This site is the smallest useful demonstration of how I like to ship things: a static build, an infrastructure definition that lives next to the code, and one command that takes both to production.
Build
Astro renders every page at build time. There is no client framework and no hydration — the only JavaScript that reaches the browser is a theme toggle and a navigation menu, both scoped to their own component.
Delivery
A single CDK stack owns the S3 buckets, the CloudFront distribution, the ACM
certificate, and the Route 53 records. The frontend is bundled inside the CDK
deploy itself, in a node:24 container, so the artifact that reaches S3 is
reproducible from the commit alone. Every deploy invalidates the distribution.
What I would change
Move the origin behind Origin Access Control instead of a public bucket policy, and add a signed, versioned asset manifest.