Route 53 DNS Migration
A zone moved with every record accounted for, and the TTLs lowered before the change rather than after.
From $199 1–2 days
S3 + CloudFront Website / CDN
Static hosting where the bucket is private, the certificate is right, and deploys invalidate the cache.
Price and scope
From $249
Typically $249–$549, fixed in writing before anything starts.
What moves it up
- Cache behaviour that has to differ by path, rather than one rule for everything
- Signed URLs or signed cookies, because some of it is not meant to be public
- An existing distribution to correct rather than a new one to build
Some of this you can check yourself, right now, for free: SSL Certificate Checker →
What actually goes wrong
This one has a signature failure and it is always the same: the bucket was made public to get the site working. It works, so nobody revisits it, and now the origin is directly reachable — CloudFront is a cache in front of a website that is already on the internet, so every rule set at the edge can be walked straight past. The second is quieter. The deploy uploads new HTML and new JavaScript, the cache is never invalidated, and for the next day some visitors get yesterday's script running against today's markup.
How I find it
aws s3api get-public-access-block --bucket <name> — all four settings, not just the firstcurl -I against the bucket's own website endpoint, to see whether the origin answers directlyaws cloudfront get-distribution-config, read for an origin access control rather than a public originaws acm list-certificates --region us-east-1 — the only region CloudFront will take one from
What you get
- A private bucket with public access blocked, reachable only through the distribution
- Origin access control configured, so the origin has one caller and it is CloudFront
- HTTPS with a certificate in us-east-1, HTTP redirected, and modern TLS only
- Cache behaviour set per path, with immutable assets cached long and HTML cached short
- An invalidation step in your deploy, so a release cannot serve mixed versions
Questions
Why does my certificate have to be in a specific region?
CloudFront only reads certificates from ACM in us-east-1, wherever your bucket or your users are. It is an AWS constraint rather than a design choice, and it is the single most common reason a distribution refuses a custom domain.
My bucket is public and everything works. Why change it?
Because anything you enforce at the edge — a WAF rule, a geo restriction, a signed URL — is only enforced for people who go through the edge. A public origin means they do not have to.
Can this host a React or Next.js build?
A static export, yes, including the routing rewrite that makes client-side routes return the right page rather than a 403. Anything needing server-side rendering at request time is a different architecture and I will say which one you have before quoting.
How much will CloudFront cost me?
For a small site, usually less than the EC2 instance it replaces — it is priced on transfer and requests, with a free tier that covers a lot of traffic. I will estimate it from your actual figures rather than quoting a number that suits the pitch.
If this is not quite it
Website / Application Migration to AWS
Moved onto AWS with the cutover rehearsed, the DNS planned, and the old host still standing.
From $459 2–5 days
Want this done?
Tell me what you are running and I will come back with a fixed price and a date. If it turns out you do not need this, I will say that instead.
Prefer to talk? Book a free call ↗ · Or hire me on Upwork ↗ · Typical reply within one business day.
Before you enquire
When I answer
Sunday to Thursday, 09:00–18:00 EET. Outside that I will still look, but I will not promise a time.
No 24/7 desk, and I will not pretend otherwise
One person, one time zone. If round-the-clock cover is what you need, you need a team, and I will say so rather than sell you a plan that cannot deliver it.
Your AWS bill stays yours
You pay Amazon directly and you keep control of the account. Nothing here resells your infrastructure or sits between you and your own billing.
A price that starts with "from" is a starting price
Every service page lists exactly what pushes a quote above it, before you ask. You get a fixed number in writing before any work begins.