🔐
Encryption in transit
A valid ACM certificate enables HTTPS, while CloudFront redirects unencrypted HTTP requests.
Security
Controls that can be independently tested
Security is treated as observable behavior: encrypted delivery, restricted storage, limited permissions, and recorded verification.
Defense through clear boundaries
The design reduces unnecessary exposure and verifies each control separately.
⛨
Private storage
S3 Block Public Access remains enabled. Only the CloudFront distribution receives origin permission.
⌕
Evidence-based checks
Tests record domain resolution, response codes, certificate matching, page access, and denied direct origin requests.
Shared responsibility
Secure configuration remains our responsibility
AWS protects the underlying cloud infrastructure. The customer still controls permissions, website files, DNS, certificates, logging, and deployment decisions.
Operational safeguards
- No credentials stored in website files or GitHub
- Least-privilege permissions for deployment operations
- Human approval before consequential cloud changes
- Repeatable validation after configuration updates
- Recorded results without exposing secrets