Magento 2.1.9, Apache/2.4.10 (Debian) - The header "Cache-Control: private" is adding to all my static files and images

Question

We have a Magento 2.1.9 installation on a Debian Jessie server. It is configured to be connected with Cloudfront CDN for media and static files. The problem is that all the files that are served to CDN contain the header Cache-Control: private, so the Cloudfront behaves as a transparent proxy just forwarding the request to the Origin.

Preconditions

1. Magento 2.1.9

2. Connection with Cloudfront CDN

Steps to reproduce

1. .htaccess in /pub/static/ contains:

   <FilesMatch .*\.(ico|jpg|jpeg|png|gif|svg|js|css|html|swf|eot|ttf|otf|woff|woff2)$>
    Header append Cache-Control public
   </FilesMatch>
   

2. .htaccess in /pub/media/ contains:

   <FilesMatch .*\.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$>
    Header append Cache-Control public
   </FilesMatch>
   

Expected result

1. All files that are forwarding to CDN, except the ones that contain a non-cacheable block, to contain the header:

   -Cache-Control: public
   

Actual result

1. All files that are forwarding to CDN contain 2 headers:

   -Cache-Control: public
   -Cache-Control: private
   

2. In this configuration, Cloudfront behaves as a transparent proxy just forwarding the request to the Origin and we don't not benefit from Cloudfront caching.

Answer 1

Eventually the culprit was found. Magento works behind a nodeBalancer who puts the problematic header. I changed the nodeBalancer configuration and the problem resolved.