The website is a small React app built with Vite. It lives in a private S3 bucket and is served by CloudFront, so the bucket is never public.
The pieces
- S3 + CloudFront with origin access control: only CloudFront can read the bucket.
- ACM certificate in us-east-1: CloudFront only accepts certificates from that region, whatever region the rest of the stack uses.
- Route 53: validation CNAMEs for the certificate, then A and AAAA alias records pointing the hostnames at the distribution.
Credentials without long sessions
The first login method expired, which made scripts flaky. We created an IAM user that can only assume a role, and a named profile that does the assuming. One variable, AWS_PROFILE, selects it. The setup is itself a script that can be re-run.
DNS you can review
Before changing live DNS, a read-only script snapshots every record into the repository, and each change is saved as a JSON change batch with a note on why. That includes a TXT record that proved domain ownership to HubSpot. A reminder from that step: check the exact hostname you typed into a verification dialog, because a one-letter typo checks a domain you do not own.
The same distribution now serves the root domain, www and cdn, each with TLS.