Amazon CloudFront

What Amazon CloudFront is and how it works

Amazon CloudFront is the Content Delivery Network operated by Amazon Web Services Inc. It caches and delivers web content (HTML, JavaScript, CSS, images, videos, API responses) from more than 450 edge Points of Presence worldwide. When a visitor opens a CloudFront enabled website, the browser request is routed to the nearest edge POP, served from cache when possible, and otherwise forwarded to the operator origin. CloudFront supports HTTPS termination, request signing, geo restrictions, Lambda@Edge functions and a tight integration with other AWS services (S3, EC2, ALB, API Gateway, Shield, WAF).

What data CloudFront processes

CloudFront does not set tracking cookies by default. To serve a request, it processes the visitor IP address, the User Agent, the requested URL, any operator defined headers, the geographical region detected by the POP, and timing metadata. CloudFront access logs may contain the visitor IP and the URL accessed. The operator can choose to store these logs in an S3 bucket of their choice (in an EU AWS region if desired) and configure CloudFront to anonymise or truncate identifiers. Signed Cookies or Signed URLs are used only for access controlled content and represent a contractual relationship between the operator and the visitor.

GDPR, ePrivacy and US CLOUD Act implications

From the visitor perspective, CloudFront is technical infrastructure delivering the requested content, so the dominant legal basis is Article 6(1)(b) GDPR (performance of a contract) plus Article 6(1)(f) (legitimate interest) for security and performance. No consent is required for the CDN function itself under Article 5(3) of the ePrivacy Directive, as it is strictly necessary to deliver the requested service. However, CloudFront is operated by Amazon Web Services Inc, a US company subject to FISA 702 and the CLOUD Act, so the operator must treat the use of CloudFront as a Chapter V GDPR transfer with documented safeguards.

International transfers and EU data residency

AWS provides Standard Contractual Clauses through the AWS GDPR Data Processing Addendum, is self certified under the EU US Data Privacy Framework, and offers the AWS Data Residency Add On (legally binding commitment to process data in selected AWS Regions). For CloudFront specifically, EU operators can restrict the origin to EU regions and configure access logs to be stored in EU S3 buckets, but the edge POPs cover every continent and the control plane is operated from US AWS regions. EDPB and CNIL guidance still classifies the residual access risk as significant and requires a transfer impact assessment.

Practical compliance steps

Sign the AWS GDPR Data Processing Addendum, opt in to the AWS Data Residency Add On where applicable, restrict the origin and the log buckets to EU AWS regions, and disable any geo restriction that would force traffic to US POPs. Document the use of CloudFront in your Record of Processing Activities, list it in the privacy policy as a processor and as an international transfer recipient, and run a transfer impact assessment. For high risk sectors that require strict EU only infrastructure, consider EU based CDNs such as Bunny CDN, Fastly with EU POPs only, OVHcloud CDN, Scaleway Edge Services or self hosted nginx with EU servers.