How do I use AWS WAF to allow or block requests from a specific country or geolocation?

Short description

To block access to your site from specific countries or allow access only to specific countries, use the geographic match rule statement.

Add a geographic match rule statement to allow web requests from the countries that you want to allow. Then, add a second geographic match rule statement for the countries that you want to block.

Note: If you use Amazon CloudFront geographic restrictions to block a country's access to your content, then CloudFront blocks every request from that country. CloudFront doesn't forward the requests to AWS WAF. To use AWS WAF criteria to allow or block requests based on geography, use an AWS WAF geographic match rule statement instead.

Resolution

Complete the following steps:

1. Open the AWS WAF console.
2. For Region, choose the AWS region where you created your protection pack.
3. In the navigation pane, choose Resources & protection packs.
4. On the right side of protection pack, select the icon next to region name to choose the protection pack.
5. In your selected protection pack, select Rules.
6. Select View and edit next to Rules to view or modify the rules associated with your protection pack.
7. In the right pane for Manage rules choose Add rules.
8. Select Geo-based rule.
9. To set up your rule, configure the following values:
   For Action, choose Allow or Block for custom rules.
   Note: If the default action is Block, then set the rule's action to Allow. If the default action is Allow, then set the rule's action to Block and add a NOT statement that specifies countries not to block.
   For Name, enter a name for your rule.
   For Statement, choose Originates from a country name.
10. Choose the country that you want to allow or block.
11. (Optional) Choose Rule configuration check Source IP address for origin.
    Choose Source IP address or IP address in header to define the request's country of origin.
    Warning: When a request routes through a content delivery network (CDN) or other proxy network, the source IP address identifies the proxy. In this case, the original IP address is sent in a header. Proxies can inconsistently manage headers and modify them to bypass inspection.
12. Choose Create Rule.