Zero-Maintenance Developer Portfolio & Docs Site
Host a blazing-fast documentation and portfolio platform on S3 + CloudFront + ACM for under $0.50/month with automated TLS.
1. Business Problem & Context
An individual developer or open-source team wants to host technical documentation and a portfolio site. Traditional VPS hosting (e.g. EC2, DigitalOcean) requires managing OS security patches, SSH keys, Nginx configurations, and renewing Let’s Encrypt certificates every 90 days.
If a project goes viral on Hacker News or Reddit, a single virtual server frequently crashes from connection pool exhaustion.
2. Requirements & Constraints
- Zero Maintenance: Zero operating systems or server processes to patch.
- Global Performance: Sub-50ms Time to First Byte (TTFB) globally.
- Budget Ceiling: Under $1.00 per month for baseline traffic.
- Security: HTTPS enforcement with automated TLS certificate renewals.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
- DNS Query: User requests
docs.example.com; Route 53 resolves to the closest CloudFront Edge PoP. - Edge Caching: CloudFront serves cached assets with gzip/brotli compression.
- Origin Access Control (OAC): On a cache miss, CloudFront signs the request with AWS SigV4 to read from the private S3 bucket. Direct public access to S3 is disabled.
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| Amazon S3 | Storage | Provides 11 9s of durability for static assets without managing disk partitions. |
| Amazon CloudFront | Networking | Terminates TLS at 450+ edge locations and shields the S3 origin from traffic surges. |
| Amazon Route 53 | Networking | Provides free Alias record queries directly to CloudFront distributions. |
| AWS Certificate Manager | Security | Issues free public SSL/TLS certificates with automatic DNS validation renewal. |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
Dedicated EC2 Instance + Nginx
- + Familiar Linux environment
- − $5-$20/month minimum
- − Requires OS updates
- − Single point of failure
S3 Static Website Hosting (Public Bucket)
- + Simple S3 config
- − Does not support HTTPS on custom domains
- − Bucket must be publicly exposed
S3 + CloudFront OAC + Route 53 (Chosen)
✓ Chosen Design- + Private S3 bucket
- + Global edge caching
- + Free automated HTTPS
- + < $0.50/mo
- − Requires CloudFront cache invalidation on deployments
6. Implementation Highlights
Security Hardening S3 Origin Access Control (OAC) Bucket Policy
{
"Version": "2012-10-17",
"Statement": {
"Sid": "AllowCloudFrontServicePrincipalReadOnly",
"Effect": "Allow",
"Principal": {
"Service": "cloudfront.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-docs-bucket/*",
"Condition": {
"StringEquals": {
"AWS:SourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
}
}
}
}7. Results & Key Metrics
- Cost: $0.32/month (within AWS Free Tier limits).
- Latency: 18ms median TTFB in North America and Europe.
- Lighthouse Score: 100 Performance, 100 Best Practices, 100 SEO.
8. Key Architectural Takeaways
Best Practice: Always use CloudFront Origin Access Control (OAC) with S3 rather than legacy Origin Access Identity (OAI) to support all AWS regions and SSE-KMS encryption.
