How this site is hosted
#aws #hosting #infrastructure #copilot #security
It’s not a ground-breaking first technical post, but I wanted to show you how the website is hosted. I needed a diagram to do it, so I taught the blog to draw with Mermaid. That became a small story of its own, so here I will stick to the infra and cover the drawing in a follow-up post.
The infra
The whole site is static, fronted by CloudFront over a private S3 bucket:
Why did I choose this approach when there are cheaper options, like a plain VPS running Nginx? Because I know AWS really well; having spent well over a decade with it I know CloudFormation, CDK, Terraform, IAM and the rest, so setting this up was mostly muscle memory. That made it a perfect task for Copilot to draft, because I knew exactly what it should look like, I just didn’t need to type the IaC from scratch.
Pros of my approach
- Cheap. A static site on S3 + CloudFront is as cheap as chips, and sits comfortably in the free tier for a personal blog.
- Fast and global. CloudFront caches at the edge, so pages load snappily no matter where you are.
- Secure by default. The S3 bucket is private (Origin Access Control only), everything is TLS, the security headers are locked down, and there is no server to exploit, so the attack surface is tiny.
- Self-scaling. No servers to patch or capacity-plan, and CloudFront plus AWS Shield absorb traffic spikes and basic DDoS for free.
- All in code. The whole thing is defined in CDK, so it is reproducible and deploys with a single command.
Cons of my approach
- More moving parts. S3, CloudFront, OAC, ACM, Route 53 and a CloudFront Function is a lot more to understand than a single box running a web server.
- Slow to change. CloudFront config changes take minutes to propagate, so it is not the snappiest feedback loop.
- Cache invalidation. You have to think about invalidating the CDN on every deploy (one of the two hard problems in computer science, apparently).
- Static only. No server-side logic without bolting on Lambda or similar.
- Overkill if you do not already know AWS. For a tiny blog, it introduces a lot of pitfalls.
References
The AWS building blocks and docs behind this setup, if you want to dig deeper:
- CloudFront Origin Access Control — how the private S3 bucket only answers to CloudFront.
- AWS CDK — the infrastructure-as-code framework the whole stack is defined in.
- Amazon Route 53 — DNS and the alias records pointing the domain at CloudFront.
- OWASP Secure Headers — the reference for the headers locked down at the edge.