Configuring a country-based access policy
You can use a country-based access policy to allow or deny access to a CDN resource for users from specific countries.
Warning
When you use country-based access policies, the system tracks client locations by running their IP addresses through GeoIP databases. Occasionally, this data may be inaccurate or out-of-date, e.g., due to IP address reallocation among providers, change of address range ownership, or delayed updates of public sources.
To configure a country-based access policy:
-
In the management console, select the folder where your resource is located.
-
Navigate to Cloud CDN.
-
Click the resource name.
-
Navigate to the Security tab.
-
In the top-right corner, click Edit.
-
Enable Country-based access.
-
In the Access policy field, select:
Block specified countriesto restrict access to the resource from countries listed in the Country list field and allow access from all other countries.Allow specified countries onlyto allow access to the resource only from countries on the Country list and deny access from all other countries.
-
In the Country list field, enter two-letter uppercase country codes separated by commas, e.g.,
RU, KZ. -
Click Save.
To configure a policy, add the geoAcl section when using the create or update method for a Resource:
"geoAcl": {
"enabled": "boolean",
"mode": "string",
"countries": [
"string"
]
}
Where:
-
enabled: Enables the country-based access policy. -
mode: Policy type:MODE_ALLOW: Allow access only from countries specified incountries.MODE_DENY: Restrict access from countries specified incountries.
-
countries: List of two-letter uppercase country codes.
To configure a policy, add the geo_acl section when using the ResourceService/Create or ResourceService/Update call:
"geo_acl": {
"enabled": "bool",
"mode": "Mode",
"countries": [
"string"
]
}
Where:
-
enabled: Enables the country-based access policy. -
mode: Policy type:MODE_ALLOW: Allow access only from countries specified incountries.MODE_DENY: Restrict access from countries specified incountries.
-
countries: List of two-letter uppercase country codes.
It may take up to 15 minutes for the new settings of the existing resource to apply to the CDN servers. After that, we recommend purging the resource cache.