In the previous post I built the site. But a few improvements were needed:

  1. The website should use https instead of http.
  2. The S3 bucket should not allow public access.

So CloudFront is the way to go.

I followed this AWS guide, using a REST API endpoint as the origin with access restricted by an origin access control (OAC). These were the steps:

  1. Apply for two SSL certificates from ACM — one for album69.com and one for *.album69.com.
  2. Create two CloudFront distributions — one for album69.com and one for www.album69.com. I chose OAC instead of OAI, which is the legacy setting.
  3. Set the alternate domain names — album69.com and www.album69.com, each with its corresponding SSL certificate.
  4. Update DNS in Route 53 — point the A records to the CloudFront distributions.

Automation

The infrastructure itself — S3 buckets, CloudFront distributions, Route 53 records — was built with Terraform (that’s another article). For day-to-day publishing, deploy.sh handles the build, sync, and CloudFront invalidation in one command.

Reference