Hosting a Static Website with Custom Domain and HTTPS Using S3 and CloudFront
A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?
Quick Answer
The answer is to use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket. This combination works because CloudFront acts as a content delivery network that can serve static content from an S3 origin while terminating HTTPS at the edge, using an ACM-issued certificate bound to the custom domain name. S3 alone cannot natively support custom SSL certificates, and services like ELB or Route 53 do not provide HTTPS termination for static hosting. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of edge-optimized architectures and the separation of storage from delivery—a common trap is assuming S3’s static website endpoint can handle HTTPS with a custom domain, which it cannot. Remember the memory tip: “CloudFront cures the HTTPS curse” — always pair a custom domain with CloudFront and ACM for secure static hosting.
⚠ Common exam trap
It's easy for candidates to assume S3 static website hosting can directly serve HTTPS with a custom domain and SSL certificate, but S3 does not support SSL termination or custom certificates on its website endpoint, making a CDN like CloudFront mandatory for HTTPS enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.
Amazon CloudFront can terminate HTTPS at the edge using an SSL certificate from AWS Certificate Manager (ACM), and it can be configured with an origin pointing to an S3 bucket configured for static website hosting. This combination allows the use of a custom domain name (e.g., www.example.com) via a CloudFront alternate domain name (CNAME) and enforces HTTPS for all client connections, which S3 static website hosting alone cannot natively support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.
Why it's wrong here
AWS Certificate Manager certificates cannot be attached directly to an S3 bucket; S3 static website endpoints serve HTTP only. ACM certificates must be deployed on CloudFront or an Application Load Balancer, which is why this combination cannot enforce HTTPS.
- ✓
Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.
Why this is correct
CloudFront terminates HTTPS at the edge using the ACM certificate, then fetches content from the S3 bucket origin. ACM certificates cannot be attached directly to S3 static website endpoints, so CloudFront is required to enforce HTTPS on the custom domain.
- ✗
Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.
Why it's wrong here
DNSSEC cryptographically signs DNS responses to prevent spoofing; it does not encrypt HTTP traffic, so HTTPS is not enforced. Route 53 alias records do map a custom domain to an S3 website endpoint, but DNSSEC addresses authenticity, not transport encryption.
- ✗
Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.
Why it's wrong here
An Application Load Balancer operates at layer 7 and requires registered targets; an S3 bucket is not a supported target type, so it cannot front static content. ALBs suit dynamic applications on EC2, Lambda or containers, not S3 website hosting.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?
easy- A.Use AWS Global Accelerator with endpoints pointing to the S3 bucket.
- B.Deploy EC2 instances in multiple Regions and use a load balancer.
- ✓ C.Use Amazon CloudFront with the S3 bucket as the origin.
- D.Host the content directly from the S3 bucket and use S3 Transfer Acceleration.
Why C: Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.