The PM's Guide to Vibe-Coding: Building a Secure, $0 Website with Kiro & AWS
As a product manager who started as a software engineer, I've always believed that the best way to truly understand a platform is to build on it. But for my personal site, I didn't want to wrestle with boilerplate or heavy frameworks. I wanted to move at the speed of thought.
I decided to try a different approach: Vibe-Coding. No templates, no drag-and-drop builders. Just me, an AI assistant named Kiro, and a conversation that materialized into a production-ready site in a single evening.
1. The Workflow: Conversational Development
"Vibe-coding" isn't about being lazy; it's about removing the friction between intent and execution. Using Kiro, I skipped the documentation deep-dives and context-switching.
Here is what the "dialogue-to-deployment" flow actually looked like:
Me: "Create a personal website scaffold using AWS Free Tier standards."
Kiro: Generates semantic HTML5 and a clean CSS structure.
Me: "Use my LinkedIn profile to populate the 'About' section, but make it sound more like a story than a resume."
Kiro: Restructures the narrative flow automatically.
Me: "It looks great, but the mobile menu feels clunky. Fix the responsiveness."
Kiro: Integrates Bootstrap 5 and optimizes the viewport meta tags.
The process felt less like "writing code" and more like collaborating with a technical co-founder who has zero ego and infinite patience.
2. The Stack: Simple, Scalable, Secure
I'm a firm believer that complexity is the enemy of maintenance. I wanted a site that was fast, free, and wouldn't break while I was sleeping.
| Component | Technology | Why I Chose It |
|---|---|---|
| Frontend | HTML5 / CSS3 / Bootstrap 5 | Zero JavaScript dependencies = Instant load times. |
| Hosting | AWS S3 (Static) | Reliable, durable, and essentially free for low traffic. |
| CDN | AWS CloudFront | Global edge caching to keep the "vibe" fast everywhere. |
| Security | AWS WAF + OAC | Enterprise-grade protection for a personal project. |
| DNS/SSL | Route 53 + ACM | Automated SSL certificates that never require manual renewal. |
3. The Security Layer: Not Overkill, Just Good Hygiene
In my experience building enterprise SaaS, I've learned that "security by obscurity" is a myth. Even a personal blog is a target for botnets and scrapers.
CloudFront as the Shield
By using Origin Access Control (OAC), I ensured my S3 bucket is completely private. The only way to reach my site is through CloudFront. This provides:
- DDoS Protection: AWS Shield (Standard) kicks in automatically.
- Performance: Edge caching reduces origin load to near zero.
- HTTPS Everywhere: Enforced TLS 1.3 for every visitor.
AWS WAF: The Intelligent Firewall
I configured AWS WAF with managed rules to block the "low-hanging fruit" of the internet:
- SQLi/XSS Protection: Blocks common web exploits and OWASP Top 10 signatures.
- Rate Limiting: Prevents a single IP from spamming my site and racking up costs.
- Bot Control: Keeps the scrapers at bay so my analytics stay clean.
4. The Economics: The $0 Strategy
One of the best parts of this setup? It fits entirely within the AWS Free Tier.
- CloudFront: 1TB of data transfer out per month.
- S3: 5GB of storage.
- WAF: Included in the CloudFront Free Tier bundles as of 2025.
Total Monthly Cost: $0.00 (plus the cost of my domain name).
Lessons Learned
- Vibe-Coding is Productive: I built the design, content, infrastructure, and security in a single evening.
- Simple Stacks Win: No JS frameworks, no build tools, no headaches. Static sites are still the gold standard for performance.
- Security is a Default, Not an Add-on: CloudFront + WAF is so easy to set up in 2026 that there's no excuse to leave an S3 bucket "public."
What's Next?
This site isn't a static monument; it's a living experiment. I plan to continue iterating and adding to this platform as a way to test new ideas.
Moving forward, I'll be experimenting with serverless architectures and dynamic features to see how far I can push this setup. I'll be building all of it the same way I started—by using Kiro to "talk" those features into existence.
Try It Yourself
If you're curious about building your own site this way:
- Check out Kiro on GitHub to start your own conversation.
- Leverage the AWS Free Tier to keep your overhead at zero.
- Don't skip security—CloudFront + WAF is a no-brainer.
The barrier to building on the web has never been lower. You don't need to be a full-time developer; you just need an idea, a bit of intuition, and the right tools.
Happy building.