storage-and-cdn

Configure S3 with versioning, encryption, and lifecycle policies, then generate presigned URLs to allow secure direct uploads. Serve content globally via a protected CloudFront distribution with appropriate cache behaviors and origin access controls to restrict direct bucket access.

S3 lifecycle policies automatically transition objects between storage tiers based on age to optimize costs. Configuring versioning alongside lifecycle rules ensures you manage storage growth and safely expire older versions or temporary files without manual intervention.

CloudFront integrates with private S3 buckets via Origin Access Control to securely serve static media globally. This configuration applies custom cache behaviors, protects the bucket from public access, and manages TLS certificates for secure content delivery.

Image and video processing pipelines can use Lambda with Sharp, self-hosted Imgproxy, or managed services like Cloudinary. These options trigger post-upload transformations such as resizing or format conversion, operating independently of your main backend application.

You can deploy S3 storage and CloudFront CDN infrastructure using Terraform examples for infrastructure as code. Terraform provisions buckets with encryption and versioning, configures lifecycle policies, and sets up protected CDN distributions with appropriate cache behaviors.

Making S3 buckets public for user uploads exposes data to unauthorized access and creates predictable URL leaks. Using private buckets with presigned URLs and CloudFront distribution ensures secure, controlled access and prevents unexpected storage cost growth.