AWS Builder Center

Builder Center

Application Security - Geo-Blocking

Application Security - Geo-Blocking

Companies implement geo-blocking policies on web applications for different reasons (e.g. regulatory with embargoed countries).

Achraf Souk

Overview

Geo-blocking policies are implemented on web applications for different reasons, such as to comply with regulations with regards to embargoed countries or to block video streaming in countries where the web application does't have streaming rights.

Common use cases

Geo-blocking can be implemented using CloudFront's native geographic restrictions, using edge functions or using AWS WAF. Each method provide different matching granularity, customizable logic and price level. The methods can also be combined, knowing that CloudFront evaluates first its geographic restrictions rule, then AWS WAF evaluates its geo-matching rules, and finally edge functions are executed to evaluate geo-blocking logic in their code. Note that CloudFront and AWS WAF determines the location of your users by using a third-party database. The accuracy of the mapping between IP addresses and countries varies by Region.


Simple and global geo restrictions in CloudFront

Use CloudFront  geographic restrictions  to restrict countries at the distribution level, with no additional charges. You can allow or block a specific set of countries, applied to all requests received by your CloudFront distribution. Viewers who are restricted by the configured geographic restrictions will receive a 403 Forbidden response by CloudFront. You can use CloudFront's Custom Error Pages to serve a friendly error page.

Advanced geo-blocking logic using CloudFront Functions

Use CloudFront Functions, configured on viewer request event, to implement the advanced geo-blocking logic using javascript. CloudFront Functions can be granularly used with a specific CloudFront cache behavior (e.g. /api/* paths), and the logic can be more granular in the code, and can be combined with other access control logic such as authorization. To implement geo based logic in CloudFront functions, you need to allow list the required CloudFront headers (e.g., CloudFront-Viewer-Country or CloudFront-Viewer-Country-Region) in an origin request policy attached to the same CloudFront cache behavior to which the function is associated.
The below sample CloudFront Function blocks viewers from Donetsk (14) or Luhansk (9) regions of Ukraine.
JavaScript
function handler(event) {
  var request = event.request;
  var country = request.headers['cloudfront-viewer-country'];
  var region = request.headers['cloudfront-viewer-country-region'];

  if (country && country.value === 'UA' && region && (region.value === '9' || region.value === '14')) {
    return {
      statusCode: 403,
      statusDescription: 'Forbidden',
    };
  }
  return request;
}

Resources

# aws-edge-services# security
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article