Private S3
All S3 public access blocked and bucket restricted to the CloudFront distribution.
Every deployment should be observable, least-privileged, and subject to explicit human approval for consequential operations.
Explore the architectureAll S3 public access blocked and bucket restricted to the CloudFront distribution.
ACM certificate validated with Route 53; HTTP redirects to HTTPS.
Use AWS credentials chain and an untracked .env file.
No arbitrary shell commands from model output.