Question

A media company streams licensed video content through Amazon CloudFront. Licensing agreements require that content be accessible only from viewers in Canada and the United States. Additionally, the security team wants to block a specific list of malicious IP addresses regardless of their geographic origin, and they want both controls applied at the edge with the lowest possible latency and cost. Which combination of controls should the security engineer implement?

Accepted Answer

Use CloudFront geographic restrictions (geo-blocking) to allow only Canada and the US, and associate an AWS WAF web ACL with an IP set rule to block the malicious IPs

Answer

Use AWS WAF geo-match rules to allow only Canada and the US, and configure security groups on the origin to block the malicious IP addresses

Answer

Use CloudFront geographic restrictions for both the country allow-list and the malicious IP blocking, since geo-restriction supports CIDR deny lists

Answer

Use a Lambda@Edge function to inspect the CloudFront-Viewer-Country header and the source IP, rejecting requests that do not match policy