Data mixing between users in my application

You have not provided nearly enough information here to aid in troubleshooting/diagnosing. However, my initial thoughts go to caching. Are you using CloudFront for S3 only or in front of your EC2/nodejs server? I am concerned that caching is returning previously generated responses from other users. For example, user1 calls listMyOrders API with their userId and security token and gets their order list. CloudFront will cache this response for all users for a set period of time. So if user2 makes the same call, they will get the response generated for user1... everybody will get that response. If this sounds like the case, you need to ensure that CloudFront isn't caching user dynamic content from nodejs calls. If CloudFront isn't in front of ec2/nodejs, then there may be other caching mechanisms on the ec2 instance. A more detailed explanation of the architecture would help. Here are some references that might help depending how you are encoding the userId in your app:

• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/QueryStringParameters.html
• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html
• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html