Global Enterprise Blog: Edge-Localized Content & Security Headers
Delivering dynamic language localization, security headers (CSP, HSTS), and sub-20ms edge redirects using CloudFront Functions and S3.
1. Business Problem & Context
An international enterprise publishes technical articles in 6 languages. Using traditional origin servers for language detection caused severe latency spikes for European and Asian users. Additionally, enterprise compliance mandated strict security headers (Content Security Policy, HSTS, X-Frame-Options) across all static assets.
2. Requirements & Constraints
- Automatic Geo/Language Redirection: Route users to
/es/,/de/,/ja/without hitting the S3 origin. - A+ Security Rating: Inject HSTS, CSP, and XSS protection headers on every response.
- Zero Origin Latency Penalty: Edge compute execution overhead must be under 2ms.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| CloudFront Functions | Compute | Sub-millisecond lightweight runtime executing at 450+ CloudFront PoPs with 1/6th the cost of Lambda@Edge. |
| Amazon CloudFront | Networking | Global CDN terminating TLS 1.3 and caching assets across 450+ Points of Presence. |
| Amazon S3 | Storage | Stores partitioned static language trees (e.g. /en/, /es/, /de/). |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
Lambda@Edge
- + Full Node.js runtime
- + Can make external network calls
- + Up to 30s timeout
- − Higher latency (10-40ms)
- − Higher cost ($0.60 per 1M requests)
CloudFront Functions (Chosen)
✓ Chosen Design- + Sub-millisecond execution
- + Extremely cheap ($0.10 per 1M requests)
- + Runs at all PoPs
- − 10KB code limit
- − No network access or file system access
6. Implementation Highlights
Edge Code Security Headers Injection CloudFront Function
function handler(event) {
var response = event.response;
var headers = response.headers;
headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubDomains; preload' };
headers['content-security-policy'] = { value: "default-src 'self'; img-src 'self' data: https:; script-src 'self';" };
headers['x-content-type-options'] = { value: 'nosniff' };
headers['x-frame-options'] = { value: 'DENY' };
headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin' };
return response;
}7. Results & Key Metrics
- Security Score: Upgraded from B to A+ on Mozilla Observatory.
- Global P95 TTFB: Reduced from 180ms to 22ms worldwide.
8. Key Architectural Takeaways
Edge Compute Rule: Use CloudFront Functions for ultra-fast, stateless header and URL transformations. Reserve Lambda@Edge only when your edge logic requires external HTTP calls or complex libraries.
