12 - CloudFront & AWS Global Accelerator

CloudFront - Geo Restriction

awscloudfrontgeo-restrictionsaa-c03

Overview

You can restrict who can access your distribution based on the country they access it from.

Type Meaning
Allowlist List of approved countries; all others are blocked
Blocklist List of banned countries

The country is determined using a third-party Geo-IP database, which matches the user's IP to its country.

Use Case

Copyright laws to control access to content.

Allowlist vs blocklist

Allowlist List of approved countries Listed countries: served All other countries: blocked Example: India and United States Blocklist List of banned countries Listed countries: blocked All other countries: served Use case: copyright laws Country comes from a third-party Geo-IP database.
An allowlist serves only approved countries. A blocklist blocks only banned countries.

Hands-On Walkthrough

  1. Open the distribution and go to the Security tab.
  2. Find CloudFront geographic restrictions (a bit hidden), under Countries, and click Edit.
  3. Choose Allow list or Block list.
  4. Example: allowlist with India and United States. All other countries are blocked by CloudFront.
  5. Save changes. The type now shows allowlist and the countries are listed.

Questions & Answers

Q1: How do you block users from certain countries on CloudFront?

Answer:

Use Geo Restriction with a blocklist of banned countries, or an allowlist of approved ones.

Q2: How does CloudFront know a user's country?

Answer:

A third-party Geo-IP database maps the user's IP to a country.

Check yourself

Quiz

Flashcards

Click the card (or focus it), then use ← → to move and Space to flip.