DEV Community: Marylinda Okparaogu

The Startup's First Website: Deploying a Static Website on AWS Using Amazon S3 and CloudFront

Marylinda Okparaogu — Wed, 22 Jul 2026 07:07:52 +0000

Lab Overview

A startup company with three employees needs its first public-facing website to showcase its product. The founder wants a solution that is:

Low cost
Easy to manage
Highly available
Secure
Able to handle sudden traffic spikes from social media platforms such as Reddit

As the Solutions Architect, your responsibility is to evaluate AWS hosting options and deploy the most suitable solution.

In this lab, you will compare Amazon EC2, AWS Amplify, and Amazon S3 before implementing a highly scalable static website solution using Amazon S3 and Amazon CloudFront.

Scenario

The startup has already developed a simple static website containing HTML, CSS, JavaScript, and image files. Since the website does not require server-side processing or a database, the goal is to identify the AWS service that provides the lowest cost while remaining highly scalable and reliable.
**
The Architecture Diagram used in this lab is shown below.**

Why This Architecture?

CloudFront provides:

HTTPS by default
Global caching
Faster website loading
Protection against traffic spikes
Improved security

Amazon S3 provides:

Durable storage
High availability
Serverless hosting
Very low cost

Learning Objectives

By completing this lab, you will be able to:
Compare EC2, Amplify, and S3 hosting options
Select the most cost-effective AWS service
Create an S3 bucket
Upload website files
Configure permissions securely
Create a CloudFront distribution
Configure Origin Access Control (OAC)
Deliver a website over HTTPS
Explain how CDNs improve performance

Note: This tutorial uses the AWS Management Console. Some labels and layouts may change slightly over time as AWS updates its interface, but the overall process remains the same

Prerequisites
Before starting you the need the following:

1)AWS Account
(If you've never touched AWS before or do not have an account, this is how to create one,

Go to aws.amazon.com/free
Click Create a Free Account
Enter your email, choose an account name (e.g. "YourName-Labs"), and set a password
You'll be asked for a credit card — this is normal and required even for free tier. Everything in this lab stays within free limits, and we'll show you exactly how to confirm that at the end.
Verify your phone number and choose the Basic Support Plan (Free)

2)Internet connection
3)Modern web browser
4)Static website files (HTML, CSS, JavaScript, and images) download it here: https://drive.google.com/drive/folders/1k1ZDBwwV05lToi-0ugOAgv3pfJhKODi9 If the files are downloaded as a ZIP folder, extract them first and Rename the extracted file to index

Solution Analysis
Before selecting a hosting service, evaluate the available AWS options.
| AWS Service | Advantages | Limitations | Decision |
|------------|------------|-------------|----------|
| Amazon EC2 | • Supports dynamic websites
• Full server control | • Requires server management
• Operating system maintenance
• Higher cost | ❌ Not Selected |
| AWS Amplify | • Ideal for React & Angular applications
• Built-in CI/CD | • Too complex for this project
• Unnecessary features for a simple HTML/CSS website | ❌ Not Selected |
| Amazon S3 Static Website Hosting | • Low cost
• Serverless
• Highly scalable
• Easy to configure | • Supports static websites only | ✅ Selected |

Amazon S3 Static Website Hosting was selected because the application consists entirely of static files and does not require a web server or backend processing. CloudFront was added to improve global performance, provide HTTPS support, and protect the S3 bucket from direct public access in future enhancements.

Implementation

Step 1 Sign in to the AWS Management Console.

Expected Result
You should successfully access the AWS Console.

STEP 2: Create an S3 Bucket
Go to the search bar, type S3 and select S3 bucket:

Click Create bucket

Enter a unique bucket name: e.g cooktogether-landing-page

Leave Region as default or choose a nearby region.

Click Create bucket:

Expected Result
You should see Bucket successfully created

STEP 3: Upload Website Files

Open the bucket.

Click:
Upload, then upload the index file you downloaded earlier

STEP 4: Enable Static Website Hosting

Open:

Bucket,bthen navigate to
↓
Properties

Scroll down to:

Static website hosting

Click:

Edit

Enable:

Enable

Choose:

Host a static website

on Index document option type:

index.html

on Error document option type:

index.html

Leave:

Redirection rules blank.

Click:

Save changes

STEP 5: Verify S3 Website Works

After saving:

Go to:

Properties
↓
Static website hosting

Copy:

Bucket website endpoint Example:

http://cooktogether-landing-page.s3-website-us-east-1.amazonaws.com

Copy it and paste in your Browser,

If everything is configured correctly:
You will see your website, the cook together landing page, the landing page will load just like a normal website.

If the page does not load or displays an Access Denied error, do not continue yet. Complete the Public Access and Bucket Policy steps below, then test the S3 website endpoint again before creating CloudFront.

STEP 6: Configure Public Access

Go to:

Permissions

Click:

Edit

under:

Block Public Access

Disable:

Block all public access

Save.

Type:

confirm

when prompted.

STEP 7: Add Bucket Policy

Open:

Permissions
↓
Bucket Policy

Paste this policy below:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicRead",
"Effect": "Allow",
"Principal": "",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::cooktogether-landing-page/"
}
]
}

then click Save.

STEP 8: Confirm Website Works

Open:

http://your-bucket-name.s3-website-region.amazonaws.com

You should see your website. If your website loads correctly from the S3 website endpoint, you are ready to continue to CloudFront. If it does not load, review the previous steps before proceeding.

Do NOT proceed to CloudFront until this works.

STEP 9: Create CloudFront Distribution

Search:

CloudFront

Click:

Create Distribution
General Information

Distribution name:

cooktogether-website

on Description option type:

CloudFront distribution for landing page

Click:

STEP 10: Configure Origin

Origin Type:

Amazon S3

Click:

Browse S3

Select:

cooktogether-landing-page

Keep:

Allow private S3 bucket access to CloudFront

enabled.

Keep:

Use recommended origin settings

enabled.

Origin Path:
Leave blank.

Note: AWS may ask you to create or select an Origin Access Control (OAC). Choose Create new OAC if prompted, then continue using the recommended settings.
(This is only for those who will encounter the OAC prompt).

Click Next

STEP 11: Security Settings

WAF:

Choose:

Monitor Mode

Why?

Safe for beginners
No blocking
Lets AWS observe traffic

Do NOT upgrade plans.

Click:

STEP 12: SSL Certificate

Since you are using the default CloudFront domain name (*.cloudfront.net), CloudFront automatically provides an SSL/TLS certificate. You only need to request your own SSL certificate if you later connect a custom domain name (for example, www.cooktogether.com).

So You DO NOT need one.

Leave blank:

Alternate Domain Name (CNAME)

Leave blank:

Custom SSL Certificate

CloudFront already provides HTTPS using:

.cloudfront.net

STEP 13: Create Distribution

Click:

Create Distribution

Wait 5–20 minutes.

STEP 14: Find CloudFront URL

Type Cloudfront on the search bar, Go to:

CloudFront
↓
Distributions

You will see:

Domain Name

Example:

drqqdng3e0nw5.cloudfront.net

This is your website URL.

Open:

https://drqqdng3e0nw5.cloudfront.net

STEP 15: Configure Default Root Object

Open:

CloudFront
↓
Distribution
↓
Edit Settings

Find:

Default root object

Enter:

index.html

Save.

Take Note:

If this field is blank, CloudFront may return:

403 Forbidden

even though the website exists.

Always set:

index.html

STEP 16: Wait for Deployment

CloudFront needs time to update.

Wait approximately 5–20 minutes for CloudFront to finish deploying. During this time, you may temporarily receive a 403 Forbidden or 404 Not Found response. This is normal. Refresh the page after deployment completes.

before testing again.

Do You Need a Domain Name?

No.

Your site is already live at:

https://drqqdng3e0nw5.cloudfront.net

A domain name is only needed if you want:

https://www.cooktogether.com instead.

Troubleshooting
If you receive 403 Forbidden

Check the following:

The CloudFront distribution has finished deploying.
The Default Root Object is set to index.html.
The bucket policy is correct.
Your bucket contains index.html.
You are using the CloudFront URL shown in your distribution.
If your website has no CSS or images

Check that you uploaded:

CSS files
JavaScript files
Image folders

Uploading only index.html will cause the page to appear broken.

If your website does not load from the S3 website endpoint

Verify:

Static Website Hosting is enabled.
Public Access settings are configured correctly.
The bucket policy has been saved.
The correct website endpoint is being used.

Troubleshooting
If you receive 403 Forbidden

Check the following:

Check that you uploaded:

CSS files
JavaScript files
Image folders

Uploading only index.html will cause the page to appear broken.

If your website does not load from the S3 website endpoint

Verify:

Static Website Hosting is enabled.
Public Access settings are configured correctly.
The bucket policy has been saved.
The correct website endpoint is being used.

Final Checklist

confirm:

✅ Bucket exists

✅ Static website hosting enabled

✅ index.html exists

✅ Not index.html.html

✅ Not index (1).html

✅ Public access configured (if using website endpoint)

✅ S3 website works first

✅ CloudFront distribution created

✅ Default root object set to index.html

✅ Waited for deployment

✅ Using actual CloudFront domain name

Result

You now have a production-style architecture used by many startups:

Implementing Secure File Access in Azure Blob Storage Using Shared Access Signatures (SAS)

Marylinda Okparaogu — Thu, 28 May 2026 22:19:29 +0000

Cloud security is one of the most critical aspects of modern infrastructure management, especially when dealing with file storage and resource accessibility.

In this hands-on implementation, I worked with Microsoft Azure Blob Storage to configure secure storage resources, manage container access levels, upload files, and generate Shared Access Signatures (SAS) for controlled resource sharing.

This guide walks through the complete process step-by-step.

What We’ll Cover

In this implementation, we will:

Create an Azure Storage Account
Create a Blob Storage Container
Upload files to the container
Configure container access levels
Generate a Shared Access Signature (SAS)
Securely share resources without exposing storage account keys

Why Shared Access Signatures (SAS) Matter

One of the biggest security risks in cloud environments is overexposing storage credentials.

Instead of granting full access to an entire storage account, Azure SAS allows organizations to provide:

Temporary access
Permission-specific access
Traceable access
Restricted resource-level authorization

This creates a more secure and scalable way to manage cloud storage access.

Prerequisites

Before starting, ensure you have:

A Microsoft Azure account
Access to the Azure Portal
Basic understanding of cloud storage concepts

Azure Portal:

https://portal.azure.com

Step 1 — Create a Storage Account

Sign in to the Azure Portal
Click Create a Resource
Search for Storage Account
Click Create

Fill in the required details:

Subscription
Resource Group
Storage Account Name
Region
Performance Type
Redundancy Option

Click Review + Create and deploy the resource.

Once deployment is complete, open the Storage Account.

📸 Insert Image Here
(Screenshot showing successful Storage Account deployment)

Step 2 — Create a Blob Storage Container

Inside the Storage Account:

Navigate to Data Storage
Click Containers
Select + Container
Enter a container name
Configure the access level

Access levels include:

Private

Only authorized users can access resources.

Blob

Allows public read access for blobs only.

Container

Allows public read access for the entire container.

For secure implementations, Private access is recommended.

Click Create.

Step 3 — Upload Files to the Container

After creating the container:

Open the container
Click Upload
Select your file
Upload the resource

Azure stores the file securely inside Blob Storage.

Step 4 — Modify Container Access Levels

One important part of storage security is understanding how visibility changes based on access configurations.

To modify access:

Open the container
Click Change Access Level
Select the preferred access setting
Save changes

This directly affects:

Resource visibility
Authorization requirements
Public accessibility
Security posture

In enterprise environments, proper access governance is essential for maintaining secure infrastructure.

Step 5 — Generate a Shared Access Signature (SAS)

To securely share a file without exposing account credentials:

Select the uploaded file
Click Generate SAS
Configure the SAS settings

You can define:

Permissions (Read, Write, Delete)
Start and Expiry Time
Allowed IP Addresses
Allowed Protocols (HTTPS Recommended)

After configuration:

Click Generate SAS Token and URL
Copy the generated SAS URL

The generated URL provides temporary and controlled access to the resource.

Step 6 — Understand the Security Benefits

What stands out about SAS in Azure is the level of granular security it provides.

Rather than granting full access to storage accounts, organizations can enforce limited, traceable, and temporary access to specific resources — a critical practice in secure cloud environments.

Key benefits include:

Reduced credential exposure
Better access governance
Time-limited authorization
Permission-based access control
Secure collaboration and file sharing

Final Thoughts

Working with Azure Blob Storage and SAS tokens highlights how modern cloud platforms balance accessibility with enterprise-grade security.

Understanding how to configure storage resources, manage access levels, and implement delegated authorization is an essential skill for cloud engineers, security professionals, and infrastructure administrators.

As cloud adoption continues to grow, secure resource management becomes increasingly important in designing scalable and protected environments.

Azure #CloudComputing #CloudSecurity #AzureStorage #BlobStorage #CyberSecurity #DevOps #SASToken #CloudInfrastructure

Hands-on Azure Entra ID Lab: User Creation, Role Assignment & Privilege Revocation

Marylinda Okparaogu — Thu, 28 May 2026 22:11:37 +0000

Introduction

In this assignment, I performed user and role management tasks in Azure Entra ID. The tasks included:

Creating a new user
Signing in with the new user account
Assigning Global Administrator privileges
Creating another user using the promoted account
Revoking administrative privileges

This practical helped me understand identity and access management in Microsoft Azure.

Requirements

Before starting, ensure you have:

An active Microsoft Azure account
Access to Azure Portal
Permission to manage users and roles

Azure Portal:
Microsoft Azure Portal

Step 1: Sign in to Azure Portal
Open the Azure Portal.
Sign in with your administrator account.

(https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i15gzk5ay2rhjogxihlj.png)

Azure Portal dashboard after login
Step 2: Open Azure Entra ID
In the search bar, type Entra ID
Click on Microsoft Entra ID

Azure Entra ID homepage/dashboard
Step 3: Create a New User
Navigate to:
Users → All Users
Click + New User
Select Create new user
Fill in:
Username
Name
Password settings
Click Review + Create
Click Create

New user creation page
Successfully created user
Explanation

This step creates a new identity within Azure Entra ID that can access Azure resources depending on assigned permissions.

Step 4: Sign In with the Newly Created User
Open an incognito/private browser
Go to Azure Portal
Sign in using:
Newly created username
Temporary password
Change the password if prompted

This confirms the user account was successfully created and can authenticate into Azure.

Step 5: Assign Global Administrator Role
Return to the main administrator account
Go to:
Entra ID → Users
Select the newly created user
Navigate to:
Assigned Roles
Click:
Add assignments
Search for:
Global Administrator
Select it and assign the role

Role assignment page
Global Administrator role selected
Confirmation of assigned role
Explanation

The Global Administrator role provides full administrative access to Azure Entra ID resources and settings.

Step 6: Sign In Using the Promoted Account
Open another incognito/private browser
Sign in using the promoted account

Successful login as Global Administrator
Step 7: Create Another User with the Promoted Account
Using the promoted account:
Go to Entra ID → Users
Click:
New User
Fill in the required information
Create the second user

Second user creation form
Successful creation message
Explanation

This demonstrates that the newly promoted Global Administrator account has sufficient privileges to manage users.

Step 8: Revoke Global Administrator Access
Return to:
Entra ID → Users
Select the first user
Open:
Assigned Roles
Remove:
Global Administrator role

Assigned roles page before removal
Confirmation after removing role
Explanation

Revoking privileged access is an important security practice that follows the principle of least privilege.

Conclusion

Through this assignment, I learned how to:

Create users in Azure Entra ID
Manage administrative privileges
Assign and revoke roles
Test user authentication and access management

This exercise improved my practical understanding of identity and access control in Azure.

Hands-on Azure Entra ID Lab: User Creation, Role Assignment & Privilege Revocation

Marylinda Okparaogu — Wed, 27 May 2026 22:34:41 +0000

Azure Entra ID User and Role Management Assignment

Introduction

In this assignment, I performed user and role management tasks in Azure Entra ID. The tasks included:

Creating a new user
Signing in with the new user account
Assigning Global Administrator privileges
Creating another user using the promoted account
Revoking administrative privileges

This practical helped me understand identity and access management in Microsoft Azure.

Requirements

Before starting, ensure you have:

An active Microsoft Azure account
Access to Azure Portal
Permission to manage users and roles

Azure Portal: https://portal.azure.com

Step 1: Sign in to Azure Portal

Open the Azure Portal and sign in with your administrator account.

Step 2: Open Azure Entra ID

In the search bar, type Entra ID and click on Microsoft Entra ID.

Step 3: Create a New User

Navigate to:

Users → All Users → + New User → Create new user

Fill in:

Username
Name
Password settings

Click:

Review + Create
Create

Explanation

This step creates a new identity within Azure Entra ID that can later be assigned permissions and roles.

Step 4: Sign In with the Newly Created User

Open an incognito/private browser and sign in using the new account credentials.

Explanation

This confirms the user account was successfully created and can authenticate into Azure.

Step 5: Assign Global Administrator Role

Return to the administrator account and navigate:

Entra ID → Users → Select user → Assigned Roles → Add assignments

Select:

Global Administrator

Explanation

The Global Administrator role provides full control over Azure Entra ID resources and identity management.

Step 6: Sign In Using the Promoted Account

Open another incognito window and sign in using the promoted account.

Step 7: Create Another User with the Promoted Account

Using the promoted Global Administrator account:

Go to Entra ID → Users → New User

Create a second user account.

Explanation

This confirms that the elevated account has permission to manage users.

Step 8: Revoke Global Administrator Access

Return to:

Entra ID → Users → Select first user → Assigned Roles

Remove:

Global Administrator

Explanation

Revoking admin access enforces the principle of least privilege and improves security.

Observation

During this exercise, I observed that newly created users did not receive email notifications automatically. However, the accounts were still successfully created and accessible using the provided credentials.

Conclusion

This assignment demonstrated:

User creation in Azure Entra ID
Role assignment and privilege management
Administrative access control
Role revocation and security enforcement

Overall, it strengthened my practical understanding of identity and access management in Microsoft Azure.