Cloud Agent LabArchitecture
Four services, one request path
The site has no web server. Static files live in S3, CloudFront delivers them over HTTPS, ACM supplies the certificate, and Route 53 connects the domain name to CloudFront.
Numbers show the order of each step when someone opens the site.
Explore each component
Select a service to see what it does here and how it is configured.
Route 53: the domain's address book
The domain is registered at Namecheap, which delegates it to four Route 53 name servers. The hosted zone holds:
- A and AAAA alias records for the bare domain and
www, pointing at the CloudFront distribution for IPv4 and IPv6. - CNAME validation records that prove to ACM the project controls the domain.
Certificate Manager: proof of identity
ACM issues a free public TLS certificate covering both the bare domain and www. It is requested in us-east-1, the only region CloudFront accepts certificates from, and validated through DNS. ACM renews it automatically as long as the validation records stay in place.
CloudFront: the front door
- Viewer protocol policy: redirect HTTP to HTTPS.
- Minimum TLS: TLSv1.2_2021, with SNI.
- Default root object:
index.html. - Error responses: 403 and 404 both show
/404.html, because a private bucket answers 403 for files that do not exist. - Caching: the AWS managed CachingOptimized policy, with compression on.
Origin access control: the only key to the bucket
CloudFront signs every request it sends to S3. The bucket policy allows s3:GetObject only for the CloudFront service, and only when the request comes from this specific distribution (an AWS:SourceArn condition). No other AWS account, distribution or anonymous visitor can read the files.
S3: private file storage
The bucket stores the HTML, CSS, JavaScript and images. All four Block Public Access settings are on, and static website hosting is deliberately left off, because the S3 website endpoint would require a public bucket. Each file is uploaded with the correct content type so browsers render it properly.
Why each service is needed
| Service | Role in this site | What would break without it |
|---|---|---|
| Amazon S3 | Stores the website files durably | There would be nothing to serve |
| Amazon CloudFront | Serves files over HTTPS from edge locations and is the only reader of the bucket | The bucket would have to be public, and HTTPS on a custom domain would not be possible |
| AWS Certificate Manager | Provides the TLS certificate for the domain | Browsers would show a certificate warning |
| Amazon Route 53 | Answers DNS queries for the domain | The custom domain would not lead to the site |