AWS CloudFront web distribution with geo restriction disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_374
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	4b1f46ec-9874-49f8-b735-902b47b7c676

Impact

The rule is checking whether AWS CloudFront web distributions have geographic restrictions enabled. This involves setting up geo restrictions to control access based on the geographic location of users attempting to access the content distributed by CloudFront.

Enabling geographic restrictions is important for maintaining control over where your content is accessible. This helps ensure compliance with regional legal and regulatory requirements while enhancing security by blocking access from regions irrelevant to your business or associated with potential malicious activity. By implementing geo restrictions, you can better protect your data and align with regional laws and policies.

How to Fix

Resource: aws_cloudfront_distribution

• Arguments: restrictions

Enable geo restriction for your AWS CloudFront distribution by including a restrictions block inside the aws_cloudfront_distribution resource. This block allows you to configure geo restrictions by specifying which countries are allowed or denied access.

This example demonstrates how to enable geo restriction for an AWS CloudFront distribution using Terraform. [source,go]

resource "aws_cloudfront_distribution" "example" { ... restrictions { geo_restriction { restriction_type = "whitelist" # Or "blacklist" depending on your use case locations = ["US", "CA", "GB"] # Example of allowed countries } } ... }