Amazon S3
Static hosting that scales on its own, and why a private bucket behind CloudFront beats a public one for user-specific files.
S3's static website hosting mode scales automatically, no server to size, no fleet to add capacity to. It's also close to the cheapest storage AWS offers, which matters directly for a minimal-cost requirement. Sits behind CloudFront rather than being hit directly.
Private buckets
A bucket holding user-specific files (a generated QR code, for instance) should stay private. A public bucket means anyone who finds or guesses another user's file path can view their data, that's an access control decision made by accident, not a shortcut.
Pair a private bucket with a CloudFront Origin Access Identity so the bucket only accepts traffic that's already come through CloudFront, and serve individual files through short-lived signed URLs rather than permanent public links.
Where this showed up
- The frontend that never touches a password: static hosting behind CloudFront.
- A cache doesn't know a token expired: the private QR bucket and signed URL retrieval.