Description

Ensure that every Amazon CloudFront distribution has geographic restrictions enabled. Geographic restrictions use either an allow list (only the listed countries can access the content) or a block list (the listed countries are denied access), and CloudFront returns an HTTP 403 error to viewers from countries that are not allowed.

Rationale

Without geographic restrictions, the content and applications behind a distribution can be reached from every country. This allows access from sanctioned or unlicensed regions and widens exposure to scraping, bot abuse, denial-of-service attacks, credential stuffing and fraud. An allow list of the countries the business serves, or a precise block list, reduces this exposure and should be combined with AWS WAF, bot controls, signed URLs or cookies, and monitoring.

Impact

  • Blocks requests from countries where the content should not be available

  • Reduces exposure to automated attacks originating from blocked countries

  • Legitimate users in blocked countries, or users whose location is detected incorrectly (for example when using a VPN), will receive an HTTP 403 error

Default Value

New CloudFront distributions have no geographic restrictions (restriction type none), so content is available in all countries.

Pre-Requisites

  • IAM permissions: cloudfront:GetDistributionConfig and cloudfront:UpdateDistribution

  • The list of countries to allow or block (as two-letter ISO 3166-1 country codes), agreed with the business and legal owners

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select Distributions.

  3. Select a distribution, open the Security tab and check the Geographic restrictions section.

  4. Repeat for each distribution.

  5. If no geographic restriction is configured, follow the implementation steps.

CLI:

Show the geographic restriction setting of a distribution:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig.Restrictions.GeoRestriction"

A distribution fails if RestrictionType is none.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select the distribution.

  3. Open the Security tab and, in Geographic restrictions, choose Edit.

  4. Select Allow list (recommended) or Block list.

  5. Add at least one country to the list.

  6. Choose Save changes.

  7. Repeat for each distribution.

CLI:

Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output.

Save the distribution configuration and get its current ETag:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config.json
aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text

Edit dist-config.json and replace the Restrictions value with an allow list, for example:

{"GeoRestriction":{"RestrictionType":"whitelist","Quantity":1,"Items":["<COUNTRY_CODE>"]}}

Apply the updated configuration with the ETag:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config.json --if-match <ETAG>

Backout Plan

Before making changes, save the current distribution configuration:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console, select the distribution and open the Security tab.

  3. In Geographic restrictions, choose Edit.

  4. Select No restrictions and choose Save changes.

CLI:

Get the current ETag with the command used in the implementation steps, then restore the saved configuration:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config-backup.json --if-match <ETAG>

Note: rolling back makes the content available from all countries again.

Reference