My company blocks US-embargoed countries from accessing several e-commerce sites that we manage. I have to investigate whether we can move our current blocking solution to AWS as well. If AWS does not offer a means by which to block these countries, there are some of our sites that, due to subsequent technical issues, can never move to AWS, so I need to know the technical offerings of AWS in order to provide guidance on what sites we can migrate to it and which we cannot. I know we could do this on the instance/iptables level, but because that would require modifying literally every front-end server, we are looking to do this blocking on the AWS service level only. Thanks!
1 Answer
If you front your website with cloudfront, you could utilize their geo restriction feature. You could also use Route 53's geo DNS feature to null route the traffic.
http://aws.amazon.com/about-aws/whats-new/2013/12/18/amazon-cloudfront-adds-geo-restriction-feature/
http://aws.amazon.com/blogs/aws/route-53-domain-reg-geo-route-price-drop/
-
While the CloudFront option would have addressed the root issue, the answer I was looking for and needed to implement is the Route 53 Geo Routing (Geo DNS) option (the second link above). This was unavailable at the time of my post, but since it now exists, this is the answer. Sep 12, 2014 at 13:59
iptables
firewall and blocking per IP source (approximately since it's not exact/complete)