# Ensure Geo restrictions are enabled in CloudFront distributions - Source: https://support.icompaas.com/support/solutions/articles/a_1793292190093304-ensure-geo-restrictions-are-enabled-in-cloudfront-distributions - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon CloudFront distribution has geographic restrictions enabled. Geographic restrictions use either an allow list (only the listed countries can access the content) or a block list (the listed countries are denied access), and CloudFront returns an HTTP 403 error to viewers from countries that are not allowed. **Rationale** Without geographic restrictions, the content and applications behind a distribution can be reached from every country. This allows access from sanctioned or unlicensed regions and widens exposure to scraping, bot abuse, denial-of-service attacks, credential stuffing and fraud. An allow list of the countries the business serves, or a precise block list, reduces this exposure and should be combined with AWS WAF, bot controls, signed URLs or cookies, and monitoring. **Impact** - Blocks requests from countries where the content should not be available - Reduces exposure to automated attacks originating from blocked countries - Legitimate users in blocked countries, or users whose location is detected incorrectly (for example when using a VPN), will receive an HTTP 403 error **Default Value** New CloudFront distributions have no geographic restrictions (restriction type none), so content is available in all countries. **Pre-Requisites** - IAM permissions: cloudfront:GetDistributionConfig and cloudfront:UpdateDistribution - The list of countries to allow or block (as two-letter ISO 3166-1 country codes), agreed with the business and legal owners **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select **Distributions**. 3. Select a distribution, open the **Security** tab and check the **Geographic restrictions** section. 4. Repeat for each distribution. 5. If no geographic restriction is configured, follow the implementation steps. **CLI:** Show the geographic restriction setting of a distribution: aws cloudfront get-distribution-config --id --query "DistributionConfig.Restrictions.GeoRestriction" A distribution fails if RestrictionType is none. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select the distribution. 3. Open the **Security** tab and, in **Geographic restrictions**, choose **Edit**. 4. Select **Allow list** (recommended) or **Block list**. 5. Add at least one country to the list. 6. Choose **Save changes**. 7. Repeat for each distribution. **CLI:** Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output. Save the distribution configuration and get its current ETag: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config.json aws cloudfront get-distribution-config --id --query "ETag" --output text Edit dist-config.json and replace the Restrictions value with an allow list, for example: {"GeoRestriction":{"RestrictionType":"whitelist","Quantity":1,"Items":\[""\]}} Apply the updated configuration with the ETag: aws cloudfront update-distribution --id --distribution-config file://dist-config.json --if-match **Backout Plan** Before making changes, save the current distribution configuration: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console, select the distribution and open the **Security** tab. 3. In **Geographic restrictions**, choose **Edit**. 4. Select **No restrictions** and choose **Save changes**. **CLI:** Get the current ETag with the command used in the implementation steps, then restore the saved configuration: aws cloudfront update-distribution --id --distribution-config file://dist-config-backup.json --if-match Note: rolling back makes the content available from all countries again. **Reference** - [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html) - [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html) - [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution-config.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution-config.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.