A static site on S3 behind CloudFront with Origin Access Control returns 403 Forbidden for every URL that does not exist, not 404 Not Found. The cause is the OAC bucket policy, and the fix is two entries in the distribution config.
We migrated a Hugo static site from a self-hosted nginx container on a local server to S3 + CloudFront. The motivation was simple: a static site has no business running on a server we have to patch. The migration took a few hours and involved four gotchas that aren’t obvious from the AWS documentation. This is a record of what we did and what tripped us up. The setup Hugo static site (PaperMod theme) S3 bucket with all public access blocked: Origin Access Control (OAC) only CloudFront distribution with ACM SSL cert Cloudflare DNS, gray cloud (DNS-only) Gitea self-hosted repo with a webhook-triggered deploy container on-prem The deploy flow on push: Gitea fires a webhook → container on saturn pulls the repo, runs hugo --minify, syncs to S3, invalidates CloudFront. ...
We are running a pilot of AWS DevOps Guru paired with Amazon Q across a federal AWS estate. DevOps Guru provides ML-driven anomaly detection and automated root cause analysis. Rather than relying on manually defined alert thresholds, it builds a baseline from operational data and flags deviations, reducing noise and surfacing issues that threshold-based alerting misses. Amazon Q brings generative AI into engineer troubleshooting workflows. When an anomaly is flagged, engineers can query Amazon Q directly for accelerated diagnosis, pulling in relevant runbooks, log context, and suggested remediation paths without switching tools. ...