Back to Checks
aws

CloudFront distribution has Geo restrictions enabled

cloudfront_distributions_geo_restrictions_enabled
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsCloudFrontDistribution

CloudFront distributions have geographic restrictions configured to limit access by country using an allowlist or blocklist (RestrictionType not none).

Prowler logoProwlerprowler-provider-aws

Risk

Absent geo restrictions, content is globally reachable, enabling:

  • Access from sanctioned or unlicensed regions (confidentiality/compliance)
  • Broader bot abuse, scraping, and DDoS staging (availability)
  • More credential-stuffing and fraud attempts against apps

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_geo_restrictions_enabled

Recommendation

Apply least privilege to distribution scope: enable geo restrictions with a country allowlist where feasible, or maintain a precise blocklist aligned to legal, licensing, and threat models.

Layer defense in depth: use WAF/bot controls, signed URLs or cookies, and monitoring to detect abuse and configuration drift.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add Restrictions.GeoRestriction with RestrictionType: "whitelist" and Locations: ["US"], then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origins {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    cache_policy_id        = "<example_cache_policy_id>"
  }

  restrictions {
    geo_restriction {
      restriction_type = "whitelist" # CRITICAL: enables geo restrictions
      locations        = ["US"]      # CRITICAL: at least one allowed country
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: "<example_origin_domain>"
            Id: "<example_origin_id>"
        DefaultCacheBehavior:
          TargetOriginId: "<example_origin_id>"
          ViewerProtocolPolicy: allow-all
          CachePolicyId: "<example_cache_policy_id>"
        Restrictions:
          GeoRestriction:
            RestrictionType: whitelist  # CRITICAL: enables geo restrictions
            Locations:                  # CRITICAL: at least one allowed country
              - US

Other

1In the AWS Console, go to CloudFront > Distributions
2Select the target distribution
3Open the Security tab > Geographic restrictions > Edit
4Choose Allow list (or Block list)
5Add at least one country to the list
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
    GeoRestrictionType,
)


class cloudfront_distributions_geo_restrictions_enabled(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)

            if distribution.geo_restriction_type == GeoRestrictionType.none:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} has Geo restrictions disabled."
            else:
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} has Geo restrictions enabled."

            findings.append(report)

        return findings

References