AWS WAF Geo Restriction for MCP Servers

GeoMatchStatement syntax and country codes

WAF geo match uses ISO 3166-1 alpha-2 two-letter country codes. The GeoMatchStatement matches a single country or list of countries. Use the NOT statement wrapper to invert the logic for allowlist (permit-only) approaches.

// CDK: Block requests from a specific list of countries (blocklist approach)
import * as wafv2 from "aws-cdk-lib/aws-wafv2";

const geoBlocklist: wafv2.CfnWebACL.RuleProperty = {
  name: "GeoBlockHigh AbuseRegions",
  priority: 3,
  action: { block: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "GeoBlockHighAbuse",
    sampledRequestsEnabled: true,
  },
  statement: {
    geoMatchStatement: {
      countryCodes: ["KP", "CU", "IR", "SY"],  // OFAC-sanctioned; block for compliance
    },
  },
};

// CDK: Allowlist approach — allow ONLY specific countries (block everyone else)
// Useful for MCP servers with geographic compliance requirements
const geoAllowlist: wafv2.CfnWebACL.RuleProperty = {
  name: "GeoAllowlistOnly",
  priority: 3,
  action: { block: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "GeoAllowlistBlock",
    sampledRequestsEnabled: true,
  },
  statement: {
    // NOT (US OR CA OR GB OR AU OR EU countries) = block all others
    notStatement: {
      statement: {
        geoMatchStatement: {
          countryCodes: [
            "US", "CA", "GB", "AU", "NZ",           // English-speaking
            "DE", "FR", "ES", "IT", "NL", "SE",      // EU core
            "JP", "KR", "SG", "IN",                  // APAC developer markets
          ],
        },
      },
    },
  },
};

Geo-amplified rate limits instead of hard blocking

Hard blocking entire countries is a blunt instrument — it blocks legitimate developers who happen to be in high-abuse regions and does nothing against attackers using VPNs. A more surgical approach: apply the same rate limit structure for all traffic but reduce the threshold for regions with disproportionate abuse-to-legitimate-use ratios.

// CDK: Stricter rate limit for high-abuse regions (not a hard block)
// Normal limit: 1,000 POST/5min. High-abuse regions: 200 POST/5min.

const strictGeoRateLimit: wafv2.CfnWebACL.RuleProperty = {
  name: "McpStrictGeoRateLimit",
  priority: 4,
  action: { block: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "McpStrictGeoRateLimit",
    sampledRequestsEnabled: true,
  },
  statement: {
    rateBasedStatement: {
      limit: 200,                          // 5× stricter than normal 1,000/5min limit
      aggregateKeyType: "IP",
      scopeDownStatement: {
        andStatement: {
          statements: [
            // Only applies to MCP POST requests
            {
              byteMatchStatement: {
                fieldToMatch: { uriPath: {} },
                searchString: "/mcp",
                positionalConstraint: "STARTS_WITH",
                textTransformations: [{ priority: 0, type: "LOWERCASE" }],
              },
            },
            {
              byteMatchStatement: {
                fieldToMatch: { method: {} },
                searchString: "POST",
                positionalConstraint: "EXACTLY",
                textTransformations: [{ priority: 0, type: "UPPERCASE" }],
              },
            },
            // Only applies to requests from high-abuse-traffic regions
            {
              geoMatchStatement: {
                countryCodes: ["CN", "RU", "BR", "VN"],  // Adjust based on your WAF logs
              },
            },
          ],
        },
      },
    },
  },
};

This rule and the normal 1,000/5min rule coexist in the same WebACL. Requests from the high-abuse regions hit the 200/5min limit at priority 4; requests from other regions only hit the 1,000/5min limit at whatever priority you assigned it. A Chinese developer using your MCP server normally will never trigger either limit; a Chinese bot generating 300 requests in 5 minutes will hit the strict limit and get blocked, while the same traffic from a US IP would only hit the broader limit.

CloudFront vs ALB geo accuracy

The accuracy of geo restriction depends on where WAF is placed in the request path. CloudFront WAF is generally more accurate for globally distributed clients.

ForwardedIP with geo: For ALB-fronted servers, you can improve accuracy by using the X-Forwarded-For header to extract the client IP, then doing geo lookup on that. WAF's GeoMatchStatement on ForwardedIpConfig is available on rate-based rules but not on standalone GeoMatchStatement. To do geo lookup on the XFF header IP, use a rate-based rule with aggregateKeyType: FORWARDED_IP and add a scope-down geoMatchStatement — WAF evaluates the geo based on the aggregation key IP in that context.

Combining geo restriction with the full WAF stack

Geo rules fit naturally between IP reputation (priority 1) and rate limits (priority 2) in the rule evaluation order. Hard compliance blocks go at the top; soft geo-amplified rate limits sit just after the general rate rules.

// Rule priority order for MCP server WAF:
// Priority 0 — Allow IP set (uptime monitors, CI/CD IPs — skip all checks)
// Priority 1 — IP Reputation List (block known bad IPs)
// Priority 2 — OFAC compliance blocklist (block sanctioned countries — hard block)
// Priority 3 — Post rate limit global (1,000 POST/5min per IP)
// Priority 4 — Post rate limit geo-amplified (200 POST/5min from high-abuse regions)
// Priority 5 — SSE rate limit (10,000 GET/5min per IP on /mcp paths)
// Priority 10 — KnownBadInputsRuleSet (Log4j, SSRF, path traversal)
// Priority 20 — CommonRuleSet (XSS, SQLi — with MCP exclusions)
// DefaultAction: ALLOW

// OFAC compliance geo block (hard block, priority 2):
const ofacGeoBlock: wafv2.CfnWebACL.RuleProperty = {
  name: "OFACGeoBlock",
  priority: 2,
  action: { block: {} },
  visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "OFACGeoBlock", sampledRequestsEnabled: true },
  statement: {
    geoMatchStatement: {
      countryCodes: ["KP", "CU", "IR", "SY"],   // https://ofac.treasury.gov/sanctions-programs-and-country-information
    },
  },
};

Limitations and bypass vectors

Geo restriction is a speed bump, not a wall. Sophisticated attackers bypass it with VPNs, proxies, and Tor. For MCP servers, treat geo restriction as a cost-raising measure against opportunistic abuse, not as a security control against determined adversaries.

Common failure modes