Security

The site is public. The files behind it are not. Visitors reach the content only through CloudFront, over HTTPS.

Controls

Private bucket. S3 Block Public Access stays on, and the bucket has no public read policy.
Origin Access Control. Only this CloudFront distribution can read the bucket.
HTTPS only. The ACM certificate covers csce412zhangdavid275.store. HTTP requests get a redirect to HTTPS.
Limited permissions. The deployment identity can change only the site's S3 bucket. It can also create and update CloudFront distributions, request certificates in us-east-1, and change DNS records in Route 53. It has no admin rights and no IAM rights, and it cannot delete buckets, objects, distributions, certificates, or hosted zones.
No secrets in git. Keys stay in the AWS CLI configuration and in a local .env file. Logs hide account numbers.
Human approval. Each change to live infrastructure waits for a typed yes.

The verification agent runs these tools against the site. Each tool returns passed (true or false) and the raw evidence.

check_site_files: every page exists, every page has the same navigation, and every local link resolves.
check_pages: all five pages return 200, and a missing path returns the custom 404 page.
check_http_redirect: a plain HTTP request gets a redirect to an HTTPS address.
check_certificate: the TLS certificate is trusted for the domain name and has not expired.
check_https_home: the home page loads over HTTPS, and the response came through CloudFront.
check_s3_origin_private: a direct request to an object in the S3 bucket returns 403 AccessDenied.