Case Study Overview

This portfolio is hosted as a production-style AWS edge delivery stack with S3 as the private content origin, CloudFront as CDN and TLS termination, Route 53 for authoritative DNS routing, AWS WAF for edge protection, and IAM-driven least-privilege operations. The objective was to deliver secure, fast, and repeatable static hosting with clean operational controls.

Key Factors

• Private S3 origin behind CloudFront OAC, with public bucket access fully blocked.
• Route 53 hosted zone with alias records to CloudFront and verified AWS nameserver delegation.
• ACM certificate lifecycle integrated with CloudFront for enforced HTTPS and modern TLS policy.
• AWS WAF managed protections and rate limits to reduce common web attack surface at the edge.
• IAM role separation for deploy, DNS update, and read-only audit actions.

Debugging and Resolution Process

During rollout, DNS was not resolving the domain to the S3/CloudFront path as expected. I used nslookup to validate the active nameservers returned by the registrar-side delegation, then cross-checked that set against Route 53 hosted zone nameservers. I also hit a certificate issuance stall in ACM because validation and edge association were not completing while domain traffic and DNS responses were inconsistent. To validate end-to-end behavior, I used ping for baseline network reachability and curl with header inspection to confirm target resolution, response metadata, and error states.

• Corrected delegation drift by updating registrar NS records to the exact Route 53 hosted zone nameserver set.
• Rebuilt the DNS cutover as: apex A/AAAA alias to CloudFront, www CNAME to apex policy, and removed conflicting legacy records.
• Reissued ACM in us-east-1 for CloudFront compatibility, then recreated DNS validation CNAME records in the authoritative hosted zone.
• Attached WAF web ACL at distribution level and tightened default behavior to HTTPS-only with redirect and cache policy normalization.
• Executed CloudFront invalidation after origin policy and certificate changes to flush stale edge states and force clean propagation.

Lessons Learned and Efficiency Gains

• Resolved: DNS alias and certificate validation blockers that prevented stable HTTPS delivery.
• Improved efficiency: standardized a deployment checklist for NS delegation, ACM validation, alias record creation, and CloudFront validation tests.
• Streamlined troubleshooting: adopted a repeatable validation sequence using nslookup, DNS record verification, ping, curl -I, and CloudFront status checks.
• Operational improvement: reduced rollback risk by isolating IAM permissions per task and documenting a clean recovery path for DNS and TLS misconfiguration.
• What I learned: edge delivery issues are usually dependency-order problems, so strict sequencing across DNS, certificate, and distribution configuration is critical.

AWS Implementation Breakdown