A secure path from visitor to content

The design separates public delivery from private storage and gives every AWS service one clear responsibility.

AWS delivery architecture from visitor through CloudFront to private S3

How a request moves

A visitor enters the custom domain. DNS directs the request to CloudFront, which provides HTTPS and retrieves approved content from the private S3 origin.

Route 53 publishes DNS records for the custom domain
ACM supplies the TLS certificate used by CloudFront
CloudFront redirects HTTP requests to HTTPS
Origin Access Control authorizes CloudFront to read S3 objects
S3 blocks anonymous public access

Service responsibilities

Four services, four distinct roles

Amazon S3

Stores the static HTML, CSS, JavaScript, SVG, and error page. Public access remains blocked.

Amazon CloudFront

Provides the public delivery endpoint, caching, HTTPS enforcement, and controlled origin access.

Amazon Route 53

Connects the registered domain to the CloudFront distribution through DNS alias records.

AWS Certificate Manager

Issues and manages the certificate that proves the domain identity and enables encrypted traffic.