AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceMedium
A media company streams video content globally using Amazon CloudFront. To comply with regional data protection laws, the company must ensure that content served to users in specific geographic locations is blocked if it originates from unapproved regions. The security team also wants to prevent access from known malicious IP addresses or ranges. Which CloudFront feature should be configured to meet these requirements?
- AOrigin Access Control (OAC)
- BField-level encryption
- CSigned URLs and Signed Cookies
- DGeo-restriction (Whitelist and Blacklist) and AWS WAF
Show answer & explanationAnswer & explanation
Correct answer: D. Geo-restriction (Whitelist and Blacklist) and AWS WAF
CloudFront's geo-restriction feature allows blocking or whitelisting content based on the user's geographic location, addressing the regional data protection requirement. AWS WAF, integrated with CloudFront, can be used to block requests from specific IP addresses or ranges, as well as protect against other web exploits, fulfilling the need to prevent access from known malicious IPs.
Why the other options are wrong
- A. Origin Access Control (OAC) ensures that CloudFront is the only way to access content in S3 buckets or other origins, preventing direct access, but doesn't handle geo-blocking or IP blacklisting.
- B. Field-level encryption encrypts specific data fields before they are sent to the origin, which is for data security but not for access control based on geography or IP.
- C. Signed URLs and Signed Cookies control access to private content, not geographic restrictions or blocking malicious IPs.
CloudFront Geo-restriction & WAF
Using CloudFront's built-in geo-restriction feature combined with AWS WAF to control content access based on geographic location and IP addresses.
- Geo-restriction allows whitelist/blacklist by country.
- AWS WAF filters requests based on IP, headers, body, etc.
- Both integrate directly with CloudFront distributions.
Memory trick: GEO stops 'LOCATIONS', WAF stops 'BAD IPs'.