CloudFront distribution has Geo restrictions enabled

Check ID: cloudfront_distributions_geo_restrictions_enabled
Provider: AWS
Service: cloudfront
Severity: LOW
Categories: internet-exposed
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions have geographic restrictions configured to limit access by country using an allowlist or blocklist (RestrictionType not none).

Risk

Absent geo restrictions, content is globally reachable, enabling:

Access from sanctioned or unlicensed regions (confidentiality/compliance)
Broader bot abuse, scraping, and DDoS staging (availability)
More credential-stuffing and fraud attempts against apps

Recommendation

Apply least privilege to distribution scope: enable geo restrictions with a country allowlist where feasible, or maintain a precise blocklist aligned to legal, licensing, and threat models. Layer defense in depth: use WAF/bot controls, signed URLs or cookies, and monitoring to detect abuse and configuration drift.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add Restrictions.GeoRestriction with RestrictionType: “whitelist” and Locations: [“US”], then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origins {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    cache_policy_id        = "<example_cache_policy_id>"
  }

  restrictions {
    geo_restriction {
      restriction_type = "whitelist" # CRITICAL: enables geo restrictions
      locations        = ["US"]      # CRITICAL: at least one allowed country
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: "<example_origin_domain>"
            Id: "<example_origin_id>"
        DefaultCacheBehavior:
          TargetOriginId: "<example_origin_id>"
          ViewerProtocolPolicy: allow-all
          CachePolicyId: "<example_cache_policy_id>"
        Restrictions:
          GeoRestriction:
            RestrictionType: whitelist  # CRITICAL: enables geo restrictions
            Locations:                  # CRITICAL: at least one allowed country
              - US

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_geo_restrictions_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution has Field Level Encryption enabled CloudFront viewer protocol policy enforces HTTPS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires