Skip to content
Hannctl.
Field Notes

E16

"Turned on" and "actually blocking" are different things

Finding where a block policy could be bypassed, fixing it, and proving it with logs

This issue has already been fixed

  • WAF
  • CloudFront
  • Athena
  • Log Analysis
Act 2 · AfterOuter gateCloudFrontInner gateALBServerKRGuard (checkpoint)Trusts the noteChecks the real IPProof that it blocksSourceCountryResult203.0.113.xAbroadBlocked203.0.113.xAbroadBlocked
The empty country column in the log fills in and gets a check. The block is proven.

In one line

In a CDN and load balancer setup, I found where a geo-block policy could be bypassed, fixed it, and proved the block with logs. This case is already fixed.

Background

This happened in a CDN and load balancer setup. The issue is already fixed.

The path was user → CloudFront (a service that delivers content quickly worldwide) → ALB (a load balancer) → server, and a geo-blocking policy (blocking access by country) was in place to stop traffic from abroad.

Problem

I traced the architecture to check whether the policy really blocked what it was meant to block.

From the ALB’s point of view, the sender is CloudFront, not the user. So the WAF (web application firewall) rule on the ALB could not see the user’s IP directly. It determined the country from a forwarded header value, such as X-Forwarded-For.

A user can put any value in that header, so forging it could bypass the block.

Plain explanationA simple analogy

Picture a guard at the inner door who checks a note in your hand (“I am Korean”) instead of your face. Anyone can write a note. So I moved the check to the outer gate, where the guard sees your face directly.

What I did

  1. I moved the country check to a CloudFront rule that sees the real client IP, which removed the bypass.
  2. To confirm the block worked, I analyzed WAF logs in Athena (a service that queries stored logs with SQL). The country field came back empty.
  3. I traced the cause. The raw log had the country value, but the table definition (DDL) was missing the field. I fixed the DDL by hand.
Plain explanationWhy was fixing the DDL enough?

Athena does not load transformed data ahead of time. It applies the table structure at the moment it reads the raw files. So a value that exists in the file stays hidden if the definition lacks the field, and only the definition needs to change.

Result

  • The bypass is gone
  • Blocks by country can be verified in the logs

What I learned

Turning a control on is different from proving it stops the threat.

Open to work · Cloud infrastructure and security