// learning
Today I Learned
Short notes, snippets, and things that surprised me. Low ceremony, high frequency.
CloudFront gives you 1,000 free invalidation paths per month
I assumed cache invalidations cost money on every deploy. Turns out the first 1,000 paths each month are free — and a wildcard /* counts as one path. So invalidating the whole site on every deploy costs nothing for a personal site deploying even 30x a month.
Astro ships zero JavaScript by default
Unlike Next.js or Gatsby, Astro strips all JavaScript from the output unless a component explicitly opts in with a client:* directive. This whole site is pure HTML + CSS — Lighthouse performance score of 100 without trying.
Use Origin Access Control, not public S3 website hosting
The old “S3 static website hosting” mode requires a public bucket and only serves HTTP. The modern pattern: keep the bucket fully private and let CloudFront read it via Origin Access Control (OAC). You get HTTPS, caching, and no publicly exposed bucket.
# bucket stays private; only CloudFront can read it
aws s3api put-public-access-block \
--bucket my-site --public-access-block-configuration \
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true