Question

A media company hosts a static marketing website consisting of HTML, CSS, JavaScript, and large image assets in an Amazon S3 bucket. Visitors are distributed globally, and the company reports slow page loads in Asia and Europe. Requirements include: serving all content over HTTPS with a custom domain, minimizing latency worldwide, protecting against common web exploits such as SQL injection and cross-site scripting, and preventing direct public access to the S3 bucket. Which architecture best meets ALL these requirements with the least operational overhead?

Accepted Answer

Create a CloudFront distribution with the S3 bucket as origin using Origin Access Control (OAC), attach an ACM certificate in us-east-1 for the custom domain, and associate an AWS WAF web ACL with the distribution.

Answer

Enable S3 static website hosting with a public bucket policy, place an Application Load Balancer in front of the bucket with an ACM certificate, and attach AWS WAF to the ALB.

Answer

Replicate the S3 bucket to Regions in Asia and Europe with Cross-Region Replication, expose each bucket via S3 static website hosting, and use Route 53 latency-based routing to direct users to the nearest bucket.

Answer

Deploy the static content to EC2 instances behind an Auto Scaling group in multiple Regions, use Global Accelerator for low-latency routing, and place AWS WAF on the accelerator endpoints.