Origin of all HTTPS requests to your resume domain
Browser
user
HTTPS
DNS resolution yourname.com → CloudFront
Route 53
DNS
resolves
Global CDN · enforces HTTPS caches at 400+ edge locations
CloudFront
CDN + cache
forwards
Free SSL/TLS certificate must be in us-east-1
ACM
SSL · us-east-1
via OAC
Prevents S3 bucket leak only CloudFront can read origin
OAC
origin access control
private
Private bucket · no public URL serves index.html + assets
S3 bucket
private · static files
networking / DNS
delivery / CDN
security / certs
storage
Terraform IaC
Security: S3 bucket has no public endpoint. All access is routed through CloudFront via OAC —
eliminating the risk of accidental data exposure via direct S3 URLs. ACM certificate is provisioned in
us-east-1 (required by CloudFront). Least-privilege IAM policies enforced throughout.