CloudFront Distributions Should Have Geo Restriction Enabled
More Info:
Geo restriction should be enabled for your Amazon CloudFront CDN distribution to whitelist or blacklist a country in order to allow or restrict users in specific locations from accessing web application content.Risk Level
LowAddress
SecurityCompliance Standards
SOC2, GDPRTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “CloudFront Distributions Should Have Geo Restriction Enabled” for AWS using AWS console, follow the below steps:
- Log in to your AWS console.
- Navigate to the CloudFront service.
- Click on the name of the distribution that you want to remediate.
- Click on the “Behaviors” tab.
- Click on the “Create Behavior” button.
- In the “Create Behavior” screen, scroll down to the “Restrict Viewer Access (Use Signed URLs or Signed Cookies)” section.
- Click on the “Yes” radio button for “Restrict Viewer Access”.
- In the “Geo Restriction” section, click on the “Yes” radio button for “Restrict access to your content by country/region”.
- In the “Whitelist” section, select the countries/regions that you want to allow access to your content.
- Click on the “Create” button to save the behavior.
Using CLI
Using CLI
To remediate the misconfiguration of CloudFront distributions not having Geo Restriction enabled in AWS using AWS CLI, follow these steps:
- Open your terminal and ensure you have AWS CLI installed and configured with the necessary permissions to modify CloudFront distributions.
-
Identify the CloudFront distribution that needs Geo Restriction enabled. You can use the following command to list all the CloudFront distributions in your AWS account:
This command will return a JSON object containing information about all the CloudFront distributions in your account.
-
Once you have identified the distribution that needs Geo Restriction enabled, you can use the following command to enable Geo Restriction:
Replace
<distribution-id>with the ID of the distribution that needs Geo Restriction enabled. - After running the above command, you should receive a JSON object containing information about the updated CloudFront distribution.
-
Verify that Geo Restriction has been enabled for the distribution by running the following command:
This command will return a JSON object containing the configuration of the specified CloudFront distribution. Verify that the
GeoRestrictionobject is present and contains the correct configuration.
Using Python
Using Python
To remediate the CloudFront Distributions should have Geo Restriction enabled misconfiguration in AWS using Python, follow the below steps:Note: This code assumes that you have the necessary AWS credentials and permissions to access and modify CloudFront distributions.
- Import the required libraries:
- Initialize AWS credentials:
- Get the list of CloudFront distributions:
- Loop through the distributions and check if Geo Restriction is enabled:
- Remediate the misconfiguration by enabling Geo Restriction: