Cloud Resume Challenge — AWS

This portfolio is itself the deliverable. The Cloud Resume Challenge is a well-known rite of passage for cloud engineers: take a resume site and ship it on a real cloud with real services — not Vercel, not Netlify — wiring together storage, CDN, DNS, compute, database, and a deploy pipeline. I picked AWS because the underlying primitives (S3, CloudFront, Route 53, Lambda, DynamoDB, API Gateway, IAM) are the same vocabulary used across most production systems I want to work on, and forcing myself to use the console first meant I had to actually understand the moving parts before hiding them behind Terraform.

The static side is a Next.js 16 app exported to plain HTML with output: 'export', synced to a private S3 bucket, and served by a CloudFront distribution sitting in front of it via an Origin Access Control policy — the bucket itself never sees public traffic. HTTPS is handled by an ACM certificate in us-east-1 (CloudFront's hard requirement), and Route 53 hosts the zone for the apex and www subdomain, both wired as alias records straight to the distribution. The interesting part of the architecture is the visitor counter at the bottom of the page: the browser makes a single GET /visitors call to API Gateway, which proxies to a Node.js Lambda that runs a DynamoDB UpdateItem with ADD #c :inc — an atomic counter, no race conditions, no read-modify-write. On-demand billing on the table means it costs nothing when nobody is visiting.

Deployment is automated end-to-end with GitHub Actions. A dedicated IAM user, scoped to s3:PutObject on this one bucket and cloudfront:CreateInvalidation on this one distribution, runs npm run build, syncs the output with smart cache headers (immutable for hashed assets, no-cache for HTML), and invalidates the CloudFront cache. The whole pipeline from git push to a live update is under five minutes, and the entire monthly cost — domain aside — has stayed well within a couple of dollars thanks to free-tier coverage and edge caching. The biggest lesson was how much of "AWS expertise" is really IAM expertise: 80% of the friction was getting policies right (OAC bucket policies, Lambda execution roles, GitHub Actions least privilege), and once those clicked, the rest of the services felt like Lego.