Architecture Visual

How joesparkman.com itself is built and shipped: a static frontend deployed straight to AWS, fronted by a global CDN with a custom domain, and released through a CI/CD pipeline that never touches long-lived credentials.

Deploy Pipeline

terminal git push main Local commit pushed to GitHub
→
rocket_launch GitHub Actions Workflow triggers on push
→
admin_panel_settings IAM OIDC Role Short-lived, least-privilege token
→
sync S3 Sync + Invalidate aws s3 sync + cloudfront invalidation

Storage and Delivery

inventory_2 S3 Buckets www + app origin buckets, us-east-2
→
hub CloudFront CDN Global edge caching, HTTP/2 + IPv6
→
verified_user ACM Certificate TLS 1.2+, SNI-only
→
dns Registrar DNS CNAME records → CloudFront

Request Path

language Visitor Browser Requests joesparkman.com
→
dns DNS Resolves CNAME record → CloudFront
→
hub CloudFront Edge HTTPS via ACM cert, cache hit/miss
→
inventory_2 S3 Origin Serves index.html on a miss

The deploy pipeline and the live request path share the same S3 + CloudFront stack, so every push to main is what visitors see within seconds of the CloudFront invalidation completing.

rocket_launchCI/CD: GitHub Actions runs on every push to main, no manual deploy step.
admin_panel_settingsAuth: The pipeline authenticates via IAM OIDC federation, a short-lived role scoped only to S3 sync and CloudFront invalidation, no static access keys.
inventory_2Storage: Two S3 buckets (www and app) hold the site's static assets, kept in sync on every deploy.
hubCDN: CloudFront serves the site globally, gzip-compressed, over HTTP/2 and IPv6, with a full cache invalidation on each release.
verified_userTLS: An ACM certificate terminates HTTPS at the CloudFront edge; viewer traffic is always redirected to HTTPS.
dnsDNS: The registrar's DNS resolves joesparkman.com, www.joesparkman.com, and app.joesparkman.com via CNAME records pointed at the CloudFront distribution.
Back to Portfolio View Source