CODEWITHSUNDEEP
apacheamazon-web-serviceselastic-ip
suman j
suman j

Reputation: 6960

limit access to AWS Elastic IP to US region

If I host a website on AWS EC2 with Elastic IP and I want to limit access to this website from US region users only, Is there any easy way to do this? Website is powered by Apache.

According to this link 

.htaccess
could be an option but didn't find a way to exclusively lock down my website to US region users only.

Upvotes: 1

Views: 1953

Answers (3)

John Hanley
John Hanley

Reputation: 81336

I will limit my answer to Amazon services.

Being able to block access by world location is an important issue today. With all of the various government regulations regarding where content is located / stored, controlling access may be a legal requirement in some situations.

Amazon has three services that support geolocation: Route53, CloudFront, and WAF (Web Application Firewall). No service is completely bulletproof but given the size of Amazon's network, all of the certifications, government compliance, etc. I tend to believe Amazon's geolocation would be better than a homebrew setup.

Your question specifies Elastic IP address. I am not aware of an Amazon service that supports geolocation blocking for your EIP. Instead, you will want to use Route53 and create a resource record set (RRS) or commonly called domain name or sub domain name to that EIP. Then put the server either in a private subnet, or put the front end service (CloudFront and/or ALB) in the same security group to limit who can access the EIP. Note: private subnets do not support EIP and are not required for ALB.

Configure geolocation as part of the setup for Route53, CloudFront or WAF (better a combination of these services). You can select the parts of the world (e.g. United States) to accept traffic from and block everybody else.

If I was building a small setup that did not require auto-scaling, I would use Route53 and CloudFront in front of my server. For higher fault-tolerance and high availability I would put the servers into a private subnet and add a load balancer with ASG (Auto Scaling Group) behind CloudFront and Route53 and add WAF to CloudFront (or the ALB).

Amazon VPCs via NACLs and Security Groups do not support any form of geolocation. Security Groups and NACLs are just very fast firewalls with a specific feature set. A VPN could be used if the customer base is tightly controlled (e.g. a group of developers or business partners) but would be untenable for a publicly accessed web server (e.g. customer portal). One might think that usernames or SSH keys could be used, but this does not control geography just authentication. A user could still access a server in France from Russia. If the requirement is geolocation, then the three Amazon services in the thread are good choices for geolocation based policies.

Route53:

Geolocation Routing

CloudFront:

Restricting the Geographic Distribution of Your Content

Amason WAF:

Working with Geographic Match Conditions

Upvotes: 5

Ashan
Ashan

Reputation: 19728

There several Cloud Native options available in AWS that could be used to restrict users to a particular region.

Upvotes: 1

joeymiller
joeymiller

Reputation: 283

You could use Cloudfront geoblocking. Block all but US. You will not 100% be able to block. You can spoof Ip and locations, but it's a start.

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html

Upvotes: 2

Related Questions