Amazon CloudWatch RUM

What CloudWatch RUM does

Amazon CloudWatch RUM is part of the AWS observability stack. After creating an AppMonitor in the AWS console, the operator embeds a small JavaScript snippet that loads the cwr web SDK from a public Amazon CloudFront URL. The SDK observes the browser using PerformanceObserver, the Long Tasks API, error events, navigation timings and an optional session replay engine. It batches the events every few seconds and pushes them to the regional CloudWatch RUM data plane endpoint, where they are stored, aggregated and exposed through CloudWatch dashboards, Contributor Insights and CloudWatch alarms.

Data and identifiers collected

By default CloudWatch RUM stores a session and a user identifier in localStorage rather than in cookies, which makes it cookieless from a banner perspective but still subject to Article 5(3) ePrivacy because it accesses the device storage. Each event payload typically contains the AppMonitor ID, the session ID, the URL of the current page, the referrer, the user agent, the device type, Core Web Vitals (LCP, INP, CLS, FCP, TTFB), navigation and resource timings, JavaScript errors with stack traces, HTTP request metrics from the Fetch and XHR observers, and any custom event the operator emits via the recordEvent API. The visitor IP address is observed by AWS at the network level when the request reaches the data plane.

GDPR and ePrivacy classification

Even cookieless analytics fall under Article 5(3) of the ePrivacy Directive when they read or write data on the user device. The CNIL exemption for audience measurement is narrow and requires the data to be collected on behalf of the operator only, not shared with third parties for further use, with IP truncation, no cross site tracking and a clear opt out. Native CloudWatch RUM does not meet every requirement out of the box, so most European deployments need either explicit consent (Article 6(1)(a)) or a configuration that enforces all CNIL conditions through SDK options and request rewriting. Operators activating session replay must always rely on consent because session replay can capture personal data inside form fields and URLs.

Hosting region and international transfers

CloudWatch RUM is regional: events stay in the AWS region of the AppMonitor. To keep European personal data inside the EEA, create the AppMonitor in Frankfurt, Ireland, Paris, Stockholm or Milan, and ensure your CloudWatch dashboards, alarms and Lambda subscribers are also deployed in the same region. AWS acts as a processor under the AWS GDPR Data Processing Addendum and is certified under the EU US Data Privacy Framework, which provides additional safeguards if a US region must be used for global teams.

Consent strategy and Consent Management Platform integration

The recommended approach is to gate the CloudWatch RUM SDK loading through your CMP and to expose two switches: one for the strictly necessary error tracking (which can be argued under legitimate interest with IP truncation) and one for the optional session replay or custom event reporting that always requires consent. Use the disableCookies and identityPoolId options carefully, prefer the unauthenticated Cognito Identity Pool to avoid linking events to AWS user accounts, and clear the localStorage entries cwr_s and cwr_u when the visitor opts out.

Practical compliance checklist

Choose an EU region for the AppMonitor, sign the AWS GDPR DPA, set sessionSampleRate to a value that minimises data collection, disable session replay or activate the masking rules to redact form inputs, configure short retention on the underlying CloudWatch Logs (30 to 90 days), strip query string parameters that may contain personal data with the urlsToInclude option, document the IAM principals authorised to read RUM data, and add CloudWatch RUM to your record of processing activities and your privacy policy.