Key learnings and the gotcha I hit on each one.
Static file storage — no server needed
Bucket name must exactly match the domain. Block Public Access stays ON — S3 is never exposed directly. OAC lets CloudFront fetch files privately using signed requests.
⚠ Gotcha
Forgetting to set Default Root Object = index.html causes AccessDenied even when everything else is correct.
CDN + HTTPS + global edge delivery
Sits in front of S3, serves files from edge locations worldwide. Enforces HTTPS, terminates SSL, and uses OAC to talk to S3 privately. Alternate domain names must list every domain it serves.
⚠ Gotcha
Picking S3 from the dropdown sets the wrong origin endpoint. Always type the regional endpoint manually: bucket.s3.region.amazonaws.com
Free SSL certificate — auto-renewing
Provisions free TLS certificates validated via DNS. Once the CNAME records are added, validation completes in minutes. Certificate auto-renews — no manual action ever needed.
⚠ Gotcha
Certificate must be requested in us-east-1 regardless of bucket region. CloudFront is global and only reads ACM certs from N. Virginia.
AWS-native DNS with ALIAS on root domain
Hosted Zone = DNS control panel ($0.50/month). ALIAS record on root domain points directly to CloudFront — no forwarding hack. Nameservers updated in GoDaddy to delegate DNS to Route 53.
⚠ Gotcha
GoDaddy cannot ALIAS a root domain. This is why Route 53 was needed — ALIAS records on @ are a Route 53 superpower.
Domain registrar only — DNS fully delegated
GoDaddy now only holds the domain registration. All DNS is managed by Route 53. The locked A records (15.197.x.x) were GoDaddy's own forwarding servers — controlled via Forwarding settings, not DNS.
⚠ Gotcha
The WebsiteBuilder A record GoDaddy adds by default blocks everything. Always delete it first when setting up a new domain.
Origin Access Control — secure S3 access
OAC replaces the old OAI method. CloudFront signs every request to S3 using SigV4. The S3 bucket policy must reference the exact CloudFront distribution ARN to allow those signed requests through.
⚠ Gotcha
After creating the CloudFront distribution, AWS shows a banner with the bucket policy to copy — easy to miss. Without it, OAC requests are denied.