GoKawiilNow Available: Open WireGuard Endpoints and Lambda Async Invocation
Two new capabilities are available in UDP Gateway today. The first allows WireGuard Listeners to accept connections from any client without pre-registration — the same model HTTPS uses for websites. The second allows Lambda destinations to be invoked asynchronously, firing a packet into a long-running workflow without the Gateway waiting for a response. Together they open up a class of public-facing, event-driven WireGuard services that previously required significant custom infrastructure to build.
WireGuard Open Endpoints
WireGuard Listeners have always required every connecting client to be pre-registered: you list each peer's public key in your CloudFormation template, and the Listener rejects any handshake from an unknown key. That model fits private services with a managed set of devices. But it creates a problem for anything that needs to be accessible by a large or unknown set of clients.
Consider a mobile app that generates a WireGuard keypair on first launch. Or a fleet of devices provisioned on demand where central key management is operationally impractical. Or any public-facing service where clients you've never seen before need to connect. With the previous model, every one of those clients required an out-of-band registration step and a CloudFormation update before it could complete a handshake. That's not a model that scales to public services.
The new AllowUnknownPeers property removes that restriction. Set it to true on a WireGuard Listener and the Gateway will complete the handshake with any valid WireGuard client, regardless of whether its public key is listed. The connection is still fully encrypted — WireGuard's cryptographic properties don't change. The difference is simply that the Listener no longer requires the key to be known in advance.
The analogy to HTTPS is intentional. When you visit a website over HTTPS, the server doesn't need to know who you are before establishing an encrypted connection. The TLS handshake completes, the channel is encrypted, and authentication (if it happens at all) is a separate concern at the application layer. Open WireGuard endpoints work the same way: the transport is encrypted, and identity can be handled by your Lambda or Step Functions destination however your application requires.
Adding a shared credential gate
Fully open enrollment — accepting literally any WireGuard client — is appropriate for some services. For others, you want the encryption and the open handshake, but you also want to prevent connections from clients that weren't issued credentials. The UnknownPeerPreSharedKey property provides a lightweight gate for exactly this case.
When UnknownPeerPreSharedKey is set, unknown peers must include that PSK in their WireGuard configuration or the handshake fails. It's not per-device authentication — every client uses the same secret — but it meaningfully restricts access to clients that were issued the PSK. Think of it like a shared API key for transport-layer access: not strong identity, but a real barrier against arbitrary connections from clients who were never given credentials.
... continue reading