Question

A company runs a public API behind Amazon CloudFront with an AWS WAF web ACL attached to the distribution. Compliance requires blocking all requests originating from countries outside of North America. After deploying a geo match rule that blocks non-US/CA/MX traffic, the security team discovers that some blocked-region clients are still reaching the origin. Investigation shows these clients route through a third-party CDN that forwards the original client IP in an X-Forwarded-For header. What is the MOST effective way to enforce the geo restriction reliably?

Accepted Answer

Configure the WAF geo match statement to use the forwarded IP configuration referencing the X-Forwarded-For header with a fallback behavior of MATCH.

Answer

Attach the same geo match WAF rule to the Application Load Balancer at the origin instead of CloudFront so it evaluates the true source IP.

Answer

Replace the geo match rule with a rate-based rule scoped to the blocked regions to throttle unwanted traffic.

Answer

Add a NACL on the origin subnet denying the CIDR ranges of the third-party CDN.