Architecture: this site on AWS

This site runs entirely on managed AWS services: no servers to patch, nothing public that can be written to. The diagram is live: click any box or link to see what it does and why it’s there. Watch the packet trace a request from the viewer, through the edge, to the origin.

This site is also my longest-running experiment in building with AI: theme, diagrams, and deploy scripts all built in AI pair sessions, with the decisions (including what got parked) documented. The working-with-AI page has the verdicts.

seb@sebstack: ~/infra $ terraform graph | dot -Tsvg
HTTPS / TLSOAC · SigV4runs per requestViewerbrowser · clientCloudFrontCDN · edge cache · TLSCF Functionauth · URL rewriteS3 — privatesebstack-site · SSE-S3ACM · us-east-1HSTS · sec headers
request · client → edge → origin response · origin → edge → client
Click a component to inspect it.

Design decisions

One rule

Nothing public is writable, and the origin is never exposed.

Single public surface

CloudFront fronts everything; the S3 bucket stays private, locked to it by Origin Access Control.

Logic at the edge

A CloudFront Function does the small request-time work: staging auth and clean-URL rewrites.

Secure by default

TLS, HSTS and security headers, applied at the edge on every response.