Is geographic restriction possible for API Gateway?

Question

I'm aware that CloudFront offers free geographic restriction so that one can prevent selected jurisdictions from being able to download one's CF distribution. But I'm much more concerned about API calls being abused than my content being downloaded. I am confident that API Gateway fully supports such protection, yet I cannot find any documentation of it.

MikeLim · Answer

You can create your CloudFront distribution with API Gateway as origin, and implement geo-restriction.

More information at [How do I set up API Gateway with my own CloudFront distribution?](https://repost.aws/knowledge-center/api-gateway-cloudfront-distribution)

You can also use [AWS WAF](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html) to protect API Gateway. Create a custom rule that does geo-restriction, as per [How do I use AWS WAF to allow or block requests from a specific country or geolocation?](https://repost.aws/knowledge-center/waf-allow-block-country-geolocation)

Didier Durand · Answer

Hi,

I'd suggest to use WAF for this: see https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.html to block / allow by country or region.

Best,

Didier

Is geographic restriction possible for API Gateway?

Add your answer

Relevant content