CloudFront, S3, and the edge
This site runs on S3 behind CloudFront, deployed by one script that a person has to type YES into. Everything below came out of operating it: the security policy that blanked two sibling domains for eighteen days, the edge function that does the redirects, the password gate on staging, and the build pipeline that turns markdown into something worth uploading.
These are field notes, not tutorials. Each one is a problem I hit, what it actually cost, and what I would do differently.
A CSP that allowlists inline scripts by sha256 hash will take the whole site down the first time you edit one, and the failure looks like a working page serving nothing. What the policy has to contain, and why the hash approach is a trap worth escaping.
There is no origin to authenticate against on a static site, so the gate has to live at the edge. Basic auth in a viewer-request function, in about forty lines, with the credential kept out of the source.
Two hundred services, and the ones that carry a small production system fit on one hand. What you actually need to run a site, and what the rest of the console is for.
Why one platform reasons in constraints you can solve and the other in forces you have to live with, and what that changes about how you hold each one in your head.
Consistency and availability are not preferences you express. The partition decides, and every database you use has already answered on your behalf.
The rule that removes a whole class of bug from a build pipeline: exactly one process may write any given output, and everything else reads.
What a content build pipeline turns out to be once it has a cache, a rebuild step and a freshness problem, which is to say the thing data engineers named twenty years ago.
Cutting a build in half without changing what it produces, and the measurement discipline that keeps the second half honest.
The distributed-systems and AWS Solutions Architect material is a separate series: one concept per episode, arranged as a building you walk wing by wing. Consistency, consensus, cost, security, and the capstone designs that use the whole map.
Walk the Learning Maps series , or start with The Descent , every decision fork in the SAA-C03 laid out at once.
Most of this infrastructure work now happens with agents in the loop. That side of the practice lives at AI-assisted engineering . The reasoning about why a complex system has to be charted rather than simplified is at Making Complexity Visible .