aws-s3-cloudfront

Purpose

Defines secure configuration and deployment practices for static websites using AWS S3 for storage and CloudFront CDN for global distribution.

Rules

S3 Bucket Configuration

MUST:

• Block all public access (use CloudFront Origin Access Identity)
• Enable versioning
• Enable server-side encryption (AES-256)
• Enable access logging
• Set lifecycle policies for old versions
• Use least-privilege IAM policies

Example Bucket Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudFrontOAI",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EXAMPLE"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

CloudFront Distribution

MUST:

• Use HTTPS only (redirect HTTP → HTTPS)
• Use TLS 1.2 as minimum
• Enable HTTP/2 and HTTP/3
• Configure custom SSL certificate (ACM)
• Set appropriate cache TTLs
• Enable gzip/Brotli compression
• Use Origin Access Identity (OAI) for S3
• Configure custom error pages

Security Headers (Lambda@Edge or CloudFront Functions):

function handler(event) {
  var response = event.response;
  var headers = response.headers;
  
  // Security Headers
  headers['strict-transport-security'] = {
    value: 'max-age=31536000; includeSubDomains; preload'
  };
  headers['content-security-policy'] = {
    value: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'"
  };
  headers['x-content-type-options'] = { value: 'nosniff' };
  headers['x-frame-options'] = { value: 'SAMEORIGIN' };
  headers['x-xss-protection'] = { value: '1; mode=block' };
  headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin' };
  headers['permissions-policy'] = { value: 'geolocation=(), microphone=(), camera=()' };
  
  return response;
}

Cache Configuration

Recommended TTLs:

• HTML files: 0-3600s (1 hour max)
• CSS/JS: 31536000s (1 year, use cache busting)
• Images: 31536000s (1 year)
• Fonts: 31536000s (1 year)

CloudFront Cache Policy:

{
  "CachePolicyConfig": {
    "Name": "StaticWebsite-CachePolicy",
    "MinTTL": 0,
    "MaxTTL": 31536000,
    "DefaultTTL": 86400,
    "ParametersInCacheKeyAndForwardedToOrigin": {
      "EnableAcceptEncodingGzip": true,
      "EnableAcceptEncodingBrotli": true,
      "QueryStringsConfig": {
        "QueryStringBehavior": "none"
      },
      "HeadersConfig": {
        "HeaderBehavior": "none"
      },
      "CookiesConfig": {
        "CookieBehavior": "none"
      }
    }
  }
}

Related Documentation

• github-actions-cicd SKILL.md
• security-architecture SKILL.md