Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallYou can host a static portfolio on AWS without running a server. Upload the built site files to an Amazon S3 bucket, serve them through an Amazon CloudFront distribution so visitors get HTTPS, and point your custom domain at that distribution with Amazon Route 53. Docker is not part of that production path. It is useful for previewing the site locally, or later if your portfolio needs a server-side runtime.
What each service does in this setup
Each service has a narrow job. Knowing which one is responsible for which part makes the setup much easier to troubleshoot.
| Service | Role for a portfolio | Needed for a static portfolio? |
|---|---|---|
| Amazon S3 | Stores your HTML, CSS, JavaScript, and images. Its static website hosting feature serves files and client-side scripts, but it does not run server-side code. | Yes, as the file store |
| Amazon CloudFront | Delivers the files from edge locations, caches them, and provides HTTPS for your domain. | Yes, for HTTPS and for keeping the bucket private |
| AWS Certificate Manager (ACM) | Issues the TLS certificate that CloudFront presents for your custom domain. | Yes, if you use a custom domain over HTTPS |
| Amazon Route 53 | Hosts the DNS records that send your domain name to the CloudFront distribution. | Yes if you use Route 53 for DNS |
| Docker | Packages an application and its dependencies into a container image. | No. Optional for local preview or a server-side app |
| AWS Amplify Hosting | A managed hosting service for static sites and front-end apps, with a built-in build and deploy workflow. | No. A managed alternative to the S3 and CloudFront stack |
The architecture you are building
Visitors never talk to the S3 bucket directly. The request flows in one direction:
- The browser resolves your domain through a Route 53 alias record to the CloudFront distribution.
- CloudFront presents an ACM certificate, redirects HTTP to HTTPS, and returns a cached copy of the file when one is available.
- When CloudFront needs a file it does not have, it fetches it from the private S3 bucket, using origin access control (OAC) to prove it is allowed to.
The S3 bucket keeps Block Public Access enabled. That is the secure default AWS recommends for this pattern, and it means the only public path to your files is through CloudFront.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
Before you start
- An AWS account with permission to use S3, CloudFront, ACM, and Route 53.
- A portfolio that has been built into static files. You need an
index.htmlat the root of the output folder, plus any CSS, JavaScript, and images it references. - A domain name. If you want a custom domain on CloudFront, the domain’s DNS must be managed in a Route 53 hosted zone (or you must be prepared to create the DNS records elsewhere and handle validation yourself).
- Optional: the AWS CLI, used in the cache invalidation step below.
AWS console labels and layouts change over time. The steps below follow the current structure of the console as of October 2026, but use them as a map and confirm each label on screen.
Step-by-step: S3 and CloudFront
Step 1: Create the build output
Run your site’s build command so that the deployable files exist as plain files. A plain HTML portfolio can be uploaded as is. A framework such as Astro, Next.js (static export), or Vite produces a folder such as dist/ or out/. Upload the contents of that folder, not the folder itself, so that index.html sits at the bucket root.
Step 2: Create a private S3 bucket
- Open the S3 console and choose Create bucket.
- Enter a bucket name. Names must be unique across all of AWS, so choose one that is specific to your portfolio.
- Pick an AWS Region close to you. Your visitors are served from CloudFront’s edge network regardless of this choice.
- Under Block Public Access settings for this bucket, leave all four options enabled.
- Choose Create bucket.
Step 3: Upload the site files
Open the bucket, choose Upload, then Add files and Add folder as needed. Confirm that index.html appears at the top level of the bucket, not inside a nested folder. If the upload contains a parent folder, your default root object will not match and the site will fail to load at the root URL.
Step 4: Understand the S3 website endpoint before you use it
S3 static website hosting, found under Properties then Static website hosting, gives you a website endpoint with an index document of index.html and an optional error document such as 404.html. The endpoint serves plain HTTP only and does not support HTTPS. The AWS tutorial for this feature asks you to remove the Block Public Access restriction and add a public-read bucket policy so the endpoint works. That is a learning shortcut. For a production portfolio, do not leave the bucket public. Use the endpoint to confirm the files render, then continue to CloudFront and keep the bucket private.
Step 5: Create a CloudFront distribution with origin access control
- Open the CloudFront console and choose Create distribution.
- For Origin domain, select your S3 bucket from the list. Choose the bucket’s regional REST endpoint, not the website endpoint from Step 4. The website endpoint cannot use OAC.
- Under Origin access, choose Origin access control settings (recommended), then create a new OAC with the default signing settings.
- Under Viewer protocol policy, choose Redirect HTTP to HTTPS.
- Set Default root object to
index.html. - Choose Create distribution. CloudFront displays a bucket policy statement to copy.
- Open the S3 bucket, go to Permissions, and edit the Bucket policy. Paste the statement that CloudFront generated. Use the generated policy rather than writing one by hand, because it includes the distribution’s exact ARN in its condition.
When the distribution finishes deploying, its status changes from Deploying to Enabled. The distribution has a generated domain name ending in cloudfront.net. Open it to test the site before you add your own domain.
Step 6: Request a certificate for your custom domain
CloudFront only accepts ACM certificates issued in the US East (N. Virginia) Region, so switch the region selector to that Region before you request the certificate. AWS’s documented sample secure static site also deploys its template in US East (N. Virginia).
Rank #3
- Open AWS Certificate Manager in US East (N. Virginia) and choose Request a certificate, then Request a public certificate.
- Add your domain name, for example the apex domain and a
wwwsubdomain if you want both. - Choose DNS validation. For a domain hosted in Route 53, choose Create records in Route 53 so ACM adds the validation CNAME records for you.
- Wait until the certificate status shows Issued. A certificate stuck in Pending validation usually means the validation record is missing or the domain’s DNS is not hosted where you expect.
Step 7: Attach the domain and certificate to CloudFront
- Open your distribution and go to the General tab, then choose Edit in the settings section.
- Under Alternate domain names (CNAMEs), add each hostname you want to serve, one per line.
- Under Custom SSL certificate, select the certificate you issued in Step 6.
- Save the changes and wait for the distribution to return to Enabled.
Step 8: Point the domain at CloudFront in Route 53
- Open the Route 53 console, choose Hosted zones, and select the zone for your domain.
- Choose Create record. Leave the record name empty for the apex domain, or enter
wwwfor the subdomain. - Set Record type to A and turn on Alias.
- Under Route traffic to, choose Alias to CloudFront distribution and select your distribution from the list.
- Choose Create records. Repeat for each hostname. Optionally add an AAAA alias record if you want IPv6.
DNS changes can take time to reach all resolvers. Until they do, your domain may return an error or the old record while the cloudfront.net address keeps working.
Where Docker fits
Docker builds a container image from a Dockerfile, and it can package a web server with your files so the site runs the same way on any machine. Docker’s own quickstart uses this approach to serve a simple static site with an Nginx container. That is a valid way to preview or run the portfolio, but it is not a requirement of the S3 and CloudFront architecture. Hosting the files in S3 does not need a running container, and a container in production would need a separate place to run, such as a container service in AWS, which is a different design from this guide.
A minimal local preview looks like this. Put the Dockerfile in the project root, next to your build output folder.
FROM nginx:alpine
COPY dist/ /usr/share/nginx/html/Replace dist/ with your build output folder, then run:
docker build -t portfolio-local .
docker run --rm -p 8080:80 portfolio-localOpen http://localhost:8080 in a browser. Pressing Ctrl+C stops the container. Nothing in this preview is uploaded to AWS.
Amplify Hosting as the alternative
AWS Amplify Hosting is a managed option for static sites and front-end apps. It connects to a Git repository, runs the build, deploys the output, and manages a domain and HTTPS for you. The trade-off is less direct control over each layer. The table compares the two approaches on the points that usually decide the choice.
Best Value
| Factor | S3 and CloudFront (this guide) | Amplify Hosting |
|---|---|---|
| Setup effort | Several manual steps across S3, CloudFront, ACM, and Route 53 | Connect a repository and configure the build and domain in one console flow |
| Control | You set origin access, cache behavior, error responses, and headers directly | Configuration is managed by the service within its supported options |
| Security configuration | You keep the bucket private and write the OAC policy yourself, following the steps above | Hosting and HTTPS configuration are handled by the service |
| Cost model | Usage-based S3 and CloudFront charges, plus any domain fee | Usage-based charges for the Amplify service, plus any domain fee |
| Best fit | Readers who want to learn the underlying services or need fine control over delivery | Readers who want the fastest route to a live site and a Git-based deploy |
Neither option is the right answer for every portfolio. If your goal is a working site with minimal configuration, Amplify is the simpler path. If your goal is to understand how the pieces connect, the S3 and CloudFront route teaches more.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the hosting costs
Costs depend on usage, region, and configuration, so no single monthly figure applies to every portfolio. The cost drivers are:
- S3: the amount of data you store, the number of requests, and any data transferred out.
- CloudFront: the number of requests, the edge locations that serve them, and the data transferred to visitors.
- Route 53: the hosted zone and DNS query charges, and the annual fee to register the domain.
- Amplify Hosting (if used): usage-based charges for build, hosting, and data served, which differ from the S3 and CloudFront model.
Domain registration fees vary by top-level domain. AWS’s Route 53 onboarding page gives example annual fees from about $9 to several hundred dollars, depending on the domain extension. That page does not show a date, so treat the range as illustrative and check current Route 53 domain pricing for the extension you want. For a monthly estimate, use the AWS Pricing Calculator with your expected traffic and file sizes.
Security checklist
- Keep all four Block Public Access settings enabled on the bucket that stores your files.
- Allow only the CloudFront distribution to read from the bucket, using the OAC bucket policy.
- Use Redirect HTTP to HTTPS on the viewer protocol policy so every visitor reaches the HTTPS version.
- Do not place secrets, API keys, or private files in the build output. Anything in the bucket can be read by anyone who has the URL through CloudFront.
- Remove the public-read bucket policy and the public access settings if you followed the S3 website endpoint tutorial to test the files.
Updating the site and clearing the cache
CloudFront caches copies of your files at edge locations. After you upload a new version, visitors may still see the old page until the cached copy expires. To force an update, create an invalidation for the paths that changed. For the whole site, invalidate everything:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →aws cloudfront create-invalidation --distribution-id E1ABCDEXAMPLE --paths "/*"Replace E1ABCDEXAMPLE with the ID shown on your distribution’s page. An invalidation takes a short time to complete, and AWS charges for invalidation paths beyond its monthly allowance, so invalidate only the paths you need when possible. Cache behavior is a delivery feature, not a guarantee that every visitor sees the newest version immediately.
Troubleshooting
- CloudFront returns 403 AccessDenied. The bucket policy is missing, or it does not match the distribution. Open the origin settings, copy the current policy statement again, and confirm the bucket policy contains the same distribution ARN.
- The root URL returns a 404 or an XML error page. The default root object is not set to
index.html, orindex.htmlis inside a subfolder in the bucket. - Subpages break when you refresh. This is typical of single-page apps that rely on client-side routing. Add custom error responses on the distribution that map 403 and 404 responses to
/index.htmlwith a 200 status. - The certificate does not appear in the CloudFront list. It was requested outside US East (N. Virginia), or it is still in Pending validation.
- Your custom domain shows the wrong site or a DNS error. The Route 53 record is not an alias to the CloudFront distribution, the hostname is missing from the alternate domain names, or DNS changes have not propagated yet.
- The site shows old content after an upload. Create an invalidation as shown above.
If you started with the S3 website endpoint and it works but CloudFront does not, check the origin first. The website endpoint and the REST endpoint are different, and OAC works only with the REST endpoint.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
