Moving a Static Site off S3 and CloudFront

The old deploy was aws s3 sync, then cloudfront create-invalidation, then waiting to find out whether the edge agreed. The new one is wrangler deploy, and the whole site is live everywhere before the command returns.

Losing invalidation is the biggest day-to-day difference. A Workers deploy is atomic and versioned, so there’s no window where new HTML is being served alongside stale hashed assets, and no invalidation bill for a site that ships several times a day.

Three pieces of infrastructure became files

CloudFront needed a Function attached to viewer requests just to turn /about/ into /about/index.html. Workers does directory indexing natively through html_handling.

Security headers were another Function. Redirects were either a Function or an S3 bucket with website hosting and routing rules. Both are now text files that ship with the site:

/*
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin

They’re in the repo, they’re reviewed in the pull request, and they deploy with the code that depends on them. That last part is what I actually wanted.

Check these before committing

There’s a cap of 20,000 files per deploy and 25 MiB per asset. Fine for a site, not fine for a media library. Anything bigger belongs in R2 with the Worker in front of it.

Requests served straight from static assets don’t bill as Worker invocations. You only pay when a request falls through to your code, which for a mostly-static site is a small fraction of traffic.

The gap worth knowing about is signed URLs. S3 presigned URLs have no direct equivalent, so private downloads mean writing the check yourself in the Worker. That’s twenty lines, but it’s twenty lines you didn’t have before.

The part I didn’t expect

The origin concept disappears entirely. There’s no bucket policy, no Origin Access Control, no service principal, no distribution ARN condition. The assets are part of the Worker.

That’s an entire category of misconfiguration gone, and it was the category most likely to leak a bucket.