WingNews logo WingNews GitHub [2]
top | item 16557518

Show HN: How to Make an AWS S3 Static Website with SSL

96 points| greatamerican | 8 years ago |josephecombs.com

38 comments

order
[+] subway|8 years ago|reply
This works, but it leaves all traffic between the CloudFront edge node and S3 unencrypted. In theory, that shouldn't be an issue, by why risk it?

A better way is to completely leave the "website" bits of S3 off, and leave that all up to CloudFront. You can create an Origin Access Identity, then grant that OAI access to read your S3 bucket (all automated in the wizard when you create a CF dist and specify an S3 origin). You then specify a default object in your CF dist, and bam, CF is using the S3 REST API over SSL to secure that CF-S3 hop.

[+] fishdaemon|8 years ago|reply
Another important aspect of using AOI is that you don't need to make the s3 bucket public. This matters even if the website is fully public. It has to do with a simple governance rule. No public s3 buckets should be allowed.

That if monitored and enforced would stop many data breaches. With some public bucketd enforcement will be difficult

[+] 3stripe|8 years ago|reply
Another way to host a Jekyll website for pennies (and with HTTPS) is https://www.netlify.com/
[+] javajosh|8 years ago|reply
Go to https://www.netlify.com/features/#dev-tools and check out the dependencies in the image there. I bet an exec said "hey we need a cool looking screenshot of code" and the dev whipped up the most useless package.json they could think of and screen-shotted it. Well, I hope that's the case.
[+] davewasthere|8 years ago|reply
I also love Netlify, but I am interested in this result from google search console:

https://i.imgur.com/ji1z6oz.png

I switched from gh-pages/cloudflare to netlify, and it looks as though page crawl performance has worsened significantly...

[+] tambre|8 years ago|reply
Well, Netlify has no IPv6 support, so it's as good as useless.
[+] greatamerican|8 years ago|reply
This is my bill estimate for March - kinda high!

https://imgur.com/a/kDmdE

[+] grepthisab|8 years ago|reply
Looks like the majority of your bill -- $4.00/$4.39 -- is in hosted zones. It's $0.50/hosted zone, and you only need one for a single static site. So looks like with reasonable traffic, this jekyll setup is about $0.89/mo for hosting, that's not bad!
[+] mike503|8 years ago|reply
Highly recommend using CloudFlare instead of Cloudfront.

a) it's totally free, which means once it's cached at CF, no charges from AWS for bandwidth, also no charges for Route 53 since CF handles the DNS too.

b) it can be used to terminate SSL in front of the S3 bucket (with or without the S3 bucket properly using SSL, depending on if you're using path-based or host-based bucket access)

c) cache invalidations are stupid fast

d) any CDN changes are done nearly instant, vs. "however long" Cloudfront takes

$.02

[+] Mononokay|8 years ago|reply
What's the benefit of hosting a static website on AWS instead of Github or Gitlab Pages?
[+] tambre|8 years ago|reply
IPv6 support, it would seem.

GitLab Pages offers no IPv6 support. GitHub doesn't support IPv6 for custom domains officially, but you can easily work around that by adding 2a04:4e42::403 as the AAAA record.

[+] greatamerican|8 years ago|reply
less dependence on GitHub, IMO - I'm open to arguments in their favor though, for sure
[+] navaati|8 years ago|reply
My question with this kind of setup is: what if a malicious person (or just an unexpected success on HN) gets me a gazillion request, do I end up with a $10k liability ?

I'd rather have the site go down than me go broke, so is it really a good idea ?

[+] StreamBright|8 years ago|reply
This is ehy you can create budget limits in AWS. DDOS to your site is not legitimate traffic and AWS will provide you protection against it. Cloudfront is limited by default too. I cant remember the actual req/s but there is a limit. You can also limit access to certain countries where your legitimate users are.
[+] logronoide|8 years ago|reply
My favorite combination for a static website is AWS S3 for content and Cloudflare for caching and SSL termination. I think Cloudflare offers more capabilities as CDN.
[+] praveenweb|8 years ago|reply
How do you compare hosting static websites on Hasura (free SSL out of the box) or Heroku vs AWS S3?

I think cloudflare gives more options as a CDN than cloudfront.

[+] edem|8 years ago|reply
Where can I read about the costs / month?
[+] pfortuny|8 years ago|reply
I’ve got the same setup at pfortuny.net/reflexiones plus amazon workmail and it costs me around 6$/month. Very low traffic, though. Anyway, the cost is 5$ for the mail, so the blog is negligible.

Amazon’s pricing is easy for this simple setup.

[+] prayerslayer|8 years ago|reply
I run the same setup. Probably don't get any traffic because I don't write blog posts anymore. My monthly costs are around $ 0.70.
[+] forty|8 years ago|reply
Probably nitpicking, but why not having www as an alias record as well?
[+] IloveHN84|8 years ago|reply
Does It work with the free tier?