🎯 Goal: Deploy a secure, fast, globally cached static site — no console clicks, no hardcoded IDs.
✅ You’ll build:
- ✅ Private S3 bucket (no public exposure!)
- ✅ CloudFront Origin Access Control (OAC) — modern, secure auth
- ✅ Bucket policy — least-privilege access for CloudFront
- ✅ Auto-upload of
index.html,style.css,script.js- ✅ HTTPS-ready distribution (default + ACM-ready)
| Approach | Risk | Cost | Performance | Security |
|---|---|---|---|---|
❌ Public S3 (s3-website-us-east-1.amazonaws.com) |
DDoS, data leaks | High (global data transfer) | Slow (no caching) | ❌ Open to internet |
| ✅ S3 + CloudFront (Terraform) | None | Low (edge caching) | ⚡ Fast (TTL, edge POPs) | ✅ Private bucket + OAC |
🔑 Key Insight:
CloudFront ≠ CDN — it’s your security control plane:
- S3 bucket stays private
- Users hit edge locations (Mumbai, Virginia, Sydney…)
- Requests never reach S3 unless cache miss
flowchart LR
A[User in India] -->|HTTPS| B[CloudFront Edge: Mumbai]
C[User in US] -->|HTTPS| D[CloudFront Edge: Virginia]
B -->|Cache HIT| A
B -->|Cache MISS| E[S3 Bucket<br/>(private, us-east-1)]
D -->|Cache HIT| C
D -->|Cache MISS| E
E -.->|OAC Auth| B & D
✅ Critical Components:
s3:GetObject only to CloudFront (via ARN condition)default_root_object = "index.html"viewer_certificate = cloudfront_default_certificate (or ACM later)price_class = "PriceClass_100" (US/EU/CA only — cheaper!)/day14/)day14/
├── main.tf # S3 + CloudFront resources
├── locals.tf # Reusable values (origin_id)
├── variables.tf # Inputs (bucket_name, environment)
├── www/ # 📁 Your static files
│ ├── index.html
│ ├── style.css
│ └── script.js
└── TASK.md # 📝 Your challenge (ACM, Route 53, CI/CD)
main.tf — Core Resources