Replace a server fleet with an event-driven control plane
Traditional RADIUS deployments combine network listeners, authentication logic, mutable state, accounting, and archives in long-running servers. The reference architecture separates those responsibilities across managed AWS services while UDP Gateway provides the global packet ingress and response path.
Choose plain UDP, WireGuard, or DTLS for authentication traffic. DTLS protects RADIUS packets in transit for clients with native DTLS support, while the AWS application receives the same RADIUS payload regardless of transport.
Network access servers → Proxylity UDP Gateway → Step Functions and DynamoDB authentication
Accounting packets → Lambda → Firehose, EventBridge, and S3 session archives
Authentication, accounting, and evidence
Access decisions
Process PAP, CHAP, and MAC authentication, then return Access-Accept, Access-Reject, VLAN, and session settings.
Session accounting
Acknowledge Start, Stop, and Interim-Update packets while organizing the full history by session.
Anomaly handling
Analyze repeated failures and unusual NAS, device, source, or geographic behavior; raise events or silently block at configured thresholds.
Regional deployment
Place processing near access infrastructure while keeping configuration and deployment in version-controlled templates.
How the flow works
Authentication batches invoke a synchronous Step Functions Express workflow. It parses packets, preloads configuration and block state from DynamoDB, processes requests concurrently, and constructs binary responses. Accounting packets take a simpler Lambda path, while a separate Firehose destination archives packets and an EventBridge-triggered workflow organizes them in S3.
Deploy the reference architecture
The example includes selectable UDP, WireGuard, and DTLS authentication transports, multi-region templates, test records, authentication tests, accounting flows, and teardown instructions. It is a reference implementation to adapt to your identity, policy, and operational requirements, not a claim that every RADIUS deployment has identical controls.
View source and deployment steps →
Discuss an enterprise RADIUS architecture →
Related use cases
Inspect RADIUS packets live | Understand the request/response model