Question

A media company serves a public web application through an Application Load Balancer protected by AWS WAF. Legal requirements mandate that the application only be accessible from users located in Canada and the United States. However, the security team notices that after adding a geo match rule to block all countries except CA and US, a significant number of legitimate North American users are still being blocked. Investigation shows these users route through a third-party content delivery and optimization proxy service whose egress nodes are located in Europe. What is the MOST appropriate way to enforce the geographic restriction while allowing these legitimate users?

Accepted Answer

Configure AWS WAF to inspect the forwarded client IP in the X-Forwarded-For header for the geo match, and add an IP set allow rule for the trusted proxy egress ranges evaluated first.

Answer

Replace the geo match statement with a rate-based rule scoped to the European egress IP ranges so legitimate traffic is throttled rather than blocked.

Answer

Move the geo match rule from the ALB web ACL to a CloudFront distribution and rely on CloudFront's built-in geo restriction feature instead.

Answer

Disable the geo match rule and instead use security groups on the ALB to allow only CA and US CIDR blocks published by AWS.