Pattern: cloudfront-s3-website

The paved road for a static frontend: private S3 + CloudFront + ACM cert + DNS, WAF-ready.

What you get: versioned S3 bucket (never public — OAC), CloudFront distribution with per-env price class, ACM certificate + Route53 records, optional WAF (on in prod), log retention per env.

Extension points: custom cache behaviors, Lambda@Edge hooks, path-routing under a shared distribution (see Novamera's fe-routing / unified-cloudfront for the centralized variant).

Promotion status: proven across 4 Novamera frontends → extraction candidate for the versioned registry.