AWS CloudFront

What AWS CloudFront is and how it fits in a website

AWS CloudFront is the content delivery network (CDN) of Amazon Web Services. It caches HTML pages, JavaScript and CSS bundles, images, fonts, video segments and API responses at hundreds of edge locations spread across the world, then serves them from the location closest to each visitor. For website operators in the European Union, CloudFront is most often deployed as a reverse proxy in front of an S3 bucket, an Application Load Balancer or a third party origin, with the goal of reducing latency, smoothing traffic spikes and offloading bandwidth from the origin.

What data CloudFront processes

CloudFront receives every HTTP and HTTPS request issued by a visitor's browser. To deliver the response it processes the source IP address, the requested URL, the HTTP method, request and response headers (including the User Agent, Referer and cookies forwarded by the origin), the TLS version and selected cipher, the geolocation derived from the IP and the chosen edge location. When access logs or real time logs are enabled, this information is stored in an S3 bucket or streamed to Kinesis. CloudFront itself does not set marketing or analytics cookies, but it can forward and cache cookies, query strings and headers configured in the cache policy.

GDPR and ePrivacy implications

IP addresses processed by CloudFront are personal data under the GDPR. Amazon Web Services Inc. acts as a processor on behalf of the website operator and as a controller for limited service operation purposes. Because the parent entity is established in the United States, every request to a CloudFront distribution can theoretically be observed by US infrastructure. The legal basis for routine content delivery is legitimate interest under Article 6(1)(f) GDPR, similar to other CDNs. The ePrivacy Directive only requires prior consent when information is stored or read on the user's device, which is not triggered by raw content delivery but is triggered if CloudFront is paired with marketing cookies, advertising tags or fingerprinting techniques.

International data transfers

Even when a European edge cache serves the response, AWS may transfer or replicate operational data to the United States. These transfers rely on the AWS GDPR Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework, complemented by encryption in transit (TLS 1.3) and at rest, customer managed keys via AWS KMS and an enterprise grade access control regime. Website operators must list AWS as a processor in their record of processing activities and inform visitors about the United States destination in the privacy notice.

Practical compliance steps

Sign the AWS GDPR Data Processing Addendum, document CloudFront in the record of processing activities and update the privacy notice to mention the AWS edge network and the United States destination. Configure cache policies that strip non essential cookies and query strings, enable AWS WAF rules that do not log raw IP addresses unnecessarily, and limit access log retention to a defined period. When CloudFront serves resources that are loaded together with analytics or advertising scripts, gate those downstream scripts behind a consent management platform so that no marketing tag fires before the visitor has accepted.