I built a private S3 + CloudFront stack for this blog. AWS recommends Amplify instead. Here’s when each makes sense.

How I host this blog on a private S3 bucket with CloudFront, OAC, and zero stored credentials.