How I built and secured my first AWS static website using S3, CloudFront, and ACM

Haroon Khan — Thu, 17 Sep 2026 07:20:25 +0000

Three days ago, AWS was completely new territory for me. As a cybersecurity student, I knew I needed hands-on cloud infrastructure experience, but starting from absolute zero is always a bit daunting. Fast forward 72 hours, and I have successfully deployed my first static website on my own domain, haroonkhan.online.

More importantly, I didn't just host it—I secured it.

Here is how I bypassed the insecure beginner shortcuts and built a locked-down architecture in my first three days.

The Problem with Default Tutorials
If you search for "how to host a static website on S3," the vast majority of guides tell you to upload your files, uncheck "Block all public access," and call it a day.

Coming at this with a security-first mindset, leaving a storage bucket entirely exposed to the public internet was an immediate red flag. I wanted to build this correctly, mirroring professional enterprise architectures rather than settling for a quick, vulnerable fix.

Building a Secure Pipeline
Instead of relying on public S3 endpoints, I designed a three-tier delivery method to protect haroonkhan.online:

The Vault (Amazon S3): My actual HTML, CSS, and JS files live here. The bucket is strictly private, with all public access permanently blocked.

The Shield (Amazon CloudFront): This acts as a global Content Delivery Network (CDN). It caches the content for fast global delivery while enforcing strict HTTPS encryption so all transit is secure.

The Map (Route 53): This handles the DNS routing, ensuring anyone typing my domain name is seamlessly directed to the CloudFront distribution.

The Secret Sauce: Origin Access Control (OAC)
The most challenging—and rewarding—part of this build was figuring out how to bridge a locked-down S3 bucket with the public internet. The modern solution is Origin Access Control (OAC).

By writing a highly specific S3 Bucket Policy, I explicitly denied all external access except for my designated CloudFront distribution. If a malicious actor tries to hit the raw S3 URL directly, they hit a brick wall. The only way to view the site is through the secure, encrypted CDN pathway.

Looking Forward
Getting this architecture live and fully secure in my first three days has been a massive confidence booster. It proves that robust cloud infrastructure isn't just for seasoned veterans—you just need the patience to read the documentation and understand the mechanics.

DEV Community: Haroon Khan

How I built and secured my first AWS static website using S3, CloudFront, and ACM