Hosting a Static Website with Custom Domain and HTTPS Using S3 and CloudFront
A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?
Quick Answer
The answer is to use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket. This combination works because CloudFront acts as a content delivery network that can serve static content from an S3 origin while terminating HTTPS at the edge, using an ACM-issued certificate bound to the custom domain name. S3 alone cannot natively support custom SSL certificates, and services like ELB or Route 53 do not provide HTTPS termination for static hosting. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of edge-optimized architectures and the separation of storage from delivery—a common trap is assuming S3’s static website endpoint can handle HTTPS with a custom domain, which it cannot. Remember the memory tip: “CloudFront cures the HTTPS curse” — always pair a custom domain with CloudFront and ACM for secure static hosting.
⚠ Common exam trap
It's easy for candidates to assume S3 static website hosting can directly serve HTTPS with a custom domain and SSL certificate, but S3 does not support SSL termination or custom certificates on its website endpoint, making a CDN like CloudFront mandatory for HTTPS enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.
Amazon CloudFront can terminate HTTPS at the edge using an SSL certificate from AWS Certificate Manager (ACM), and it can be configured with an origin pointing to an S3 bucket configured for static website hosting. This combination allows the use of a custom domain name (e.g., www.example.com) via a CloudFront alternate domain name (CNAME) and enforces HTTPS for all client connections, which S3 static website hosting alone cannot natively support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.
Why it's wrong here
S3 static website hosting does not support custom SSL certificates.
- ✓
Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.
Why this is correct
CloudFront provides HTTPS and works with ACM.
- ✗
Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.
Why it's wrong here
DNSSEC does not provide HTTPS.
- ✗
Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.
Why it's wrong here
ALB cannot use S3 as a target directly.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?
easy- A.Use AWS Global Accelerator with endpoints pointing to the S3 bucket.
- B.Deploy EC2 instances in multiple Regions and use a load balancer.
- ✓ C.Use Amazon CloudFront with the S3 bucket as the origin.
- D.Host the content directly from the S3 bucket and use S3 Transfer Acceleration.
Why C: Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.