Context
A reference build showing how KubeKraft approaches static-site hosting for clients who don't need — and don't want to pay for — a managed platform's premium.
Problem
Managed static-hosting platforms (Amplify, Netlify's paid tiers, Vercel) charge a real premium for features a low-traffic site rarely uses: PR preview environments, managed CI, one-click domain wizards. For a solo consultant or small business site, that premium isn't buying much.
Approach
S3 for storage, CloudFront as the CDN with Origin Access Control (no public bucket), ACM for a free managed TLS certificate, and Route53 for DNS. Deploys run through GitHub Actions using OIDC federation — no long-lived AWS keys stored in CI. Infrastructure is defined in OpenTofu so the whole stack is reproducible and reviewable in a pull request before it touches production.
Outcome
Hosting cost drops to roughly $1-3/month (mostly the Route53 hosted-zone fee), CloudFront's free tier covers a year of egress at low traffic, and the owner keeps a real, auditable deploy pipeline instead of a black-box managed build.
Architecture
A private S3 bucket holds the built site output. CloudFront sits in front of it as the CDN and TLS terminator, using Origin Access Control so the bucket itself is never publicly reachable — only CloudFront can read from it. ACM issues and auto-renews the certificate at no cost. Route53 hosts DNS and points the domain at the CloudFront distribution via an alias record.
Deploy pipeline
A GitHub Actions workflow builds the site, assumes an IAM role via OIDC (scoped narrowly to s3:PutObject/ListBucket on the one bucket and cloudfront:CreateInvalidation on the one distribution), syncs the build output to S3, and invalidates the CloudFront cache. No AWS access keys are ever stored in GitHub Secrets.
Cost
At low traffic, the whole stack runs roughly $1-3/month — almost entirely the $0.50/month Route53 hosted-zone fee, since CloudFront’s free tier covers a full year of egress and S3 storage for a static site is negligible.
← All projects