Cloud platforms · AWS
The default for marketing sites, documentation and public information: a private S3 origin behind CloudFront with WAF, managed TLS and a pipeline that deploys with short-lived credentials.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
The browser resolves the domain. Route 53 returns an alias to the CloudFront distribution, so the apex domain works without a CNAME.
The browser connects to the nearest CloudFront edge over TLS 1.2 or newer. HTTP is redirected to HTTPS and a response headers policy adds HSTS, CSP and the other security headers.
The web ACL evaluates the request first: AWS managed rule groups, an IP reputation list and a rate-based rule. Blocked requests never reach the origin.
On a cache miss CloudFront fetches the object from S3 using origin access control, which signs requests with SigV4. The bucket policy only trusts this one distribution.
Standard access logs land in a separate bucket with a lifecycle rule, ready for Athena queries or a SIEM.
A GitHub Actions workflow assumes a deploy role through OIDC, syncs the build to S3, sets cache headers and creates a targeted invalidation. No long-lived access keys exist.
| Component | What it does | Why this choice |
|---|---|---|
| Amazon S3 (private bucket) | Holds the built site. Block Public Access is on at account and bucket level. | S3 gives very high durability and no servers to patch. A public website endpoint is avoided because it cannot use OAC. |
| Amazon CloudFront | Global cache, TLS termination, HTTP/3, compression, redirects and security headers. | Offloads almost all traffic from the origin and gives one place to attach WAF, logging and headers. |
| Origin access control (OAC) | Signs CloudFront-to-S3 requests so only the distribution can read the bucket. | OAC replaces the legacy origin access identity and supports SSE-KMS and all S3 Regions. |
| AWS WAF web ACL | Managed rule groups, rate-based rules and optional geo or bot controls. | Cheap protection for a public endpoint. A CloudFront web ACL has to be created in us-east-1. |
| AWS Certificate Manager | Issues and renews the public TLS certificate. | Free for use with CloudFront and removes expiry incidents. The certificate must be in us-east-1. |
| Amazon Route 53 | Public hosted zone with alias records to CloudFront, plus DNSSEC if required. | Alias records are free to query and work at the zone apex. |
| IAM role with GitHub OIDC | Short-lived credentials for the pipeline, scoped to one bucket and one distribution. | Removes stored secrets, which is the usual cause of leaked deploy keys. |
Origin type
Why. Keeps the bucket unreachable except through CloudFront, so WAF and headers cannot be bypassed.
Trade-off. Directory index and clean URLs need a small CloudFront Function or build-time paths, because S3 REST endpoints do not resolve /about/ to index.html.
Hosting model
Why. Lowest cost and attack surface, predictable performance, and any CI system can deploy it.
Trade-off. Dynamic features move to separate APIs or third-party forms. Preview environments need extra pipeline work.
Cache policy
Why. Hashed filenames make stale assets impossible and keep invalidation cost near zero.
Trade-off. HTML is cached briefly, so urgent content fixes need an invalidation step in the pipeline.
Security headers
Why. Managed feature with no code to run, patch or bill per invocation.
Trade-off. A strict CSP with inline scripts needs hashes generated at build time.
Private origin, WAF in front, TLS 1.2 or newer, security headers, no stored credentials and S3 Block Public Access.
S3 and CloudFront are regional and global managed services. Versioning on the bucket gives a one-step rollback of a bad deploy.
Edge caching, Brotli and gzip, HTTP/3 and immutable assets. Time to first byte is edge-served for cache hits.
Pay for requests, data transfer and WAF rules. For a typical brochure site the monthly bill is small and driven by transfer and WAF.
One workflow deploys everything. Infrastructure lives in Terraform or CDK so the distribution is reproducible.
No idle compute, and caching reduces repeat transfers. Image optimisation at build time lowers bytes served.
No VPC is needed. The only public surface is the CloudFront distribution. The bucket policy denies everything except the distribution's service principal with a source ARN condition, and denies non-TLS access.
Two roles only: a deploy role (s3:PutObject and DeleteObject on one bucket, cloudfront:CreateInvalidation on one distribution) trusted by the GitHub repository and branch through OIDC, and a read-only audit role for humans via IAM Identity Center.
Content is public by design, so classification is OFFICIAL public content. Use SSE-S3 by default, or a customer-managed KMS key if policy requires it. Do not host forms data here. Note that CloudFront caches content at global edge locations, so confidential content does not belong in this pattern.
| Control | How this design addresses it |
|---|---|
| Patch applications and operating systems | No servers or operating systems to patch. Build dependencies are scanned in CI. Essential Eight patch applications, applied to the build chain. |
| Restrict administrative privileges | No long-lived keys, deploy role scoped to one bucket and distribution, human access through MFA-backed Identity Center. Essential Eight restrict administrative privileges. |
| Regular backups | S3 versioning plus the Git repository as the source of truth. Essential Eight regular backups. |
| Logging and monitoring | CloudFront and S3 access logs, CloudTrail for configuration changes. Supports ISMF event logging expectations. |
| Privacy | Analytics and forms must be assessed under APP 1 and APP 5 notices. No personal information is stored by this tier. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
| Failure mode | Mitigation |
|---|---|
| Bad deploy publishes a broken page | Versioned bucket and an immutable build artefact. Redeploy the last good commit and invalidate. Smoke test in the pipeline before invalidation. |
| Certificate or DNS mistake causes an outage | ACM validation records managed in code, CloudFront alternate domain names checked in plan, low TTL during cutovers. |
| Bot or scraping spike | Rate-based WAF rule and bot control if needed. CloudFront absorbs the traffic from cache. |
| Regional S3 impairment | Cached content continues to be served. For stronger resilience add an origin group with a replicated bucket in a second Region. |
CloudFront data transfer and requests, WAF web ACL and rule fees, Route 53 hosted zone and queries.
AWS
A scale-to-zero API for web and mobile apps. Cognito authenticates, API Gateway enforces, Lambda runs the business logic, DynamoDB stores state and SQS or EventBridge decouple the slow work.
AWS
The workhorse for line-of-business web apps: public load balancer, containers across three Availability Zones, a private Aurora PostgreSQL cluster, ElastiCache for sessions and S3 for files.
Azure
The Azure equivalent of the three-tier pattern: Front Door with WAF, Container Apps or App Service on a private network, Azure SQL, Entra ID for identity and Key Vault for secrets.
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.