Latest

58 articles

The Cheapest, Most Resilient Static Website: Private S3 Bucket + CloudFront OAI
AWS Cloud

The Cheapest, Most Resilient Static Website: Private S3 Bucket + CloudFront OAI

Host static content in a private S3 bucket, serve it globally via CloudFront, and use an Origin Access...

Ned Ned ·
S3 Interface VPC Endpoint: Private Access With Fine-Grained IAM Role Restriction
AWS Cloud

S3 Interface VPC Endpoint: Private Access With Fine-Grained IAM Role Restriction

Deploy an interface VPC endpoint for S3 to keep all API traffic on the AWS network, then use...

Ned Ned ·
PHI-Compliant S3: aws:SecureTransport + SSE-KMS for Encryption in Transit and at Rest
AWS Cloud

PHI-Compliant S3: aws:SecureTransport + SSE-KMS for Encryption in Transit and at Rest

Enforce TLS on all S3 requests with the aws:SecureTransport condition and use SSE-KMS with a customer-managed key so...

Ned Ned ·
Private S3 Access with VPC Endpoints: No Internet, No NAT Gateway, No Public IP
AWS Cloud

Private S3 Access with VPC Endpoints: No Internet, No NAT Gateway, No Public IP

Move EC2 instances to private subnets and connect to S3 through a VPC gateway endpoint. All traffic stays...

Ned Ned ·
CloudFront + OAI + WAF: Locking Down S3 Static Websites at the Edge
AWS Cloud

CloudFront + OAI + WAF: Locking Down S3 Static Websites at the Edge

Combine CloudFront Origin Access Identity with AWS WAF to route all traffic through the CDN, block direct S3...

Ned Ned ·
SSE-KMS with Automatic Rotation: Encryption, Auditing, and Key Rotation in One Setting
AWS Cloud

SSE-KMS with Automatic Rotation: Encryption, Auditing, and Key Rotation in One Setting

Configure S3 with SSE-KMS and automatic annual key rotation to satisfy encryption at rest, CloudTrail auditing, and rotation...

Ned Ned ·