You can deploy a static web app with a fully private S3 bucket by putting CloudFront in front of it and granting CloudFront exclusive access. The “legacy” style CloudFront distribution uses an Origin Access Identity (OAI) instead of the newer Origin Access Control (OAC).
- An AWS account with permissions for S3, CloudFront, and IAM.
- A built static website folder on your machine (for example containing
index.html, CSS, JS, and assets). - Optional but recommended: a registered domain (for example via Route 53) and an ACM certificate in
us-east-1if you want HTTPS on a custom domain.