03 · AWS by handLab 16 / 59
Challengeaws
Static Site on S3 + CloudFront — Challenge
Serve a site from a private bucket through a CDN with HTTPS, correct cache headers, and a cleanup you actually run.
- Time
- 27 min
- Level
- Beginner
- Objectives
- 5 objectives
- Cost
- Low cost
Where this fits in the platform
Already built
This lab adds
- A bucket served through a CDN
Which lets you
Before you start
You will need
- AWS CLI v2, configured
- An AWS account
You will be able to
- Serve a private S3 bucket through CloudFront with Origin Access Control
- Set cache headers that differ for immutable assets and HTML
- Confirm compression and caching from response headers, not assumptions
- Destroy everything you created
Cost — Low cost
— CloudFront's always-free tier covers 1 TB egress and 10M requests per month, and a few MB in S3 costs well under $0.01. Nothing here provisions an hourly resource: no NAT Gateway, no load balancer.
The goal#
Achieve the same outcome as Static Site on S3 + CloudFront, from an empty starting point, without the steps.
You need to put a static site on the internet, on HTTPS, cheaply, and without leaving a bucket open to the world.
This is the architecture EgyKode itself runs on — the page you are reading is served exactly this way, so the Terraform in infrastructure/terraform/production/ is the finished version of what you are about to build by hand.
Hands-on environment
Run it on AWS
This lab builds real cloud infrastructure, so it needs your own AWS account. Follow the cost and cleanup notes above — the resources are yours, and so is the bill.
Anything you tick here is your own record. EgyKode cannot see inside that terminal, so the success criteria stay self-assessed even when the environment checks your work for you.
What must be true when you are done
Step 1 of 3
What must be true when you are done#
- The site loads over HTTPS on the CloudFront domain.
- The bucket is private — a direct S3 URL returns AccessDenied, and only CloudFront can read it.
- Fingerprinted assets return
max-age=31536000, immutable; HTML revalidates. Content-Encoding: bris present on an HTML response.- Everything created is deleted at the end, verified by listing.
Rules#
- Do not open the guided lab until you are finished, or until you have been stuck on the same thing for 20 minutes. Being stuck is the exercise; staying stuck is not.
- Official documentation is allowed and encouraged. In the job it is the first thing you open.
- Verify every criterion yourself with a command whose output you can read. "It looks right" is not a check.
If you get stuck#
Work in layers rather than restarting things:
- What did you expect to happen, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
That sequence is the skill this tier exists to build. The commands are lookup-able; the sequence is not.
You are done when
0 of 5
The concept behind it
Next up
Lab 16 of 59 on the project path