Question

A media company streams licensed video content through a CloudFront distribution backed by an S3 origin. Due to licensing agreements, the content must not be accessible to viewers located in a specific list of countries. The SysOps administrator must enforce this restriction with minimal operational overhead and without modifying the application. Which approach satisfies this requirement?

Accepted Answer

Configure CloudFront geographic restrictions (geo restriction) with a blocklist of the disallowed countries on the distribution.

Answer

Create a network ACL on the VPC hosting the S3 bucket that denies inbound traffic from the disallowed country IP ranges.

Answer

Add an S3 bucket policy with an aws:SourceIp condition listing all IP ranges for the disallowed countries.

Answer

Use Route 53 geolocation routing to return NXDOMAIN for viewers in the disallowed countries.