Hosting a Static Portfolio Website on AWS S3 using IAM

As part of an AWS learning journey, a static portfolio website was successfully deployed using Amazon S3 and secured with IAM best practices. The project highlighted the importance of understanding S3 static hosting, bucket policies, and IAM permissions.

While cloud storage offers scalability and cost-effectiveness, configuring permissions correctly is crucial; misconfigured S3 buckets have historically led to large-scale data breaches, costing organizations millions of dollars. This project demonstrates a secure approach to public website hosting.

Key Insights

S3 is case-sensitive, impacting image loading: 2024 observation during multiple S3 deployments.
IAM permissions directly control service visibility within the AWS console.
Bucket policies override Access Control Lists (ACLs) when both are present.
Least privilege is a critical security principle, limiting potential damage from compromised credentials.

Working Example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadAccess",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

Practical Applications

Personal Portfolio: Developers use S3 to host personal websites, showcasing skills and projects.
Pitfall: Overly permissive bucket policies (e.g., allowing s3:*) can expose sensitive data and lead to unauthorized access.

References:

On This Page

Hosting a Static Portfolio Website on AWS S3 using IAM