🌍 Introduction
If you directly host a static site on AWS S3 (public), your files are exposed to the internet. This is fine for simple hosting, but not secure for production.
The best practice is:
- Keep your S3 bucket private
- Serve content via CloudFront (with caching + HTTPS)
- Map domain using Route 53
This way, CloudFront acts as a secure CDN, while S3 only accepts requests from CloudFront ✅
By the end, you’ll have this flow:
👉 Browser → Route 53 (DNS) → CloudFront (HTTPS + caching + SSL) → S3 (private)
🔒 Step 1: Keep Your S3 Bucket Private
- Block Public Access = ON ✅ (default)
- Disable Static Website Hosting
- Remove any public bucket policy
👉 Your bucket should have no public access.
⚡ Step 2: Create a CloudFront Distribution
- Go to CloudFront → Distributions → Create Distribution
-
Custom Domain: Enter your domain name (
myapp.com) - If no SSL → Request a free SSL certificate from ACM and attach it
-
Specify Origin:
- Origin type → S3
- Origin → Select your bucket
- Origin Path →
/index.html(if required) - Enable OAC (Origin Access Control) → Allows CloudFront to access your private S3 bucket
Leave other settings as default
(Optional) WAF → Not needed for now
Save distribution
📜 Step 3: Update S3 Bucket Policy
- After CloudFront is created → it will suggest a bucket policy (under Settings → Origins → Edit)
- Copy that policy and paste it into your S3 bucket policy section
- ✅ This ensures that only CloudFront can read from your S3 bucket
🌐 Step 4: Update Route 53 DNS
- Go to your Hosted Zone (example:
myapp.com) -
Create a Record:
- Name →
myapp.com - Type → A (Alias)
- Alias → Yes
- Target → Select your CloudFront distribution
- Name →
(Optional) Create another record for
www.myapp.com→ CloudFront
🧪 Step 5: Test Setup
- Wait 5–15 minutes for CloudFront distribution to deploy
- Open:
https://myapp.com
- Flow is now: Browser → Route 53 → CloudFront → S3 (private) 🎉
🎯 Conclusion
With this setup, you get a secure and production-ready website hosting on AWS:
✅ Private S3 bucket (no public exposure)
✅ CloudFront with HTTPS + caching
✅ Custom domain via Route 53
✅ Free SSL from ACM
This is the recommended AWS architecture for static site hosting in production 🚀
✅ Next Steps
🚀 Be interview-ready in the era of AI & Cloud — start your DevOps journey today!
💡 YouTube won’t get you a job. Real projects + real internship certificate will.
🔥 AI is reshaping jobs. Don’t watch it happen, be part of it with DevOps & Cloud skills.
🎯 ₹2000/month today = Dream job tomorrow. Secure your spot now.
⏳ Every month you wait, Cloud + AI jobs are being filled. Don’t miss out!
🌐 DevOps + AWS + AI = The skillset every recruiter is hunting for in 2025.
Top comments (0)