AWS Static Demo
Private S3 origin served through CloudFront with Origin Access Control
(OAC). Provisioned with Terraform — Free Tier friendly
(PriceClass_100, SSE-S3, no public bucket).
If you can read this page, the IaC path works.