Version 2026-06-30_v001

S3 + CloudFront Directory Indexer

Apache-style public folders without maintaining Apache. Store files in S3, serve them globally with CloudFront, update indexes with Lambda, and display beautiful directory pages with Lambda@Edge.

The whole beginner package is four files

s3-cloudfront-indexer-simple-2026-06-30_v001/
  START-HERE.html
  lambda-edge-directory-browser/index.mjs
  s3-directory-index-updater/index.mjs
  iam-policies/s3-cloudfront-indexer-policy-example.json

What happens when you upload a file?

You upload a file to S3
        ↓
S3 event triggers updater Lambda
        ↓
Updater rebuilds .directory-index.json
        ↓
Updater invalidates affected CloudFront paths
        ↓
Visitor opens a folder URL
        ↓
Lambda@Edge renders a beautiful directory listing

GET variables visitors can use

?sort=name|modified|size
?order=asc|desc
?density=compact|comfortable
?theme=auto|light|dark
?locale=en-US
?tz=local|UTC
?filter=zip
?latest=1
?debug=1

These are intentionally visible and educational. People can click column headers, see the URL change, bookmark the view, share it, and learn how the system works.

Default behavior

Normal folders sort by name ascending.
Folders under _daily-builds/ sort by modified descending, newest first.
?latest=1 on a daily-build folder redirects to the newest useful item.
The grid scrolls sideways on phones/tablets instead of crushing columns.

What to upload where

Lambda@Edge directory browser: upload the ZIP whose only file is index.mjs to your Lambda@Edge function in us-east-1, deploy it, publish a numbered version, then attach that numbered ARN to CloudFront as an Origin Request Lambda association.

S3 updater Lambda: upload the updater ZIP to a normal regional Lambda connected to your S3 bucket events. Set CLOUDFRONT_DISTRIBUTION_ID when you want automatic invalidations.

IAM policy: customize the example bucket names, AWS account ID, and CloudFront distribution ID before attaching it to the updater Lambda role.

Security idea

No public SSH server. No VPS patching. No Apache process to babysit. The security work moves to AWS configuration: least-privilege IAM, CloudFront HTTPS, S3 permissions, and careful publishing workflows.