UDP Gateway now offers two significant enhancements: open WireGuard endpoints and asynchronous Lambda invocation. Previously, WireGuard listeners required pre-registration of all connecting client keys. The new 'Allow Unknown Peers' property removes this restriction, enabling listeners to accept connections from any valid WireGuard client, similar to how HTTPS handles website access. This is ideal for services needing to connect with a large or unknown set of clients, such as mobile apps or on-demand device fleets.

For added security with open endpoints, the 'Unknown Peer Pre Shared Key' property allows for a shared credential gate, restricting access to clients issued a specific Pre-Shared Key (PSK). This acts as a lightweight barrier against arbitrary connections.

The second major update allows Lambda destinations to be invoked asynchronously. Previously, the Gateway waited for a Lambda function to complete before sending a reply. Now, with 'Use Async Invoke,' the Gateway fires a packet batch to a Lambda function and proceeds without waiting for a response. This is particularly useful for triggering long-running workflows, such as those managed by AWS Step Functions, enabling fault-tolerant, durable execution without holding the Gateway connection open. These features together facilitate public-facing, event-driven WireGuard services that previously demanded extensive custom infrastructure.

A key use case combines these features: a public WireGuard endpoint that triggers a long-running backend workflow, such as a device provisioning service where devices connect to an open listener, triggering a Lambda function to initiate a complex provisioning workflow via Step Functions.