It works.

Served by CloudFront from a private S3 bucket, over HTTPS on a Route 53 subdomain.

Deployed by Pulumi from aws/main/web/demo.