Consider keeping some TF resources out of the stack/environment

[dsiguero]

• S3 website buckets: They aren't namespaced to the AWS account and they need to have a specific name for Cloudflare CDN to work with S3 static website. So somebody could create the bucket we're using on their own AWS account, and "take it" from us.
• Website DNS records: If we move the S3 bucket outside of the stack, we could consider moving the DNS records too, to avoid slow propagation.