Cloud Agent Lab

CSCE 412 · Project 5

A secure cloud website with an AI agent team behind it

This page is stored in a private Amazon S3 bucket, delivered over HTTPS by Amazon CloudFront, and reached through a custom domain on Route 53. The project's goal is a team of specialized AI agents that plans, deploys and verifies this infrastructure, with a person approving every consequential change.

Explore the architecture Meet the agents
Diagram: the visitor's browser looks up the domain in Route 53, sends an HTTPS request to CloudFront, which uses an ACM certificate and reads files from a private S3 bucket. Direct public access to the bucket is denied.
4AWS services: S3, CloudFront, Route 53, ACM
0public buckets: the origin blocks all public access
301redirect sends every HTTP request to HTTPS
TLS 1.2+minimum protocol version for visitors

Design principles

Private by default

The S3 bucket blocks all public access. A bucket policy lets exactly one CloudFront distribution read the files, so the only way in is through the CDN.

HTTPS everywhere

A certificate from AWS Certificate Manager covers the domain and its www name. CloudFront redirects plain HTTP to HTTPS before serving anything.

Verified, not assumed

An agent saying "the site is secure" is not evidence. Checks record real status codes, certificate details and response headers so every claim can be confirmed.

How this page reached you

  1. DNS. Your browser asked Route 53 for the domain's address and was pointed to the nearest CloudFront edge location.
  2. TLS handshake. CloudFront presented the ACM certificate, and your browser confirmed it matches this domain.
  3. Edge cache. CloudFront served the page from its cache, or fetched it from S3 with a signed request if the copy had expired.
  4. Private origin. S3 checked that the request came from this distribution and returned the file. Anyone else asking S3 directly gets 403 Access Denied.

Want proof? The Security page can inspect the real response headers of this site from your browser.