Portfolio Delivery on AWS

The goal was to publish the portfolio through a small, reviewable AWS architecture without leaving an origin publicly accessible or introducing always-running compute.

The delivery path also needed a predictable deployment command, canonical domain behavior, TLS, useful security defaults and a cost response that could limit unexpected spend.

1. Route 53A and AAAA aliases send apex and www requests to the CloudFront distribution.
2. Canonical hostA CloudFront Function permanently redirects www traffic to the apex domain.
3. Edge deliveryCloudFront terminates TLS, compresses content, applies managed security headers and serves cached objects over HTTP/2 or HTTP/3.
4. Signed origin requestOrigin Access Control signs requests from CloudFront to S3.
5. Private object storageThe S3 bucket blocks all public access and grants read access only to the intended distribution.

• No public website bucketS3 static website hosting is not used; direct origin requests are denied.
• Scoped origin policyThe bucket policy permits object reads from the CloudFront service only when the request belongs to this distribution.
• Managed edge protectionThe CloudFront pricing plan supplies a managed WAF association while Terraform owns the rest of the distribution configuration.
• No stored credentialsTerraform and deployment scripts use the normal local AWS credential chain; secrets and identifiers are excluded from the public site.

Terraform owns the certificate, DNS aliases, CloudFront distribution, origin access control, private bucket policy, cache behavior, redirect function, budget monitoring and automated cost response. State is stored in a separate versioned S3 bucket using native lockfiles.

The content deployment script stages only public HTML, CSS, JavaScript, sitemap, robots and referenced assets. It synchronizes with deletion enabled, applies cache policies by file type and submits one CloudFront invalidation. A separate verification script checks public routes, the canonical redirect, security headers and custom 404 behavior.

• Predictable deliveryThe distribution uses AWS-managed policies and a flat-rate CloudFront pricing plan.
• Small originThe architecture uses static objects and avoids a load balancer, NAT Gateway, database or always-running compute.
• Budget monitoringAWS Budgets provides forecast and actual-spend notifications for the portfolio delivery services.
• Automated responseA separate threshold invokes a narrowly scoped Lambda that can disable only this distribution.

Keep the runtime proportional to the workload

Static delivery removes the need for an application server, load balancer or database. The deployment process owns asset selection, cache policy and invalidation.

Separate public delivery from origin access

CloudFront serves the site while OAC and the bucket policy restrict reads at the private S3 origin. Verification checks both the public request path and denied direct-origin access.

Bound the cost response

The automated response can disable only this distribution. Because billing data arrives with a delay, it is a defensive response rather than an immediate spending limit.

Deployment evidence: HTTPS responses, redirect checks and private-origin controls. This is a recorded verification, not a live status monitor. Select the image to inspect it.

The result is a reproducible delivery system with a private origin, edge security and automated publishing. Verification covers the public routes and the origin boundary; budget monitoring and a scoped response address unexpected spend.