Visual deployment map

Where each file goes in AWS

This guide maps the public source package at 8k.art to the exact AWS console screen where each file is deployed.

https://8k.art/daily/2026-07-14/s3-cloudfront-indexer/

One-page map

Source file on 8k.art	AWS destination	Purpose
`lambda-edge-directory-browser/index.mjs`	Lambda in US East (N. Virginia) → directory-browser function → Code	Creates the visual directory listings and their cache headers.
`cloudfront-function-headers/allow-all-cors-and-inline-text.js`	CloudFront → Functions → matching headers function → Development → Code	Sets response headers for normal files, including browser/CDN HTML caching behavior.
`s3-directory-index-updater/index.mjs`	Lambda → regional S3 directory-index updater → Code	Rebuilds directory metadata after S3 changes and requests exact CloudFront invalidations.
`policies/s3-list-prefix-policy-example.json`	IAM → Roles → `8k-art-directory-browser-role-…` → Permissions → `AllowListBetaFolder`	Allows the browser Lambda to list the approved S3 prefixes.

Source package screen

Public s3-cloudfront-indexer directory listing — The public package directory. Open the matching subfolder to obtain the file named in each deployment section below.

1. Lambda@Edge directory browser

Deploy + publish version

Source location

https://8k.art/daily/2026-07-14/s3-cloudfront-indexer/lambda-edge-directory-browser/index.mjs

AWS console location

Open Lambda and select region US East (N. Virginia) us-east-1.

Open the function that uses the role 8k-art-directory-browser-role-4amo9rx0.

Choose Code, open index.mjs, replace the file, and click Deploy.

Publish a new numbered version.

In each CloudFront distribution, update the Origin response Lambda@Edge association to that new version.

What this file controls

Directory pages such as:

/daily/
/daily/2026-07-14/
/beta/
/beta/_daily-builds/2026-07-14/

For the current cache design, directory HTML is browser-revalidated while CloudFront can retain the edge copy for one year.

2. CloudFront response-header function

Save + publish

Source location

https://8k.art/daily/2026-07-14/s3-cloudfront-indexer/cloudfront-function-headers/allow-all-cors-and-inline-text.js

AWS console location

Open CloudFront.

Choose Functions, not Lambda.

Open the headers function used by your distributions.

Under Development, replace the function code and save it.

Test, then click Publish.

Verify each relevant cache behavior associates it at Viewer response.

What this file controls

Response headers for ordinary objects, especially HTML files that keep the same URL when replaced.

Browser: max-age=0, must-revalidate
CloudFront: s-maxage=31536000

This avoids a one-year stale browser copy while preserving a one-year edge cache.

3. S3 directory-index updater

Deploy only

Source location

https://8k.art/daily/2026-07-14/s3-cloudfront-indexer/s3-directory-index-updater/index.mjs

AWS console location

Open Lambda → Functions.

Open the regional function named similar to s3-directory-index-updater.

Replace index.mjs and click Deploy.

Do not publish a Lambda@Edge version; this is an ordinary regional Lambda.

What this file controls

After an upload, overwrite, or deletion, it rebuilds the affected indexes and invalidates the exact changed object and directory routes.

/daily
/daily/
/daily/2026-07-14
/daily/2026-07-14/
/daily/2026-07-14/changed-file.html

4. IAM listing policy

AWS IAM Roles page — IAM → Roles. Open `8k-art-directory-browser-role-4amo9rx0`.

IAM role permissions page — On the Permissions tab, open the customer inline policy `AllowListBetaFolder`.

IAM JSON policy editor — Edit the policy in JSON mode. The allowed prefixes include `daily/` and `daily/*` for each configured bucket.

Do not confuse the three JavaScript files. The directory-browser file goes to Lambda@Edge, the updater goes to a regional Lambda, and the headers file goes to CloudFront Functions.

Final deployment order

Deploy the regional S3 directory-index updater.

Deploy the Lambda@Edge directory browser, publish a numbered version, and update CloudFront associations.

Publish the CloudFront response-header function.

Wait until every CloudFront distribution reports Deployed.

Perform the one final transition invalidation, then future changes should use automatic exact invalidation.

Expected public result

Public directory listing — The public listing should reflect the current S3 objects after the automatic updater completes and the affected CloudFront paths are invalidated.