Case study · Serverless web

S3 + CloudFront Static Site

I deployed a static website to a private S3 bucket and serve it through CloudFront using an Origin Access Control (OAC). The site is available globally over HTTPS.

Live Demo Source Code

What’s done

  • Private S3 bucket (block public access on)
  • CloudFront distribution with OAC (S3 REST origin)
  • Bucket policy scoped to this distribution’s ARN
  • index.html set as the default root object
  • 404 page uploaded (404.html)
  • Set up CI to sync to S3

How I verified

  • Direct S3 access is denied; content only loads via CloudFront
  • HTTPS enforced (HTTP → HTTPS redirect)
  • Manual invalidation works for cache refresh

Environment

  • Bucket region: ca-central-1
  • TLS: CloudFront default certificate
  • Stack: HTML/CSS only

Why this matters

  • Least-privilege: S3 stays private; CDN is the only reader
  • Global performance via CloudFront
  • Clear path to IaC

Built by Chrys Hew. Last updated 2025-10-02.