Study guide

Technical reference and lesson notes

Purpose of This Lesson

This hands-on lesson demonstrates how to create and publish a static website using Amazon S3. It covers bucket configuration, static website hosting, uploading HTML and image objects, granting public read access with a bucket policy, accessing the website endpoint, and the security limitation of S3 website endpoints.

The workflow is especially relevant to AWS Certified CloudOps Engineer Associate preparation because it combines S3 configuration, permissions, public access controls, website endpoints, and a service-selection decision involving CloudFront.

Key Concepts

Amazon S3 static website hosting: S3 can serve static files such as HTML and JPEG images directly through a website endpoint.
General purpose S3 bucket: The website content is stored as objects in a standard general purpose bucket.
Index document: The default page loaded by the website endpoint is configured as index.html.
Error document: An error document can be configured, but it is optional in this workflow.
Public access configuration: Public access must be permitted for the website objects. The lab disables the bucket setting that blocks all public access.
Bucket policy: A resource-based policy grants the public principal permission to perform s3:GetObject on objects in the bucket.
Website endpoint: The S3 static website endpoint provides HTTP access to the hosted content.
CloudFront: S3 static website endpoints are HTTP-only in this workflow. CloudFront is required in front of the bucket when a secure HTTPS experience is needed.

Static Website Configuration and Publishing Workflow

1. Create the bucket

Create a new S3 bucket with a globally unique name, select the required AWS Region, and use the general purpose bucket type. The lab leaves ACLs disabled.

Because the website must be publicly reachable, clear the option that blocks all public access and acknowledge the warning. This is a deliberate security-sensitive choice: public access is required for the demonstrated configuration.

2. Enable static website hosting

Open the bucket’s Properties tab and locate Static website hosting. Enable hosting and select the option to host a static website. Set the index document to:

index.html

An error document is optional and is not configured in this workflow. After saving, S3 displays the website endpoint for the bucket.

3. Prepare the website files

The HTML page references image objects by their exact object names. In the demonstration, the website consists of:

index.html
pineapple.jpeg
papaya.jpeg
apple.jpeg

The filenames in the HTML must match the uploaded object keys, including spelling and capitalization. The HTML also includes descriptions for the images’ alternative text; those descriptions do not replace the object filenames used in the image references.

4. Upload the objects

Upload the image files to the bucket, then upload index.html. All referenced objects must be in the expected location in the bucket. If the HTML references objects at the bucket root, upload them at the bucket root rather than inside a separate folder.

5. Grant public read access

In the bucket’s Permissions tab, edit the bucket policy and allow the public principal to retrieve objects. The policy needs the following logical elements:

Principal: wildcard, representing anyone
Action: s3:GetObject
Resource: the bucket ARN followed by /*, representing objects in the bucket

A representative policy is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
    }
  ]
}

Replace YOUR-BUCKET-NAME with the actual bucket name. The /* is important: the policy grants access to objects, not merely to the bucket resource itself. Policy syntax, capitalization, commas, quotation marks, and ARN formatting must be valid.

6. Test the endpoint

Return to the Properties tab, locate the static website hosting section, and open the website endpoint. If the files and permissions are configured correctly, the browser displays the static page and its referenced images.

Exam- or Assessment-Relevant Takeaways

A static S3 website requires an index document, such as index.html, configured in the bucket’s static website hosting settings.
Public access settings and the bucket policy must work together. Disabling the block-all-public-access setting alone does not grant object retrieval permission.
The public read policy uses s3:GetObject and a resource ending in /* to target objects.
The HTML references must match the exact S3 object keys that were uploaded.
The S3 static website endpoint shown in this workflow is HTTP-only and is therefore not a secure HTTPS endpoint.
Choose CloudFront in front of the bucket when the requirement is a secure experience using HTTPS.
To remove the lab resources, delete all objects before attempting to delete the bucket. An S3 bucket cannot be deleted while it still contains objects.

Tool / Feature Decision Guide

Requirement or situation	Appropriate choice	Reason
Serve HTML, images, and other static files without an application server	S3 static website hosting	The content is static and can be served directly from S3.
Select the default page for the website endpoint	Index document setting	S3 uses the configured document, such as `index.html`, as the default page.
Allow anonymous visitors to retrieve website objects	Public access configuration plus an S3 bucket policy	Both the account or bucket public-access setting and the policy must permit the required access.
Provide a secure HTTPS experience for the S3-hosted site	CloudFront in front of the bucket	The demonstrated S3 static website endpoint is HTTP-only.
Remove the completed lab	Delete objects, then delete the bucket	The bucket must be empty before deletion.

Common Traps / Misconceptions

Mistaking the S3 website endpoint for HTTPS: The endpoint in this workflow uses HTTP. Seeing a browser warning that the site is not secure is expected.
Forgetting public access settings: A public bucket policy will not work as intended if the bucket still blocks all public access.
Granting access to the wrong resource: Use the bucket ARN with /* for object access. The policy must target the objects that visitors need to retrieve.
Using the wrong action: The required action is s3:GetObject, including the correct capitalization.
Uploading only the HTML file: The page may load but its images will fail if the referenced JPEG objects are missing or have different names.
Assuming alt text is an object key: Image descriptions improve the HTML document, but the src references still need the exact uploaded filenames.
Trying to delete a nonempty bucket: Delete every object first, then delete the bucket.
Treating public access as a default best practice: This configuration intentionally exposes objects publicly for a simple static website and should be used only when that exposure is appropriate.

Real-World Engineer / Analyst Notes

Treat disabling block public access and adding a wildcard-principal policy as an explicit exposure decision. Verify that the bucket contains only content intended for public viewing.
Keep object names consistent between the HTML source and S3. A typo or capitalization mismatch can produce broken images even when the website endpoint itself works.
Use the website endpoint to validate the complete delivery path: index document selection, object existence, policy evaluation, and browser rendering.
For a production secure delivery pattern, place CloudFront in front of the S3 content rather than relying on the HTTP-only website endpoint.
Clean up temporary lab resources after testing. Remove objects before deleting the bucket, and review whether any public-access changes should be reverted elsewhere.

Quick Reference Summary

Create a unique general purpose S3 bucket.
Leave ACLs disabled, but disable the setting that blocks all public access for this public website exercise.
Enable static website hosting in Properties.
Set the index document to index.html; an error document is optional.
Upload index.html and every image or other object referenced by the HTML.
Add a bucket policy allowing public s3:GetObject access to arn:aws:s3:::BUCKET-NAME/*.
Open the website endpoint from the bucket properties.
Remember that the endpoint is HTTP-only; use CloudFront when HTTPS is required.
Delete all objects before deleting the bucket.

Flashcards

Q: A team needs to host a simple HTML page and JPEG images without an application server. Which S3 capability should they enable?

A: Enable S3 static website hosting. It is designed to serve static objects such as HTML and images through a website endpoint.

Q: Which document should be configured as the index document for the demonstrated website?

A: Configure index.html. S3 loads the configured index document when visitors access the website endpoint.

Q: Is an error document required for this static website configuration?

A: No. The error document is optional in this workflow; only index.html is required for the demonstrated site.

Q: A bucket policy allows anonymous s3:GetObject, but visitors still cannot retrieve the website files. What configuration should you check first?

A: Check whether the bucket still has the setting that blocks all public access enabled. The public-access setting and the bucket policy must permit the intended public access.

Q: What principal and action are used to permit public retrieval of the website objects?

A: Use a wildcard principal, "*", with the s3:GetObject action. This allows anyone to retrieve the objects covered by the policy resource.

Q: Why does the object resource in the public bucket policy end with /*?

A: The suffix targets objects contained in the bucket. The bucket ARN alone does not identify all of the website objects that must be retrieved.

Q: An HTML page loads, but its images do not. What should you compare?

A: Compare the filenames in the HTML references with the exact uploaded S3 object keys, including spelling and capitalization. Missing or mismatched keys commonly cause broken images.

Q: When should CloudFront be chosen instead of relying directly on the S3 static website endpoint?

A: Choose CloudFront when the site must provide a secure HTTPS experience. The demonstrated S3 website endpoint is HTTP-only.

Q: What is the security implication of the demonstrated bucket policy?

A: It makes the covered objects publicly readable. Only content intended for public viewing should be placed in a bucket configured this way.

Q: Does disabling the block-all-public-access setting by itself make the objects readable by everyone?

A: No. It permits public access to be considered, but the bucket policy must also grant the required s3:GetObject permission.

Q: What must be done before an S3 bucket can be deleted?

A: Delete all objects in the bucket first. S3 does not allow deletion of a bucket that still contains objects.

Q: Which part of the policy requires especially careful syntax and capitalization?

A: The action, such as s3:GetObject, and the ARN/resource syntax must be exact. Invalid capitalization, commas, quotation marks, or ARN formatting can prevent the policy from working.

Practice Questions

Question 1

An engineer uploads index.html and three images to an S3 bucket. The website page loads, but all images appear broken. The HTML uses papaya.jpeg, while the uploaded object is named Papaya.jpeg. What is the most likely cause?

A. The bucket needs an error document

B. The image object key does not exactly match the HTML reference

C. The index document must be named default.html

D. CloudFront must be enabled before images can load

Correct answer: B. S3 object keys must match the references in the HTML, including spelling and capitalization. An error document and CloudFront are not required simply to load the referenced images.

Question 2

A public visitor receives an access-denied response from a static S3 website. The bucket policy allows s3:GetObject for Principal: "*", but the bucket still has the setting to block all public access enabled. What is the best explanation?

A. The index document must be stored in a different Region

B. S3 website hosting cannot serve JPEG files

C. The public-access block prevents the intended public access

D. The policy must use s3:ListBucket instead

Correct answer: C. The configuration must allow public access before the public object-read policy can provide the intended result. s3:ListBucket is not the object retrieval action used in this workflow.

Question 3

A product owner requires the S3-hosted static site to use HTTPS. Which approach best meets the requirement described in the lesson?

A. Configure an optional S3 error document

B. Add /* to the HTML filenames

C. Put CloudFront in front of the S3 bucket

D. Enable ACLs while leaving public access blocked

Correct answer: C. The demonstrated S3 static website endpoint is HTTP-only. CloudFront is the service identified in the lesson for providing a secure experience in front of the bucket.

Question 4

An administrator wants to grant public read access to all website objects. Which resource should be used in the bucket policy?

A. arn:aws:s3:::BUCKET-NAME/*

B. arn:aws:s3:::BUCKET-NAME/index.html/*

C. arn:aws:cloudfront:::BUCKET-NAME/*

D. arn:aws:s3:::BUCKET-NAME only, with no object suffix

Correct answer: A. The bucket ARN followed by /* targets the objects in the bucket, including index.html and the image files.

WordPress Metadata

Suggested Slug:
create-amazon-s3-static-website

Meta Description:
Learn how to configure an Amazon S3 static website, publish public objects with a bucket policy, and understand why CloudFront is required for HTTPS.

Tags:
Amazon S3, static website hosting, AWS networking, bucket policy, public access, CloudFront, AWS CloudOps, S3 permissions, HTTP, AWS certification

Create an Amazon S3 Static Website: Configuration, Public Access, and CloudFront Considerations