynamoDB authentication
Accounting packets → Lambda → Firehose, EventBridge, and S3 session archives
Authentication, accounting, and evidence
Access decisions
Process PAP, CHAP, and MAC authentication, then return Access-Accept, Access-Reject, VLAN, and session settings.
Session accounting
Acknowledge Start, Stop, and Interim-Update packets while organizing the full history by session.
Anomaly handling
Analyze repeated failures and unusual NAS, device, source, or geographic behavior; raise events or silently block at configured thresholds.
Regional deployment
Place processing near access infrastructure while keeping configuration and deployment in version-controlled templates.
How the flow works
Authentication batches invoke a synchronous Step Functions Express workflow. It parses packets, preloads configuration and block state from DynamoDB, processes requests concurrently, and constructs binary responses. Accounting packets take a simpler Lambda path, while a separate Firehose destination archives packets and an EventBridge-triggered workflow organizes them in S3.
Deploy the reference architecture
The example includes multi-region templates, test records, authentication tests, accounting flows, and teardown instructions. It is a reference implementation to adapt to your identity, policy, and operational requirements, not a claim that every RADIUS deployment has identical controls.
View source and deployment steps →
Discuss an enterprise RADIUS architecture →
Related use cases
Inspect RADIUS packets live | Understand the request/response model