EngineerExperiences

Part 3 of 8 AWSS3Security

Creating a private S3 bucket

Creating the S3 bucket that holds the generated website and keeping it private so only CloudFront can read it.

Creating the S3 bucket

I created an S3 bucket specifically for the generated website.

The bucket name in this article is intentionally generic:

YOUR_S3_BUCKET

For example, it could be something like:

my-astro-blog-production

but the actual name is up to you.

The important distinction is that S3 is not being used as a Git repository backup.

GitHub contains the source:

Astro source
Markdown
Components
Configuration
package.json

while S3 contains the generated website:

index.html
projects/index.html
assets/...

The deployment pipeline is therefore:

Only the build output is uploaded Source Astro build dist/ S3
Nothing but dist/ leaves the machine, which keeps the bucket small and the sync cheap.

Keep the S3 bucket private

I don’t want the S3 bucket to be the public-facing website.

Instead, the architecture is:

Requests reach a private S3 bucket through CloudFront only Internet CloudFront HTTPS Private S3 bucket
Keeping the bucket private means only CloudFront can read it, so the objects are never publicly listed.

This gives CloudFront control over the public distribution layer.

The S3 bucket itself doesn’t need to be directly accessible from the public internet.

For a CloudFront distribution using the S3 REST endpoint, CloudFront can be configured to access the bucket using Origin Access Control (OAC).