Natnael Mengesha

This Site, As Built

The portfolio practices what it draws: private origin, signed edge, strict CSP, $0.51/mo.

CloudFront · S3 OAC · Terraform · Strict CSP · Serverless

$0.51
Monthly run cost
0
Servers to patch
0
Third-party scripts
PUBLIC INTERNET Visitor Browser, HTTPS only EDGE (GLOBAL) natnael.co zone Amazon Route 53 Distribution CloudFront + ACM URL router CloudFront Function AWS ACCOUNT Site origin Amazon S3, private Contact handler Lambda URL (planned) Outbound mail SES v2 (planned) 1 · DNS lookup 2 · HTTPS 3 · rewrite URI 4 · OAC signed GET /api/contact SendEmail
Fig. 1 — Edge delivery from private origin; contact path (planned) at /api/contact.

solid = account · long dash = VPC · short dash = zone or planned

Context

  • Portfolio for a principal AWS architect. Static pages, one contact path.
  • Same rigor as client work: private origin, least privilege, IaC, known cost.
  • Zero-maintenance target. No servers, no CMS, no third-party scripts.

Decision

  • S3 private origin behind CloudFront OAC. Bucket never public; the edge signs every GET.
  • CloudFront Function rewrites clean URLs at the edge. Strict same-origin CSP. Fonts self-hosted.
  • Terraform throughout. Remote state in S3, native lockfile. No console drift.
  • Planned: /api/contact via Lambda Function URL + SES v2; GitHub Actions deploys via OIDC, no stored keys.

Outcome

  • Whole stack fits one Terraform plan. TLS via ACM, DNS via Route 53.
  • Runs at $0.51 per month. No idle compute, no patch cycle.
  • The page you are reading ships from this bucket.