Cloud Resume Challenge

Overview

You're looking at the result. This site started on Firebase Hosting and now runs entirely on AWS. Static files live in a private S3 bucket that is never publicly accessible; CloudFront serves them over HTTPS using an ACM certificate and reads from the bucket through Origin Access Control. DNS is hosted in Route 53, with an alias record pointing the domain at the distribution. The visitor counter is serverless: page JavaScript calls a Lambda function URL, which increments and returns a count stored in DynamoDB.

The migration had zero downtime. Because my registrar, Squarespace, can't point a root domain at CloudFront, I first moved DNS to Route 53 by mirroring the existing records into a new hosted zone and switching nameservers while Firebase was still serving the site. Only after the CloudFront distribution was fully tested did I switch the record over.

What broke

Two problems taught me the most. Certificate validation stayed pending because the validation records had never been created; adding them to Route 53 fixed it within minutes. Then CloudFront returned AccessDenied: my files sat under a public/ prefix while CloudFront was requesting the bucket root, and S3 reports missing objects as AccessDenied rather than "not found", so it looked like a permissions problem. Setting the origin path to /public solved it. I confirmed the cutover through response headers: server: AmazonS3 and x-cache moving from Miss to Hit.

Infrastructure as code & CI/CD

The entire stack — S3 bucket, CloudFront distribution, ACM certificate, Route 53 records, Lambda function and DynamoDB table — is defined in Terraform. Every push to the main branch runs a GitHub Actions pipeline that syncs the site to S3, invalidates the CloudFront cache and deploys the Lambda, authenticating to AWS through OIDC rather than stored access keys.