Skip to content

How I Built This Site

This site was built using a mix of IaC and CICD. It is designed to completely rebuild in AWS S3 after every push to the master branch. Below are the steps I took to deploy it.

Register Domain and Create Certificate

The first steps I had to perform to make this a production level site was to register a domain and obtain a certificate. This was fairly straightforward from following the AWS docs.

I ended up registering mkrochta.com and created an ACM Certificate for it.

Deploy my CloudFormation to build out most of the IaC.

Next I created and deployed a CloudFormation template to build out my infrastructure. The template contained resources for the following:

  • S3 Bucket
  • Bucket Policy
  • CloudFront
  • Origin Access Control

Create an IAM user.

After the majority of the infrastructure was configured I then created an IAM user to access the S3 bucket. I scoped the IAM policy permissions down to only access the bucket we previously created and also limited the actions for it.

I then created a set of IAM access/secret keys to be used in GitHub.

Create GitHub Repo / Configure Secrets

Next I created a new private GitHub repo.

Once that was created I configured two Secrets in the GitHub repo for my IAM keys.

Configure GitHub Actions

After that I created a CICD pipeline by configuring GitHub Actions.

To do this I created a new file/directory in my repo .github/workflows/main.yml.

In the main.yml I configured steps to do the following:

  • Setup python
  • Install dependencies (pip, mkdocs, mkdocs material theme)
  • Build site mkdocs build
  • Configure AWS credentials
  • Deploy static site to S3 bucket aws s3 sync ./site/ s3://INSERT-BUCKET-NAME --delete

Configure Site

At this time my site was mostly up and running. Any push to master would rebuild my MkDocs site in the S3 bucket.

The only thing left to do was to add markdown pages. And then reference them in the mkdocs.yml file.

Map DNS

The final step I did was map mkrochta.com as an Alias to the CloudFront distribution in my Route 53 hosted zone.

Final Product / Security Considerations

With everything deployed and configured my final product ended up being a fully functional static website that is served through a CDN and protected by a WAF.

Security was considered in every piece of infrastructure built. Including some of the following:

  • S3 Bucket Encryption with AES256.
  • S3 Bucket Policy is limited to the CloudFront OAC.
  • S3 Bucket Public Access Settings are all set to block.
  • CloudFront uses the latest TLS version and SSL support method.
  • CloudFront uses an ACM Certificate.
  • CloudFront & WAFV2 being used in general. Could've just left this as a public static bucket.
  • WAFV2 is configured a default block policy.
  • WAFV2 has a number of AWS managed rules attached.