Architecture pattern

Deliver a secure static website with AWS

Use Route 53 for DNS, CloudFront for edge delivery, AWS WAF and ACM at the distribution, and a private Amazon S3 origin.

Official AWS sources reviewed 2026-07-25.

Architecture flow

  1. Resolve: Route 53 maps the site hostname to CloudFront.
  2. Protect the edge: ACM supplies the viewer certificate and WAF evaluates web requests at CloudFront.
  3. Cache and deliver: CloudFront serves cached objects close to viewers.
  4. Read the origin: On cache misses, CloudFront reads from a private S3 bucket through origin access control.

Text alternative: Route 53 resolves the website hostname to CloudFront. ACM terminates viewer TLS and AWS WAF evaluates requests at the distribution. CloudFront serves cached content or securely reads an object from private Amazon S3.

How the services connect

DNS resolution points viewers at CloudFront; it is not part of each object request after the address is resolved. ACM and WAF attach controls to the distribution rather than acting as sequential content origins.

Use origin access control and a restrictive S3 bucket policy so viewers cannot bypass CloudFront. The certificate for CloudFront must be in us-east-1 and cover the distribution hostname.

Tune cache keys and lifetimes before reaching for invalidations. Keep WAF rules in count mode during rollout and monitor both blocked requests and origin errors.

Tradeoffs and caveats

  • Low-operations global delivery for static assets with a private durable origin.
  • Cache behavior improves latency but adds invalidation and stale-content decisions.
  • Route 53, CloudFront, WAF, S3, logs, and transfer retain separate billing dimensions.

AWS services in this pattern

Primary AWS sources