skills.rest
Hack23
Hack23OFFICIAL
Explore all skills by this author →
WebsiteGitHub

aws-s3-cloudfront

Deploy AWS S3 static websites with CloudFront enforcing secure configurations.

9|3|Updated Oct 26, 2019
Search Tags:#deployment#security#aws#s3#cloudfront
One-click install
npx skills add https://github.com/Hack23/homepage --skill aws-s3-cloudfront
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-s3-cloudfront
Source: https://github.com/Hack23/homepage/tree/main/.github/skills/deployment/aws-s3-cloudfront
Command: npx skills add https://github.com/Hack23/homepage --skill aws-s3-cloudfront

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill defines secure configuration and deployment practices for static websites using AWS S3 for storage and CloudFront CDN for global distribution, ensuring compliance with security headers, TLS, and optimized caching.

Core Features & Use Cases

  • Secure S3 configuration: Enforces blocking public access via Origin Access Identity, server-side encryption, versioning, access logging, and lifecycle policies.
  • CloudFront best practices: Requires HTTPS-only, TLS 1.2+, HTTP/2/HTTP/3, ACM SSL certificates, proper cache settings, and OAI usage.
  • Security headers & caching: Applies security headers (CSP, HSTS, etc.) via Lambda@Edge/CloudFront Functions and sensible cache policies for assets, with example configurations.

Quick Start

Set up an S3 bucket and CloudFront distribution with the recommended security headers and a basic cache policy for a static site.

Frequently Asked Questions about aws-s3-cloudfront

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure S3 and CloudFront for a secure static website deployment?▼

Secure S3 and CloudFront deployments require blocking public access via Origin Access Identity, enforcing server-side encryption, versioning, and HTTPS-only with TLS 1.2+ to protect static websites.

What security headers are needed for AWS CloudFront static sites?▼

Security headers for CloudFront static sites include CSP and HSTS, applied via Lambda@Edge or CloudFront Functions to enforce strict content policies and transport security across the CDN distribution.

How do I restrict direct S3 bucket access when using CloudFront?▼

Restrict direct S3 bucket access by blocking all public access and configuring CloudFront Origin Access Identity (OAI), ensuring the static site content is exclusively served through the CDN distribution.

Can I use CloudFront Functions instead of Lambda@Edge for security headers?▼

Yes, both CloudFront Functions and Lambda@Edge are supported for injecting security headers like CSP and HSTS into static website responses, allowing lightweight edge processing for secure deployments.

What S3 lifecycle and caching policies work best for static site assets?▼

Optimal static site caching uses sensible CloudFront cache policies for assets combined with S3 lifecycle policies and versioning, ensuring efficient content delivery while managing storage costs securely.

Do I need ACM certificates to enforce HTTPS on CloudFront static websites?▼

Yes, ACM SSL certificates are required to enforce HTTPS-only access on CloudFront distributions, working alongside TLS 1.2+ and HTTP/2 or HTTP/3 protocols for secure static website hosting.

Related Skills

Explore More Software Engineering Skills→
leonj1leonj1

aws-static-hosting

Deploy static websites to AWS using S3 and CloudFront.

Community
Intermediate
sitharaj88sitharaj88
1

aws-cloudfront

Generate AWS CloudFront distribution configurations for static sites, APIs, and media streaming.

Community
Advanced
Hack23Hack23
9

aws-s3-cloudfront

Deploy AWS S3 static websites with CloudFront enforcing secure configurations.

Official
Advanced
engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

cloudfront-cdn

Design and operate Amazon CloudFront CDN distributions with caching and edge processing.

Official
Advanced