SECURITY & VALIDATION / 03

Trust, but verify.

A checklist of security properties that must be demonstrated with actual API responses and AWS configuration—not model assertions.

TARGET CONTROLS

Secure by design.

The controls below are design goals until verified against the deployed website.

STORAGE

No public S3 origin

Block Public Access enabled. Direct unsigned S3 object requests should be denied.

DELIVERY

Signed origin access

CloudFront accesses S3 using Origin Access Control and a distribution-scoped bucket policy.

ENCRYPTION

TLS from browser to edge

An ACM certificate matching the custom domain enables HTTPS with valid trust.

POLICY

Secure redirects

CloudFront redirects ordinary HTTP page requests to HTTPS before serving the website.

INTERACTIVE FEATURE

Deployment readiness checklist

Mark completed verification tasks while testing. These checkboxes are browser-local notes, not proof that AWS passed.

Five public pages return successful responses Custom domain uses a valid HTTPS certificate HTTP redirects to HTTPS Direct anonymous S3 object request denied CloudFront OAC and private bucket policy confirmed

0 of 5 locally marked complete