CloudFront Distributions Should Have Geo Restriction Enabled

Using Console

To remediate the misconfiguration “CloudFront Distributions Should Have Geo Restriction Enabled” for AWS using AWS console, follow the below steps:

Log in to your AWS console.
Navigate to the CloudFront service.
Click on the name of the distribution that you want to remediate.
Click on the “Behaviors” tab.
Click on the “Create Behavior” button.
In the “Create Behavior” screen, scroll down to the “Restrict Viewer Access (Use Signed URLs or Signed Cookies)” section.
Click on the “Yes” radio button for “Restrict Viewer Access”.
In the “Geo Restriction” section, click on the “Yes” radio button for “Restrict access to your content by country/region”.
In the “Whitelist” section, select the countries/regions that you want to allow access to your content.
Click on the “Create” button to save the behavior.

Once completed, the CloudFront distribution will have geo restriction enabled.

Using CLI

To remediate the misconfiguration of CloudFront distributions not having Geo Restriction enabled in AWS using AWS CLI, follow these steps:

Open your terminal and ensure you have AWS CLI installed and configured with the necessary permissions to modify CloudFront distributions.
Identify the CloudFront distribution that needs Geo Restriction enabled. You can use the following command to list all the CloudFront distributions in your AWS account:
aws cloudfront list-distributions
This command will return a JSON object containing information about all the CloudFront distributions in your account.
Once you have identified the distribution that needs Geo Restriction enabled, you can use the following command to enable Geo Restriction:
aws cloudfront update-distribution --id <distribution-id> --distribution-config '{"GeoRestriction":{"RestrictionType":"whitelist","Quantity":0}}'
Replace <distribution-id> with the ID of the distribution that needs Geo Restriction enabled.
After running the above command, you should receive a JSON object containing information about the updated CloudFront distribution.
Verify that Geo Restriction has been enabled for the distribution by running the following command:
aws cloudfront get-distribution-config --id <distribution-id>
This command will return a JSON object containing the configuration of the specified CloudFront distribution. Verify that the GeoRestriction object is present and contains the correct configuration.

That’s it! You have successfully remediated the misconfiguration of CloudFront distributions not having Geo Restriction enabled in AWS using AWS CLI.

Using Python

To remediate the CloudFront Distributions should have Geo Restriction enabled misconfiguration in AWS using Python, follow the below steps:

Import the required libraries:

import boto3

Initialize AWS credentials:

aws_access_key_id = 'YOUR_AWS_ACCESS_KEY_ID'
aws_secret_access_key = 'YOUR_AWS_SECRET_ACCESS_KEY'
region_name = 'YOUR_AWS_REGION_NAME'

session = boto3.Session(
    aws_access_key_id=aws_access_key_id,
    aws_secret_access_key=aws_secret_access_key,
    region_name=region_name
)

cloudfront = session.client('cloudfront')

Get the list of CloudFront distributions:

distributions = cloudfront.list_distributions()

Loop through the distributions and check if Geo Restriction is enabled:

for distribution in distributions['DistributionList']['Items']:
    distribution_id = distribution['Id']
    distribution_config = cloudfront.get_distribution_config(Id=distribution_id)
    geo_restriction = distribution_config['DistributionConfig']['Restrictions']['GeoRestriction']['RestrictionType']
    if geo_restriction != 'whitelist':
        # Geo Restriction is not enabled, remediate the misconfiguration

Remediate the misconfiguration by enabling Geo Restriction:

distribution_config['DistributionConfig']['Restrictions']['GeoRestriction']['RestrictionType'] = 'whitelist'
cloudfront.update_distribution(
    DistributionConfig=distribution_config['DistributionConfig'],
    Id=distribution_id,
    IfMatch=distribution_config['ETag']
)

Note: This code assumes that you have the necessary AWS credentials and permissions to access and modify CloudFront distributions.

Using Terraform

resource "aws_cloudfront_distribution" "THIS_DISTRIBUTION" {
  # Replace THIS_DISTRIBUTION with your distribution name/identifier
  enabled             = true
  default_root_object = "index.html"

  origins {
    domain_name = "ORIGIN_DOMAIN_NAME" # e.g., mybucket.s3.amazonaws.com
    origin_id   = "ORIGIN_ID"

    s3_origin_config {
      origin_access_identity = "ORIGIN_ACCESS_IDENTITY"
    }
  }

  default_cache_behavior {
    target_origin_id       = "ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https"

    allowed_methods = ["GET", "HEAD"]
    cached_methods  = ["GET", "HEAD"]

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  # This block enables Geo Restriction as required by the finding
  restrictions {
    geo_restriction {
      restriction_type = "whitelist"     # or "blacklist" / "none"
      locations        = ["US", "CA"]    # replace with the list of country codes you require
    }
  }

  viewer_certificate {
    acm_certificate_arn            = "ACM_CERTIFICATE_ARN"
    ssl_support_method             = "sni-only"
    minimum_protocol_version       = "TLSv1.2_2021"
  }

  # ...any other required arguments (logging, price_class, aliases, etc.)
}

Changing the restrictions / geo_restriction block is an in‑place update for an existing CloudFront distribution and does not force replacement, though CloudFront will take some time to propagate the config globally.After you add or modify the restrictions.geo_restriction block, terraform plan should show an in-place update on aws_cloudfront_distribution.THIS_DISTRIBUTION with the new restriction_type and locations values being added or changed.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

CloudFront Distributions Should Have Geo Restriction Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: