RMZI .tech

Blog

How I run static sites on S3 and CloudFront

Brochure and consulting sites do not need a Node server in production. They need HTTPS, fast global edge caching, and a boring deploy path.

Stack

  1. Astro SSG with trailingSlash: 'always' and directory output.
  2. Private S3 bucket as origin (no public website endpoint).
  3. CloudFront with Origin Access Control, HTTPS redirect, and a viewer-request function that maps /about/ → /about/index.html.
  4. ACM certificate in us-east-1 (required for CloudFront).
  5. Namecheap DNS CNAMEs — leave MX/TXT alone for Google Workspace email.
  6. GitHub Actions OIDC → IAM role → s3 sync + CloudFront invalidation. Push to main deploys preview; a GitHub Release deploys production.

Reusable OpenTofu modules (static-site, github-oidc-deploy) live in the RMZI-Tech modules repo so each site is a thin consumer stack.

This site and ajrsurvey.com share that pattern. If you want the same for your firm site, get in touch.

← All posts