TheArchitect

Static Website (S3 + CloudFront + Route53)

AWS architecture template · SAA-C03: S3 origin → CloudFront CDN → Route53 DNS alias. WAF edge protection, OAC enforces private bucket.

Static Website (S3 + CloudFront + Route53) is a free AWS architecture template built with CloudFront, IAM, Route 53, S3 and WAF. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
Route 53 DNSWAF WebACLCloudFront CDNOAC RoleS3 Origin Buck…
Static Website (S3 + CloudFront + Route53) architecture diagram

AWS services in this template

  • CloudFront
  • IAM
  • Route 53
  • S3
  • WAF

Deployment notes

Needs input

  • Enter your S3 BucketName and Route53 HostedZoneName before deploying.
  • CloudFront requires a valid ACM certificate ARN in us-east-1 for HTTPS.

Generated CloudFormation — 5 resources

Logical IDResource type
Route53DNSroute53AWS::Route53::HostedZone
WAFWebACLwafAWS::WAFv2::WebACL
CloudFrontCDNcloudfrontAWS::CloudFront::Distribution
OACRoleiamAWS::IAM::Role
S3OriginBuckets3AWS::S3::Bucket
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "WAFWebACLwaf",
          "To": "CloudFrontCDNcloudfront",
          "Label": "protect"
        },
        {
          "From": "CloudFrontCDNcloudfront",
          "To": "S3OriginBuckets3",
          "Label": "origin request"
        },
        {
          "From": "OACRoleiam",
          "To": "S3OriginBuckets3",
          "Label": "OAC policy"
        }
      ]
    }
  },
  "Resources": {
    "Route53DNSroute53": {
      "Type": "AWS::Route53::HostedZone",
      "Properties": {
        "HostedZoneConfig": {
          "Comment": "Alias A record pointing to the CloudFront distribution"
        }
      }
    },
    "WAFWebACLwaf": {
      "Type": "AWS::WAFv2::WebACL",
      "Properties": {
        "Name": "saa-website-waf",
        "Scope": "CLOUDFRONT",
        "DefaultAction": {
          "Allow": {}
        },
        "VisibilityConfig": {
          "CloudWatchMetricsEnabled": true,
          "MetricName": "saa-website-waf",
          "SampledRequestsEnabled": true
        },
        "Description": "WAF WebACL protecting the CloudFront distribution"
      }
    },
    "CloudFrontCDNcloudfront": {
      "Type": "AWS::CloudFront::Distribution",
      "Properties": {
        "DistributionConfig": {
          "Enabled": true,
          "Comment": "Static website CDN distribution",
          "DefaultRootObject": "index.html",
          "PriceClass": "PriceClass_100",
          "HttpVersion": "http2and3",
          "WebACLId": "Ref: WAF WebACL",
          "DefaultCacheBehavior": {
            "TargetOriginId": "S3Origin",
            "ViewerProtocolPolicy": "redirect-to-https",
            "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
          },
          "ViewerCertificate": {
            "CloudFrontDefaultCertificate": true
          },
          "Origins": [
            {
              "DomainName": {
                "Fn::GetAtt": [
                  "S3OriginBuckets3",
                  "RegionalDomainName"
                ]
              },
              "Id": "S3Origin",
              "S3OriginConfig": {
                "OriginAccessIdentity": ""
              }
            }
          ]
        }
      }
    },
    "OACRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-website-oac-role",
        "Description": "Origin Access Control — CloudFront-only S3 access"
      }
    },
    "S3OriginBuckets3": {
      "Type": "AWS::S3::Bucket",
      "DependsOn": [
        "OACRoleiam"
      ],
      "Properties": {
        "BucketName": "saa-static-website-origin",
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "WebsiteConfiguration": {
          "IndexDocument": "index.html",
          "ErrorDocument": "error.html"
        }
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates