Denshin / Blog / DevOps
S3 + CloudFront for an admin-heavy SPA: the boring wins
Why we still host most admin panels on S3 and CloudFront, what we miss compared to the newer hosting platforms, and what we don't miss at all.
Denshin Engineering · DevOps · 11 March 2026 · 1 min read
Almost every client we work with eventually asks the same question: should we move our admin panel onto Vercel, or Netlify, or one of the newer hosting platforms? They've heard the marketing. The answer is almost always no, and the reason is almost always "it's already on S3 and CloudFront, and that's fine".
For an admin-heavy SPA (a big bundle of authenticated routes that talks to a Lambda API), S3 plus CloudFront does the job for less than a few dollars a month, deploys in 30 seconds via aws s3 sync, and never wakes anybody up.
What we miss compared to the newer platforms: server components, edge functions, automatic preview URLs per branch. None of these are nothing, but for a private admin panel that only client staff log into, they don't change anything that matters.
What we don't miss: the cost cliff at scale, the platform-specific lock-in, the deploy-time complexity, the surprise bill for a misconfigured cache. CloudFront is genuinely boring, and "boring" here means "I didn't think about it for the last six months".
The setup is roughly:
- S3 bucket, private, with CloudFront as the only allowed reader.
- CloudFront with a sensible cache policy that respects
Cache-Control headers from the build (long for hashed assets, zero for index.html).
- A function-URL or origin-request rule that rewrites unknown paths to
index.html so client-side routing works.
- An invalidation on
/index.html on every deploy. That's it.
If the same project also had a heavy public marketing site with SEO concerns, we'd reconsider. For most admin panels: don't over-think it.
Tags: AWS, S3, CloudFront, Deployment, SPA
All posts · Work with Denshin