FIG. 01 — SYSTEM OVERVIEW

Static Site Delivery
Pipeline

A serverless architecture that serves a static site from a private S3 bucket, encrypted end-to-end over HTTPS, cached globally by CloudFront, with DNS handled outside AWS entirely.

See the architecture ↓
FIG. 02 — REQUEST PATH

How a request travels

Browser visitor Cloudflare DNS · CNAME (DNS only) CloudFront HTTPS · CDN cache edge locations ACM TLS cert us-east-1 S3 Bucket private origin via OAC

Cloudflare only resolves the hostname — it never touches AWS. ACM issues a certificate to CloudFront, which is the only thing allowed to read from the bucket.

FIG. 03 — COMPONENTS

What's under the hood

Amazon S3
Stores the site files. Bucket is fully private — no public access, no static website hosting endpoint.
Amazon CloudFront
Serves the content over HTTPS, caches at edge locations, and is the only principal allowed to read the bucket, via Origin Access Control.
AWS Certificate Manager
Issues a free public TLS certificate in us-east-1, validated by a DNS record — no manual renewal required.
Cloudflare DNS
Resolves the subdomain to the CloudFront distribution. No Route 53 involved — DNS stays where it already lives.