Amazon CloudFront: CDN | DNSTrace.dev

What Amazon CloudFront is

CloudFront is the AWS content delivery network. It commonly fronts an S3 bucket, a load balancer or an arbitrary origin, and is frequently combined with AWS WAF. Distributions receive a cloudfront.net hostname that customers usually alias with their own name.

How DNSTrace.dev detects it

Detection correlates independent public signals. A single match is reported as strong evidence; agreement between a response header and the announcing network is reported as confirmed.

x-amz-cf-id — Encrypted per-request identifier.
x-amz-cf-pop — The three-letter edge location code that served the request.
server: CloudFront — Present on many distributions.
via header naming cloudfront.net — Added by the CloudFront proxy.
CNAME targets under cloudfront.net — The distribution hostname.
AS16509 — The Amazon autonomous system commonly announcing the edge address.

What a detection proves

The request was served by a CloudFront edge location, and identifies which one.

What it does not prove

Whether the origin is also on AWS. CloudFront can front any public origin, including one on another provider entirely.

Common questions

Does a CloudFront detection mean the site runs on AWS?

Not necessarily. CloudFront accepts any reachable public origin, so the application behind it can be hosted anywhere.

Is x-amzn-waf-action related to CloudFront?

It indicates AWS WAF, which is frequently attached to a CloudFront distribution but is a separate product. DNSTrace.dev reports it as a firewall signal rather than a delivery signal.