S3 Static Hosting, CloudFront & Interview Questions

S3 Static Website Hosting

S3 can serve static websites directly. The website endpoint differs from the REST API endpoint and supports index/error documents and redirect rules.

# Enable static website hosting
aws s3api put-bucket-website --bucket my-bucket \
  --website-configuration '{
    "IndexDocument": {"Suffix": "index.html"},
    "ErrorDocument": {"Key": "404.html"}
  }'

# Website endpoint format (not the REST API endpoint):
# http://my-bucket.s3-website-eu-west-1.amazonaws.com

# Must also allow public access (for a truly public site)
aws s3api put-bucket-policy --bucket my-bucket --policy '{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}'

CloudFront + S3 (Production Setup)

CloudFront distributes content globally via edge locations, adds HTTPS with custom domains, caching, and WAF integration. Use OAC (Origin Access Control) to keep S3 private.

# Modern approach: OAC (replaces OAI)
# 1. Create CloudFront distribution pointing to S3 origin
# 2. Enable OAC on origin (no public bucket policy needed)
# 3. CloudFront attaches sigv4 request to S3 — only CF can read

# Invalidate CloudFront cache after deployment
aws cloudfront create-invalidation \
  --distribution-id ABCDEF123456 \
  --paths "/*"

# Invalidate specific paths
aws cloudfront create-invalidation \
  --distribution-id ABCDEF123456 \
  --paths "/index.html" "/static/js/*"

S3 Replication

# Cross-Region Replication (CRR) — requires versioning on both buckets
aws s3api put-bucket-replication --bucket source-bucket \
  --replication-configuration '{
    "Role": "arn:aws:iam::123456789012:role/s3-replication-role",
    "Rules": [{
      "Status": "Enabled",
      "Filter": {"Prefix": ""},
      "Destination": {
        "Bucket": "arn:aws:s3:::dest-bucket-eu",
        "StorageClass": "STANDARD_IA"
      }
    }]
  }'

• CRR (Cross-Region): disaster recovery, data sovereignty, latency reduction

• SRR (Same-Region): log aggregation across accounts, dev/prod data sync

• Replication does not apply to objects that existed before rule was created

• Delete markers not replicated by default (configure DeleteMarkerReplication)

S3 Event Notifications

// Trigger Lambda on object upload
{
  "LambdaFunctionConfigurations": [{
    "LambdaFunctionArn": "arn:aws:lambda:eu-west-1:123:function:process-upload",
    "Events": ["s3:ObjectCreated:*"],
    "Filter": {
      "Key": {
        "FilterRules": [
          {"Name": "prefix", "Value": "uploads/"},
          {"Name": "suffix", "Value": ".jpg"}
        ]
      }
    }
  }]
}

S3 Transfer Acceleration

# Enable Transfer Acceleration (uses CloudFront edge for upload path)
aws s3api put-bucket-accelerate-configuration \
  --bucket my-bucket \
  --accelerate-configuration Status=Enabled

# Use accelerated endpoint for uploads from distant clients
aws s3 cp large-file.zip s3://my-bucket/ \
  --endpoint-url https://my-bucket.s3-accelerate.amazonaws.com

Interview Questions

• S3 vs EFS vs EBS? S3=object storage (web scale, any size), EFS=shared NFS for EC2 (managed filesystem), EBS=block storage attached to single EC2 (like a hard drive)

• How to make S3 access faster globally? CloudFront CDN for reads; S3 Transfer Acceleration for uploads; choose bucket region close to users

• S3 consistency model? Strong read-after-write consistency for all operations since Dec 2020 — no need for consistency workarounds anymore

• How to prevent accidental deletion? Enable versioning + Object Lock; use MFA Delete; restrict DeleteObject via IAM; lifecycle rules for noncurrent version retention

• Cost optimization in S3? Lifecycle rules to cheaper storage classes; S3 Intelligent-Tiering for unknown access; analyze with S3 Storage Lens; delete incomplete multipart uploads; enable S3 Inventory to find unused objects

• Cross-account S3 access? Bucket policy grants the other account; that account's IAM must also allow it (both resource and identity policy needed)

• What is an S3 presigned URL? A time-limited signed URL allowing temporary GET or PUT without AWS credentials; generated server-side, used client-side