Modernizing AWS CloudFormation for Secure Static Front‑End Hosting
Patch: deploy secure static site using modernized CloudFormation with OAC, Node 20, and least‑privilege IAM.
Run the provided CloudFormation template to set up S3, CloudFront, and Route 53.
Summary
The original AWS sample used Origin Access Identity (OAI), Node.js 12, and Lambda@Edge for security headers. The modernized template replaces OAI with Origin Access Control (OAC), upgrades the copy helper to Node.js 20, and uses CloudFront Response Headers Policy instead of Lambda@Edge. Least‑privilege IAM is applied to S3 operations, and the S3 origin remains private behind CloudFront.
Additional improvements include SPA‑friendly error handling (403/404 → 200), optional apex domain support, custom cache and origin request policies, and explicit resource naming parameters. The template deploys an S3 bucket for assets, an S3 bucket for access logs, an ACM certificate, a CloudFront distribution, and Route 53 alias records.
Key changes
- Replace OAI with Origin Access Control (OAC) for secure S3 access
- Upgrade copy helper to Node.js 20 and remove Lambda@Edge response‑header function
- Use CloudFront Response Headers Policy for security headers
- Apply least‑privilege IAM to S3 operations
- Enable SPA‑friendly error handling (403/404 → 200)
- Support apex domain and custom cache/origin request policies