Solution A β S3 + CloudFront + ACM + Route53
Private bucket, OAC-protected
Global CDN, TLS 1.2+
Free TLS certificate, auto-renew
ALIAS record, IPv4 + IPv6
Modular, remote state
GitHub Actions + OIDC
Deployed: