Static HTML site on AWS

Comments

• Dashed lines are configuration, not user traffic. ACM provides the certificate to CloudFront, and OAC lets CloudFront read the private bucket.
• The bucket is private. Users never access it directly. OAC replaces OAI, the older mechanism.
• The certificate used by CloudFront must be created in us-east-1, regardless of where the rest of the architecture runs.
• Step 4 (upload with AWS CLI) happens before visitors arrive. It is numbered to show the publishing flow, not the visit flow.
• IAM is not drawn. In practice, an IAM policy controls which identity can write to the bucket.

Information flow

1. Amazon Route 53

   The user enters the domain; Route 53 resolves the DNS record, typically an alias pointing to CloudFront.

2. Amazon CloudFront

   CloudFront serves the site over HTTPS using the ACM certificate.

3. Amazon S3 + OAC

   On a cache miss, CloudFront fetches HTML, CSS and JS from the private bucket through OAC.

4. AWS CLI (publishing)

   The developer uploads the built files with aws s3 sync; this is the publishing step.