S3 Static Site with CloudFront and WAF

Production Static Site Hosting in One Stack

Deploying a static site on AWS correctly involves more pieces than it looks like. This CloudFormation template wires everything together — S3 with Origin Access Control, CloudFront, automatic ACM certificate provisioning, and WAF with AWS managed rules — so you're not clicking through five consoles.

What's Deployed

• S3 bucket with public access blocked and bucket policy scoped to CloudFront OAC
• CloudFront distribution with HTTPS-only redirect and custom domain
• ACM certificate with DNS validation (auto-created in us-east-1)
• WAF WebACL with AWS-managed rule groups: Core, Known Bad Inputs, IP Reputation
• CloudFront cache behaviors for static assets vs HTML
• S3 deployment helper script for syncing your build output

Deploying Your Site

aws cloudformation deploy --template-file static-site.yaml \n  --stack-name my-site \n  --parameter-overrides DomainName=example.com

# After stack creates:
./deploy.sh ./dist

Included Files

• static-site.yaml — full CloudFormation template
• deploy.sh — sync build output to S3 and invalidate CloudFront
• README.md — DNS setup, certificate validation, and WAF tuning notes