Justin Essler

← AWS Learning Lab

Lab 01

Static Web Architecture

A secure static-site delivery path using a private S3 origin, CloudFront, custom DNS, and HTTPS.

S3 · CloudFront · OAC · Route 53 · ACM

Lab milestone complete

Problem

Serve a real website without making its storage public.

A static site needs reliable global delivery, a custom domain, and HTTPS—but the S3 bucket holding the files should not become a publicly browsable web server.

This lab separated storage from delivery. S3 holds the site assets privately, while CloudFront is the public entry point responsible for caching and serving them over the custom domain.

Architecture

A private origin behind the CDN.

Route 53 maps the domain to the CloudFront distribution. ACM supplies the certificate used at the edge, and the S3 bucket policy allows origin access only through CloudFront’s OAC.

Build

The services were connected in layers.

  1. 01
    Stored the site in S3

    Uploaded the plain HTML, CSS, and JavaScript files while keeping public bucket access blocked.

  2. 02
    Placed CloudFront in front

    Created the distribution and configured the S3 bucket as its origin.

  3. 03
    Restricted origin access

    Used OAC and the bucket policy so CloudFront could read the files without exposing S3 directly.

  4. 04
    Connected HTTPS and DNS

    Associated the ACM certificate with CloudFront and routed the custom domain through Route 53.

What I Tested

The public path works; the origin stays private.

  • 01
    Custom-domain delivery

    Verified the site resolves at its domain and loads through CloudFront over HTTPS.

  • 02
    Private-origin behavior

    Confirmed that site content is delivered through the distribution rather than by exposing the S3 bucket publicly.

  • 03
    Static asset loading

    Checked that the HTML, shared stylesheet, JavaScript, and internal navigation all load through the same delivery path.

What I Learned

A static website is still a system.

  • 01
    Each service has a narrow responsibility.

    S3 stores, CloudFront delivers, ACM handles the certificate, Route 53 resolves the domain, and OAC protects the origin path.

  • 02
    Private by default is practical.

    The content can be public on the web without making the underlying storage bucket public.

  • 03
    DNS and TLS are part of the architecture.

    A working application endpoint is not finished until the domain, certificate, and delivery behavior operate together.