Create an Amazon S3 Static Website – SAP-C02 Study Guide

Purpose of This Lesson

Amazon S3 can host static websites consisting of HTML, CSS, JavaScript, images, and other browser-delivered files. This is useful for simple sites, prototypes, documentation, and demonstrations that do not require server-side processing.

This lesson covers the configuration required to publish a basic S3 static website and the security and architecture limitations that matter for the AWS Certified Solutions Architect – Professional exam.

Key Concepts

S3 static website hosting

An S3 bucket can be configured for static website hosting. The bucket uses an index document as the default page when a visitor accesses the website endpoint.

Typical static website objects include:

• index.html
• CSS and JavaScript files
• Images and other media
• An optional error document such as error.html

The index document name must match the object key uploaded to the bucket. For example, if the configuration specifies index.html, an object with that exact key must exist.

Public access requirements

A directly accessible S3 website must allow unauthenticated users to retrieve its objects. This normally requires:

1. Disabling the relevant S3 Block Public Access settings for the bucket or account scope.
2. Adding a bucket policy that permits public s3:GetObject access.
3. Ensuring the policy resource covers the objects in the bucket, not only the bucket itself.

A typical public-read policy pattern is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket-name/*"
    }
  ]
}

The /* suffix is important because s3:GetObject applies to object ARNs. The bucket ARN without the suffix identifies the bucket itself and does not represent all objects.

Website endpoint behavior

When static website hosting is enabled, S3 provides a regional website endpoint. Requests to this endpoint are handled as website requests rather than normal S3 API requests.

Important characteristics include:

• The endpoint serves the configured index document.
• An optional error document can be configured.
• The direct S3 website endpoint uses HTTP rather than HTTPS.
• Objects must be publicly readable when the endpoint is accessed directly.
• The website endpoint is intended for static content, not application-side execution.

CloudFront for HTTPS and distribution features

The direct S3 website endpoint does not provide HTTPS. For a secure public experience, place Amazon CloudFront in front of the content.

For a new architecture, a common pattern is:

• Use an S3 bucket as the origin.
• Keep the bucket private.
• Use CloudFront Origin Access Control (OAC) to authorize CloudFront to read the bucket.
• Allow users to access the content only through the CloudFront distribution.
• Attach an ACM certificate for a custom HTTPS domain.

CloudFront can also provide caching, edge delivery, custom domains, security headers, and integration with AWS WAF. S3 website endpoints may be used as CloudFront custom origins, but this approach generally requires public access to the website endpoint. Using the S3 REST endpoint with OAC is usually preferable when private origin access is required.

Bucket deletion

An S3 bucket must be empty before it can be deleted. All objects, object versions, delete markers, and potentially multipart-upload remnants must be addressed when deleting a versioned or heavily used bucket.

Exam-Relevant Takeaways

• S3 static website hosting is suitable for static files only; it does not execute server-side code.
• The configured index document must be uploaded with the matching object key.
• A direct S3 website endpoint is HTTP-only.
• Public website access requires public object reads, which conflicts with S3 Block Public Access settings.
• The bucket policy generally uses Principal: "*", Action: "s3:GetObject", and a resource such as arn:aws:s3:::bucket-name/*.
• The bucket ARN and object ARN are different. arn:aws:s3:::bucket-name identifies the bucket; arn:aws:s3:::bucket-name/* covers objects.
• CloudFront is the usual solution for HTTPS, caching, custom domains, and edge delivery.
• CloudFront OAC allows a stronger design in which the S3 bucket remains private.
• S3 website hosting and S3 REST API access are different endpoint behaviors; do not treat them as interchangeable.
• S3 buckets must be emptied before deletion.

Architecture Decision Guide

Requirement	Recommended approach	Key consideration
Simple public static site for testing	S3 static website endpoint	Requires public access and provides HTTP only
Public static site requiring HTTPS	CloudFront in front of S3	Use an ACM certificate and configure the distribution correctly
Private S3 origin with public delivery through CDN	CloudFront with S3 REST origin and OAC	Keep Block Public Access enabled and authorize CloudFront in the bucket policy
Dynamic application or server-side rendering	Compute or managed application service behind a suitable load balancer/API	S3 static hosting cannot execute backend code
Custom domain	Route 53 alias or DNS record to CloudFront	HTTPS certificate must be provisioned in us-east-1 for CloudFront
Custom error handling	Configure an S3 error document or CloudFront custom error response	Behavior differs between website endpoints and REST origins

Common Exam Traps

• Assuming S3 website endpoints support HTTPS: They do not. Use CloudFront for HTTPS.
• Using only the bucket ARN in a GetObject policy: Object access requires an object resource, commonly bucket-arn/*.
• Leaving Block Public Access enabled while expecting direct public access: S3 will reject or block the public policy depending on the applicable settings.
• Confusing website hosting with normal S3 object URLs: Website endpoints support index and error document behavior; REST endpoints expose S3 API/object behavior.
• Making the bucket public when CloudFront OAC is available: For production designs, prefer a private bucket with CloudFront OAC unless website-endpoint-specific behavior is required.
• Expecting S3 to run application code: S3 serves objects; it does not provide server-side execution.
• Forgetting exact object-key matching: Index.html, /index.html, and index.html are not interchangeable object keys in the way a local filesystem path might suggest.
• Assuming deleting the bucket automatically deletes its contents: The bucket must be emptied first.

Real-World Engineer Notes

• Avoid public S3 buckets for production workloads unless public object delivery is explicitly required and the exposure is understood.
• For a production static site, CloudFront with OAC, HTTPS, a custom domain, and appropriate response headers is generally a stronger architecture.
• Consider enabling S3 versioning and lifecycle rules where recovery, retention, or cleanup requirements justify them.
• Restrict deployment permissions separately from website read permissions. A public-read policy should not grant public write or delete access.
• Keep object names and references consistent. Broken relative paths are a common cause of missing images and stylesheets after migration to S3.
• If using CloudFront, remember that newly uploaded or replaced objects may remain cached until expiration or an invalidation is performed.
• Static website hosting can be cost-effective, but review request, data-transfer, CloudFront, logging, and storage charges for production traffic.

Quick Reference Summary

• Default page: Configure an index document such as index.html.
• Direct public access: Requires public object reads and compatible Block Public Access settings.
• Read permission: s3:GetObject.
• Object policy resource: arn:aws:s3:::bucket-name/*.
• Direct website protocol: HTTP only.
• HTTPS and CDN: Use CloudFront.
• Private origin pattern: S3 REST origin plus CloudFront OAC.
• Deletion requirement: Empty the bucket before deleting it.

Flashcards

1. Q: What type of content can S3 static website hosting serve?

A: Static objects such as HTML, CSS, JavaScript, images, and other files; it does not execute server-side application code.

1. Q: What is the purpose of the S3 index document setting?

A: It specifies the object, commonly index.html, returned as the default page for a website request.

1. Q: Does the direct S3 static website endpoint support HTTPS?

A: No. HTTPS generally requires CloudFront or another HTTPS-capable front end.

1. Q: What permission is commonly required for public website visitors?

A: s3:GetObject.

1. Q: What principal represents unauthenticated users in a public-read bucket policy?

A: "Principal": "*".

1. Q: Why does a public-read object policy commonly end with /*?

A: The suffix targets objects inside the bucket rather than only the bucket resource.

1. Q: What S3 setting can block an otherwise valid public bucket policy?

A: S3 Block Public Access.

1. Q: What is the preferred CloudFront mechanism for accessing a private S3 origin?

A: Origin Access Control, or OAC.

1. Q: What must happen before an S3 bucket can be deleted?

A: All objects and, where applicable, object versions and delete markers must be removed.

1. Q: How do S3 website and REST endpoints differ?

A: Website endpoints provide website features such as index/error document handling, while REST endpoints provide S3 object/API behavior.

Practice Questions

Question 1

A company hosts a static website directly from an S3 website endpoint. Visitors report that browsers display a security warning because the site is accessed over HTTP. What is the most appropriate solution?

A. Enable S3 Transfer Acceleration
B. Enable S3 default encryption
C. Place Amazon CloudFront in front of the content and attach an ACM certificate
D. Add s3:PutObject to the bucket policy

Correct answer: C

Explanation: The direct S3 website endpoint is HTTP-only. CloudFront provides HTTPS termination and can use an ACM certificate for the website’s custom domain. Encryption at rest and upload permissions do not provide HTTPS delivery.

Question 2

An administrator adds a bucket policy allowing s3:GetObject on arn:aws:s3:::static-site-bucket, but anonymous users cannot retrieve index.html. What is the most likely issue?

A. The policy resource does not cover objects
B. The index document must be stored in Glacier Flexible Retrieval
C. S3 requires s3:ListBucket for every website visitor
D. The bucket must use S3 One Zone-IA

Correct answer: A

Explanation: arn:aws:s3:::static-site-bucket identifies the bucket, not its objects. The object permission should target an object ARN pattern such as arn:aws:s3:::static-site-bucket/*.

Question 3

A solutions architect must serve a public static site through CloudFront while ensuring that users cannot bypass CloudFront and access the S3 bucket directly. Which design best satisfies the requirement?

A. Make the S3 bucket public and use an S3 website endpoint as the CloudFront origin
B. Use an S3 REST origin, keep Block Public Access enabled, and authorize CloudFront with OAC
C. Give all anonymous users s3:ListBucket and s3:GetObject
D. Use an internet-facing Application Load Balancer as the S3 origin

Correct answer: B

Explanation: CloudFront OAC supports private S3 origins. The bucket remains non-public, and its policy grants read access to the CloudFront distribution rather than to everyone on the internet.

Question 4

A static S3 website returns an access-denied error after its administrator adds a public-read bucket policy. Which two areas should be checked first? (Choose two.)

A. Whether applicable S3 Block Public Access settings are blocking the policy
B. Whether the index document name exactly matches the uploaded object key
C. Whether the bucket has an RDS read replica
D. Whether the objects are stored on an EC2 instance

Correct answers: A and B

Explanation: Block Public Access can prevent anonymous access even when a public policy exists. The website configuration must also reference an object key that matches the uploaded index file exactly.

Question 5

A developer wants to host a static frontend in S3 but also needs server-side API processing for authenticated requests. Which statement is correct?

A. S3 static website hosting executes backend code in response to requests
B. S3 static website hosting supports only static content; the API requires another service such as API Gateway with Lambda or a container-based backend
C. S3 automatically converts JavaScript into server-side code
D. CloudFront alone provides arbitrary server-side application execution

Correct answer: B

Explanation: S3 serves static objects only. Dynamic functionality must be implemented using an appropriate backend architecture, such as API Gateway and Lambda, containers, or other compute services.