Hey everyone, 

Just wanted to chime in on some of the chatter recently around static website hosting, as an AWS SA Pro. Also, apologies I’m on mobile, so formatting might be a mess. 

When you configure S3 bucket hosting correctly, the only thing you grant bucket content access to explicitly is the CloudFront distribution itself, meaning any external visitors attempting to access the bucket directly will be denied. This is the intended behaviour and is a good thing.

This also ties into something else that comes up fairly often, people receiving unexpectedly high S3 bills that appear to be caused by bots or DDoS activity hitting their bucket directly. Putting CloudFront in front of your S3 bucket goes a long way in mitigating this, as CloudFront absorbs that traffic before it ever reaches your bucket and runs up your bill.

So please, for your growth as an AWS specialist, student, startup founder, or whatever hat you are wearing, if you intend to use S3 to host your site, pair it with CloudFront and consider enabling S3 static website hosting for that extra layer of protection if desired.

Lastly, there are other methods for hosting sites on AWS. One I am particularly fond of is Lambda + CloudFront, which can be set up with up through IaC tooling such as SST. That is a bit off topic, but if it interests you it is definitely worth a bit of research as you get similarly low infrastructure overhead with the added benefit of SSR.

I have hopefully attached a link to the AWS docs to this post.

PSA: The modern way to host sites in S3