Static Website
Architectureserverless
CloudFront + S3 with WAF, TLS and CI deploys
Open & fork this on Zstem →Architecture
- Users: Visitors resolving the site over HTTPS
- Route 53: Public hosted zone; ALIAS A/AAAA records to the CloudFront distribution
- ACM Certificate: Public TLS cert in us-east-1, attached to the distribution; auto-renews
- WAF Web ACL: Managed rules + rate limiting in front of the distribution
- CloudFront: Global edge cache; HTTPS only, compression on, SPA error mapping
- Site Bucket: Private origin, reachable only via Origin Access Control (OAC)
- Access Logs: Standard + real-time logs for traffic analysis; lifecycle to Glacier
- GitHub Repo: Source of truth; push to main triggers the deploy pipeline
- Build & Deploy: Builds the site, syncs to S3, then invalidates changed paths
Sequence
Participants: Browser, CloudFront, WAF, S3 Origin (OAC)
- Browser→CloudFrontGET /index.html
- CloudFront→WAFevaluate request
- WAF→CloudFrontallow
- CloudFront→Browser200 from edge cachecache hit path
- CloudFront→S3 Origin (OAC)GET object (SigV4 via OAC)
- S3 Origin (OAC)→CloudFront200 + object
- CloudFront→Browser200, stored at edge