6 ms·

I use AWS S3, which I put behind a Cloudfront distribution. It's quick to set up, and there are no servers to keep up to date and patched. You also get free SSL

by gtsteve 10y ago

I use AWS S3, which I put behind a Cloudfront distribution. It's quick to set up, and there are no servers to keep up to date and patched. You also get free SSL for your Cloudfront distribution via AWS certificate manager. For stuff like Contact Us forms, I use AWS Lambda to post the data into my company's CMS. We've had this setup for about a year now and it works quite well. The cost is almost nothing but we don't have a high traffic website. If you started getting billions of hits from expensive Cloudfront regions such as Australia or India, you might consider something else.

falcolas 10y ago
A quick note on the S3/Cloudfront option - make sure you enable "Compress Objects Automatically"; it's not enabled by default and wasn't provided for a long time. https://aws.amazon.com/blogs/aws/new-gzip-compression-support-for-amazon-cloudfront/ https://aws.amazon.com/blogs/aws/new-gzip-compression-suppor... You'll save a lot on your bandwidth bill.
- colinbartlett 10y ago
  You can also set your edge usage to "Use Only US, Canada, and Europe" vs. "Use All Edge Locations" to save money, depending on your performance needs in various geographies.
- nitrogen 10y ago
  This is probably a better option than storing compressed data in S3 with a hard-coded Content-Encoding header, as it seems some web clients (like the Facebook app) display the raw gzip data.
deleted 10y ago
[deleted]
bkgunby 10y ago
It's worth noting that SSL only works between the browser and Cloudfront servers. Last time I checked there wasn't an option to use SSL with s3. It's not a deal breaker, but it was enough to make me look for alternatives.
- colinbartlett 10y ago
  If I understand what you're saying, if the origin for your Cloudfront distribution is an S3 bucket, the link between S3 and Cloudfront is unencrypted? That seems unimaginable to me.
  - nitrogen 10y ago
    If the origin is an S3 static website, the link is unencrypted but should run over Amazon's own network. Since Amazon has your S3 and CloudFront data anyway, assuming all CF endpoints are under Amazon's control, you don't lose much by having the S3 origin load over http.
    - nightcracker 10y ago
      That's just naive with the information we have today. Google thought this too, and the NSA happily used that to eavesdrop.
      - nitrogen 10y ago
        Eavesdropping on the connection between CF and S3 doesn't say too much about a public static website, though. If you're serving private data, use an S3 bucket directly instead of the S3 static website hosting HTTP server.
    - philsnow 10y ago
      What makes you think that when cloudfront requests objects internally from s3, it's using http? It could just as easily be connecting with s2n and authenticating both endpoints of the connection.
      - nitrogen 10y ago
        It says so in the CloudFront distribution setup, when you point it at an s3-website-[region] URL instead of directly at an S3 bucket.
      - 10y ago

by gtsteve 10y ago

falcolas 10y ago

A quick note on the S3/Cloudfront option - make sure you enable "Compress Objects Automatically"; it's not enabled by default and wasn't provided for a long time. https://aws.amazon.com/blogs/aws/new-gzip-compression-support-for-amazon-cloudfront/ https://aws.amazon.com/blogs/aws/new-gzip-compression-suppor... You'll save a lot on your bandwidth bill.

colinbartlett 10y ago
You can also set your edge usage to "Use Only US, Canada, and Europe" vs. "Use All Edge Locations" to save money, depending on your performance needs in various geographies.
nitrogen 10y ago
This is probably a better option than storing compressed data in S3 with a hard-coded Content-Encoding header, as it seems some web clients (like the Facebook app) display the raw gzip data.

deleted 10y ago

[deleted]

bkgunby 10y ago

It's worth noting that SSL only works between the browser and Cloudfront servers. Last time I checked there wasn't an option to use SSL with s3. It's not a deal breaker, but it was enough to make me look for alternatives.

colinbartlett 10y ago
If I understand what you're saying, if the origin for your Cloudfront distribution is an S3 bucket, the link between S3 and Cloudfront is unencrypted? That seems unimaginable to me.
- nitrogen 10y ago
  If the origin is an S3 static website, the link is unencrypted but should run over Amazon's own network. Since Amazon has your S3 and CloudFront data anyway, assuming all CF endpoints are under Amazon's control, you don't lose much by having the S3 origin load over http.
  - nightcracker 10y ago
    That's just naive with the information we have today. Google thought this too, and the NSA happily used that to eavesdrop.
    - nitrogen 10y ago
      Eavesdropping on the connection between CF and S3 doesn't say too much about a public static website, though. If you're serving private data, use an S3 bucket directly instead of the S3 static website hosting HTTP server.
  - philsnow 10y ago
    What makes you think that when cloudfront requests objects internally from s3, it's using http? It could just as easily be connecting with s2n and authenticating both endpoints of the connection.
    - nitrogen 10y ago
      It says so in the CloudFront distribution setup, when you point it at an s3-website-[region] URL instead of directly at an S3 bucket.
    - 10y ago