Question

A media company distributes licensed video content through an Amazon CloudFront distribution backed by an S3 origin. Due to licensing agreements, the content must not be accessible from viewers located in three specific countries. The CloudOps engineer must enforce this restriction at the edge with minimal operational overhead and without modifying the origin. Which approach meets these requirements?

Accepted Answer

Configure CloudFront geographic restrictions (geo-blocking) with a blocklist of the three countries on the distribution.

Answer

Attach a network ACL to the S3 origin subnet denying inbound traffic from the countries' IP ranges.

Answer

Create a Route 53 geolocation routing policy that returns no answer for viewers in the three countries.

Answer

Add an S3 bucket policy condition using aws:SourceIp to deny requests from IP ranges in the three countries.