Appstream 2.0 Geographic loaction restriction

Yes, you can restrict Amazon AppStream 2.0 access based on geographic location by implementing IP-based IAM policies. This approach ensures that AppStream 2.0 sessions can only be accessed from clients whose IP addresses belong to authorized ranges.

As part of security best practices for AppStream 2.0, you can limit access to AppStream 2.0 applications to specific IP ranges. This is particularly useful when you want to ensure that users can only connect from certain geographic locations or networks.

Additionally, you might want to consider other security measures that can complement geographic restrictions:

1. Enforcing single-session limits to prevent session sharing
2. Configuring session expiry and re-authentication requirements
3. Adding additional authentication by joining AppStream 2.0 fleets to Microsoft Active Directory

These combined approaches can help you create a more secure environment with geographic access controls for your AppStream 2.0 deployment.
Sources
Cookie-Based Authentication in Amazon AppStream 2.0 - Amazon AppStream 2.0

By the description, it looks like you are not using IdP but user pool. User Pool is not recommended for production purposes. Customers do not have any control over the URL/endpoint that users are using to access AppStream when using User Pool.

Ideally to meet this use case and in general, you should be using SAML where you can configure conditional access based on their requirement. In this case restricting from specific geographic location.

[+] Setting Up SAML https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html

[+] AppStream 2.0 Integration with SAML 2.0 https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-further-info.html

[+] Block access by location (example) https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-by-location