One small correction: In the sentence "When copying over the config file, make sure to remove all breakpoints from the certificates. Otherwise this will cause a base64 decoding error in the build." I think you meant line breaks instead of breakpoints.
S3 / Cloudfront is (apologies for the buzzword) serverless and incredibly cheap. It's public-facing only though.
Getting the ACM certs is the big bonus though.