CloudDeploy — Automated Static Site Hosting Platform

Key Metrics

Overview

CloudDeploy is an AWS-powered static site deployment platform designed to automate static website hosting, versioning, and rollbacks on Amazon S3. The platform allows users to upload website archives via a web dashboard, automatically configures S3 bucket policies and CORS, stores metadata in Amazon RDS PostgreSQL, and enables instant version switching via server-side S3 CopyObject operations.

Problem

Deploying static websites to S3 manually requires repetitive bucket creation, static hosting configuration, CORS writing, bucket policy authoring, manual file uploads with correct MIME types, and lacks deployment history or instant rollback capabilities.

Solution

Built an automated deployment management system using Flask and boto3 that isolates projects via S3 key prefixes (projects/{slug}/versions/v{n}/), verifies ZIP uploads against zip-slip vulnerabilities, maintains immutable version history in RDS PostgreSQL, enables instant server-side rollbacks to live/ prefixes, and publishes deployment telemetry to CloudWatch.

Architecture

Multi-tenant web application architecture. A Flask backend running on EC2 (or Gunicorn) handles user authentication (JWT in httpOnly cookies) and ZIP file processing. AWS SDK (boto3) automates S3 bucket static website hosting, bucket policy generation (iam/clouddeploy-policy.json), and immutable file deployment (projects/{slug}/versions/v{n}/). Instant rollbacks copy version objects to projects/{slug}/live/ using server-side S3 CopyObject. Project metadata is persisted in Amazon RDS PostgreSQL, while deployment counts, archive sizes, and rollback events are streamed to CloudWatch custom metrics.

Challenges

• Preventing zip-slip security vulnerabilities during archive extraction by validating target paths before unpacking files.
• Resolving circular foreign key constraints between Project and Deployment models using SQLAlchemy's use_alter=True.
• Designing an instant rollback mechanism without re-uploading assets by executing server-side S3 CopyObject operations between version and live prefixes.
• Authoring a least-privilege IAM policy and bucket policy allowing public read access to live/ and versions/ prefixes under a single shared bucket.

Lessons Learned

• Advanced S3 object key partitioning strategies for multi-tenant static hosting.
• Infrastructure-as-code automation using Python and boto3 SDK.
• Least-privilege IAM policy authoring and S3 bucket security configuration.
• Relational schema modeling with circular dependency resolution in SQLAlchemy.
• Zip archive security validation and path sanitization techniques.
• Publishing operational metrics and rollback telemetry to Amazon CloudWatch.

Future Improvements

• Custom domain name integration using Amazon Route 53 and CloudFront.
• Global CDN acceleration and HTTPS encryption via Amazon CloudFront distributions.
• Server-side build step execution (e.g. npm run build) prior to deployment.
• Webhook integration support for automated deployments from GitHub Actions.
• Team collaboration features with organization-level project sharing.