1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# ConstraintTemplate: defines the Rego logic
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8spspprivilegedcontainer
spec:
  crd:
    spec:
      names:
        kind: K8sPSPPrivilegedContainer
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8spspprivilegedcontainer

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged container is not allowed: %v", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged init container is not allowed: %v", [container.name])
        }
---
# Constraint: applies the template to all Pods
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
  name: deny-privileged-containers
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    excludedNamespaces:
      - kube-system
      - gatekeeper-system
  enforcementAction: deny

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedrepos
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRepos
      validation:
        openAPIV3Schema:
          type: object
          properties:
            repos:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sallowedrepos

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not startswith(container.image, input.parameters.repos[_])
          msg := sprintf(
            "Container <%v> image <%v> not from an allowed registry. Allowed: %v",
            [container.name, container.image, input.parameters.repos]
          )
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: require-approved-registries
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    repos:
      - "123456789012.dkr.ecr.us-east-1.amazonaws.com/"
      - "123456789012.dkr.ecr.us-west-2.amazonaws.com/"
      - "public.ecr.aws/"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged-containers
  annotations:
    policies.kyverno.io/title: Disallow Privileged Containers
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Privileged mode disables most security mechanisms and must not be allowed.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-privileged
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - kyverno
      validate:
        message: "Privileged containers are not allowed."
        pattern:
          spec:
            containers:
              - =(securityContext):
                  =(privileged): false
            =(initContainers):
              - =(securityContext):
                  =(privileged): false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
  annotations:
    policies.kyverno.io/title: Require Resource Limits
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: medium
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: require-limits
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "All containers must have CPU and memory limits defined."
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
  annotations:
    policies.kyverno.io/title: Require Labels
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: medium
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: require-team-label
      match:
        any:
          - resources:
              kinds:
                - Deployment
                - StatefulSet
                - DaemonSet
      validate:
        message: "The label 'app.kubernetes.io/managed-by' is required."
        pattern:
          metadata:
            labels:
              app.kubernetes.io/managed-by: "?*"
    - name: require-cost-center
      match:
        any:
          - resources:
              kinds:
                - Namespace
      validate:
        message: "Namespaces must have a 'cost-center' label for billing."
        pattern:
          metadata:
            labels:
              cost-center: "?*"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
  annotations:
    policies.kyverno.io/title: Restrict Image Registries
    policies.kyverno.io/category: Supply Chain Security
    policies.kyverno.io/severity: high
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: validate-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: >-
          Images must come from an approved ECR registry.
          Allowed: 123456789012.dkr.ecr.*.amazonaws.com, public.ecr.aws
        foreach:
          - list: "request.object.spec.containers"
            deny:
              conditions:
                all:
                  - key: ""
                    operator: NotEquals
                    value: "123456789012.dkr.ecr.*"
                  - key: ""
                    operator: NotEquals
                    value: "public.ecr.aws/*"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-security-context
spec:
  rules:
    - name: add-run-as-non-root
      match:
        any:
          - resources:
              kinds:
                - Pod
      mutate:
        patchStrategicMerge:
          spec:
            securityContext:
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# buildspec.yml for AWS CodeBuild
version: 0.2

phases:
  install:
    commands:
      - curl -L https://github.com/open-policy-agent/conftest/releases/download/v0.55.0/conftest_0.55.0_Linux_x86_64.tar.gz | tar xz
      - mv conftest /usr/local/bin/
      - curl -L https://github.com/kyverno/kyverno/releases/download/v1.17.1/kyverno-cli_v1.17.1_linux_x86_64.tar.gz | tar xz
      - mv kyverno /usr/local/bin/

  pre_build:
    commands:
      - echo "Running policy checks..."
      # OPA/conftest validation
      - conftest test k8s-manifests/ --policy policy/ --output json > conftest-results.json
      # Kyverno CLI validation
      - kyverno apply kyverno-policies/ --resource k8s-manifests/ --output json > kyverno-results.json

  build:
    commands:
      - echo "All policy checks passed. Proceeding with deployment..."
      - kubectl apply -f k8s-manifests/

reports:
  conftest:
    files:
      - conftest-results.json
  kyverno:
    files:
      - kyverno-results.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# .github/workflows/policy-check.yml
name: Policy Validation
on:
  pull_request:
    paths:
      - 'k8s-manifests/**'
      - 'policy/**'

jobs:
  conftest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run conftest
        uses: instrumenta/conftest-action@v0.3.0
        with:
          files: k8s-manifests/
          policy: policy/

  kyverno:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Kyverno CLI
        run: |
          curl -LO https://github.com/kyverno/kyverno/releases/download/v1.17.1/kyverno-cli_v1.17.1_linux_x86_64.tar.gz
          tar xzf kyverno-cli_v1.17.1_linux_x86_64.tar.gz
          sudo mv kyverno /usr/local/bin/
      - name: Validate manifests
        run: kyverno apply kyverno-policies/ --resource k8s-manifests/ --exit-code 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Kyverno: Enforce Restricted pod security profile
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-restricted-profile
spec:
  validationFailureAction: Enforce
  rules:
    - name: restrict-capabilities
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Containers must drop ALL capabilities and may only add NET_BIND_SERVICE."
        pattern:
          spec:
            containers:
              - securityContext:
                  capabilities:
                    drop:
                      - ALL
                    =(add):
                      - NET_BIND_SERVICE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-network-policy
spec:
  validationFailureAction: Audit
  rules:
    - name: require-netpol
      match:
        any:
          - resources:
              kinds:
                - Deployment
      preconditions:
        all:
          - key: ""
            operator: NotIn
            value: ["kube-system", "kyverno", "gatekeeper-system"]
      validate:
        message: "A NetworkPolicy must exist in the namespace before deploying workloads."
        deny:
          conditions:
            all:
              - key: ""
                operator: AnyNotIn
                value: ""

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-automount-sa-token
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-automount
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
      validate:
        message: "Pods must set automountServiceAccountToken to false."
        pattern:
          spec:
            automountServiceAccountToken: false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# falco-values.yaml

driver:
  kind: modern_ebpf

falco:
  json_output: true
  log_stderr: true
  log_level: info
  priority: warning
  grpc:
    enabled: true
  grpc_output:
    enabled: true

collectors:
  kubernetes:
    enabled: true
  containerd:
    enabled: true

falcosidekick:
  enabled: true
  webui:
    enabled: true
    replicaCount: 1
  config:
    slack:
      webhookurl: ""  # Set via --set or secret
      minimumpriority: "warning"
    aws:
      cloudwatchlogs:
        loggroup: "/eks/falco/alerts"
        logstream: ""
        minimumpriority: "warning"
      sns:
        topicarn: "arn:aws:sns:us-east-1:181303648587:alert-critical"
        minimumpriority: "critical"
      s3:
        bucket: "my-falco-logs-bucket"
        prefix: "falco/"
        minimumpriority: "notice"

tolerations:
  - effect: NoSchedule
    operator: Exists

resources:
  requests:
    cpu: 100m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1024Mi

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# custom-rules.yaml

# -------------------------------------------------------------------
# Rule: Detect Cryptomining Processes
# Scenario: Attacker deploys XMRig or similar miner in a compromised pod
# -------------------------------------------------------------------
- rule: Detect Cryptomining Binary Execution
  desc: >
    Detects execution of known cryptocurrency mining binaries
    in any container. Covers XMRig, ethminer, cgminer, and
    common pool connections.
  condition: >
    spawned_process and container and
    (proc.name in (xmrig, minerd, minergate-cli, cgminer,
    bfgminer, ethminer, cpuminer, cpuminer-multi,
    t-rex, phoenixminer, nbminer, gminer) or
    proc.cmdline contains "stratum+tcp://" or
    proc.cmdline contains "stratum+ssl://" or
    proc.cmdline contains "--donate-level" or
    proc.cmdline contains "pool.minexmr.com" or
    proc.cmdline contains "monerohash.com")
  output: >
    Cryptominer detected in container
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name
    image=%container.image.repository)
  priority: CRITICAL
  tags: [cryptomining, mitre_execution, T1496]

# -------------------------------------------------------------------
# Rule: Detect Reverse Shell
# Scenario: Attacker establishes outbound shell after initial access
# -------------------------------------------------------------------
- rule: Reverse Shell in Container
  desc: >
    Detects reverse shell connections from containers using
    common techniques: bash -i redirect, netcat, socat, python,
    and perl reverse shells.
  condition: >
    spawned_process and container and
    ((proc.name = bash and proc.cmdline contains "/dev/tcp/") or
    (proc.name in (nc, ncat, netcat) and
     proc.cmdline contains "-e") or
    (proc.name = socat and
     proc.cmdline contains "exec:") or
    (proc.name = python and
     proc.cmdline contains "socket" and
     proc.cmdline contains "connect") or
    (proc.name = perl and
     proc.cmdline contains "socket"))
  output: >
    Reverse shell detected
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name
    connection=%fd.name)
  priority: CRITICAL
  tags: [reverse_shell, mitre_execution, T1059]

# -------------------------------------------------------------------
# Rule: Detect Container Escape Attempts
# Scenario: Attacker attempts to break out of container isolation
# -------------------------------------------------------------------
- rule: Container Escape via nsenter or chroot
  desc: >
    Detects attempts to escape container isolation using nsenter,
    chroot to host filesystem, or access to Docker socket.
  condition: >
    spawned_process and container and
    (proc.name = nsenter or
    (proc.name = chroot and proc.cmdline contains "/host") or
    (proc.name = mount and proc.cmdline contains "/var/run/docker.sock") or
    proc.cmdline contains "/.dockerenv" or
    proc.cmdline contains "/proc/1/root")
  output: >
    Container escape attempt detected
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name)
  priority: CRITICAL
  tags: [container_escape, mitre_privilege_escalation, T1611]

# -------------------------------------------------------------------
# Rule: Detect Unexpected Privilege Escalation
# Scenario: Process gains root privileges inside a container
# -------------------------------------------------------------------
- rule: Privilege Escalation via setuid Binary
  desc: >
    Detects execution of setuid/setgid binaries or direct calls
    to privilege escalation tools inside containers.
  condition: >
    spawned_process and container and
    (proc.name in (su, sudo, doas) or
    (proc.name = chmod and proc.cmdline contains "+s") or
    (proc.name = chown and proc.args contains "root"))
  output: >
    Privilege escalation attempt
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name)
  priority: WARNING
  tags: [privilege_escalation, mitre_privilege_escalation, T1548]

# -------------------------------------------------------------------
# Rule: Detect Kubernetes API Enumeration
# Scenario: Compromised pod probes the K8s API for lateral movement
# -------------------------------------------------------------------
- rule: Kubernetes API Access from Container
  desc: >
    Detects curl or wget requests to the Kubernetes API server
    from within a container, which may indicate reconnaissance
    or credential theft attempts.
  condition: >
    spawned_process and container and
    (proc.name in (curl, wget) and
     (proc.cmdline contains "kubernetes.default" or
      proc.cmdline contains "10.96.0.1" or
      proc.cmdline contains "/api/v1/secrets" or
      proc.cmdline contains "/api/v1/namespaces"))
  output: >
    Kubernetes API access from container
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name)
  priority: WARNING
  tags: [k8s_api_access, mitre_discovery, T1613]

# -------------------------------------------------------------------
# Rule: Detect IMDS Credential Harvesting
# Scenario: Pod attempts to steal IAM credentials via metadata service
# -------------------------------------------------------------------
- rule: IMDS Credential Access from Container
  desc: >
    Detects attempts to access the EC2 Instance Metadata Service
    (IMDS) to harvest IAM role credentials from containers.
  condition: >
    spawned_process and container and
    (proc.name in (curl, wget) and
     (proc.cmdline contains "169.254.169.254" or
      proc.cmdline contains "metadata.google.internal"))
  output: >
    IMDS credential harvesting attempt
    (user=%user.name command=%proc.cmdline container=%container.name
    namespace=%k8s.ns.name pod=%k8s.pod.name)
  priority: CRITICAL
  tags: [credential_access, mitre_credential_access, T1552]

1
2
3
4
5
6
7
8
9
10
11
12
13
# Example: Detect unexpected database client in a web frontend pod
- rule: Unexpected DB Client in Frontend
  desc: Frontend containers should never run database clients
  condition: >
    spawned_process and container and
    k8s.ns.name = "frontend" and
    proc.name in (mysql, psql, mongo, redis-cli, mongosh)
  output: >
    Database client in frontend container
    (command=%proc.cmdline pod=%k8s.pod.name
    namespace=%k8s.ns.name)
  priority: CRITICAL
  tags: [application_specific, lateral_movement]

1
2
3
4
5
6
7
8
9
# Pod Security Standard: Restricted
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS CloudFront Geographic Access Control with WAF Integration'

Parameters:
  ApplicationName:
    Type: String
    Description: Name of the application for resource naming
    Default: 'geo-secure-app'
    
  OriginDomainName:
    Type: String
    Description: Origin server domain name
    
  AllowedCountries:
    Type: CommaDelimitedList
    Description: List of allowed country codes (ISO 3166-1 alpha-2)
    Default: 'US,CA,GB,AU,DE,FR,JP'
    
  BlockedCountries:
    Type: CommaDelimitedList
    Description: List of specifically blocked country codes
    Default: 'CN,RU,KP,IR'
    
  ComplianceRegion:
    Type: String
    Description: Primary compliance region
    Default: 'US'
    AllowedValues: ['US', 'EU', 'APAC', 'GLOBAL']
    
  GeoBlockingMode:
    Type: String
    Description: Geographic blocking strategy
    Default: 'WHITELIST'
    AllowedValues: ['WHITELIST', 'BLACKLIST', 'HYBRID']

Conditions:
  IsWhitelistMode: !Equals [!Ref GeoBlockingMode, 'WHITELIST']
  IsBlacklistMode: !Equals [!Ref GeoBlockingMode, 'BLACKLIST']
  IsHybridMode: !Equals [!Ref GeoBlockingMode, 'HYBRID']

Resources:
  # AWS WAF Web ACL with Advanced Geographic Controls
  GeographicWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${ApplicationName}-geo-waf-acl'
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Description: 'Advanced geographic access control with compliance features'
      
      Rules:
        # 1. Whitelist Mode - Allow only specific countries
        - !If
          - IsWhitelistMode
          - Name: AllowedCountriesRule
            Priority: 1
            Statement:
              GeoMatchStatement:
                CountryCodes: !Ref AllowedCountries
            Action:
              Allow: {}
            VisibilityConfig:
              SampledRequestsEnabled: true
              CloudWatchMetricsEnabled: true
              MetricName: !Sub '${ApplicationName}-allowed-countries'
          - !Ref 'AWS::NoValue'
              
        # 2. Blacklist Mode - Block specific countries
        - !If
          - IsBlacklistMode
          - Name: BlockedCountriesRule
            Priority: 2
            Statement:
              GeoMatchStatement:
                CountryCodes: !Ref BlockedCountries
            Action:
              Block:
                CustomResponse:
                  ResponseCode: 403
                  CustomResponseBodyKey: 'geo-blocked-response'
            VisibilityConfig:
              SampledRequestsEnabled: true
              CloudWatchMetricsEnabled: true
              MetricName: !Sub '${ApplicationName}-blocked-countries'
          - !Ref 'AWS::NoValue'
              
        # 3. Admin Access Exception (bypass geo-blocking for admin IPs)
        - Name: AdminAccessException
          Priority: 3
          Statement:
            IPSetReferenceStatement:
              Arn: !GetAtt AdminIPSet.Arn
          Action:
            Allow: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: !Sub '${ApplicationName}-admin-exception'
            
        # 4. API Endpoint Geographic Control
        - Name: APIGeographicControl
          Priority: 4
          Statement:
            AndStatement:
              Statements:
                - ByteMatchStatement:
                    SearchString: '/api/'
                    FieldToMatch:
                      UriPath: {}
                    TextTransformations:
                      - Priority: 1
                        Type: LOWERCASE
                    PositionalConstraint: STARTS_WITH
                - NotStatement:
                    Statement:
                      GeoMatchStatement:
                        CountryCodes: !Ref AllowedCountries
          Action:
            Block:
              CustomResponse:
                ResponseCode: 403
                CustomResponseBodyKey: 'api-geo-blocked-response'
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: !Sub '${ApplicationName}-api-geo-control'
            
        # 5. Compliance Monitoring Rule
        - Name: ComplianceMonitoringRule
          Priority: 5
          Statement:
            NotStatement:
              Statement:
                GeoMatchStatement:
                  CountryCodes: !Ref AllowedCountries
          Action:
            Count: {}  # Log for compliance monitoring without blocking
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: !Sub '${ApplicationName}-compliance-monitor'

      # Custom Response Bodies
      CustomResponseBodies:
        geo-blocked-response:
          ContentType: APPLICATION_JSON
          Content: |
            {
              "error": "Access Denied",
              "message": "Access from your geographic location is not permitted.",
              "code": "GEO_RESTRICTED",
              "support": "contact-support@example.com"
            }
        api-geo-blocked-response:
          ContentType: APPLICATION_JSON
          Content: |
            {
              "error": "API Access Denied", 
              "message": "API access from your geographic location is restricted.",
              "code": "API_GEO_RESTRICTED",
              "documentation": "https://docs.example.com/api/geographic-restrictions"
            }

      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: !Sub '${ApplicationName}-geo-waf-acl'

  # IP Set for Admin Access Exceptions
  AdminIPSet:
    Type: AWS::WAFv2::IPSet
    Properties:
      Name: !Sub '${ApplicationName}-admin-ip-set'
      Scope: CLOUDFRONT
      IPAddressVersion: IPV4
      Addresses:
        - '203.0.113.0/24'  # Replace with actual admin IP ranges
        - '198.51.100.0/24'
      Description: 'Admin IP addresses exempt from geographic restrictions'

  # CloudFront Distribution with Geo-Restriction
  GeographicCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: !Sub 'Geographic access control distribution for ${ApplicationName}'
        
        # Associate WAF Web ACL
        WebACLId: !GetAtt GeographicWebACL.Arn
        
        # Origins Configuration
        Origins:
          - Id: !Sub '${ApplicationName}-primary-origin'
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
                - TLSv1.3
        
        # Default Cache Behavior
        DefaultCacheBehavior:
          TargetOriginId: !Sub '${ApplicationName}-primary-origin'
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT
            - POST
            - PATCH
            - DELETE
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          
          # Cache Policy for Geographic Content
          CachePolicyId: !Ref GeographicCachePolicy
          OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf  # CORS-S3Origin
          
        # Native CloudFront Geo-Restriction (Backup Layer)
        Restrictions:
          GeoRestriction: !If
            - IsWhitelistMode
            - RestrictionType: whitelist
              Locations: !Ref AllowedCountries
            - !If
              - IsBlacklistMode  
              - RestrictionType: blacklist
                Locations: !Ref BlockedCountries
              - RestrictionType: none
        
        # SSL Configuration
        ViewerCertificate:
          AcmCertificateArn: !Ref SSLCertificate
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2021
          
        # Global Distribution
        PriceClass: PriceClass_All
        
        # Logging Configuration
        Logging:
          Bucket: !GetAtt GeoLoggingBucket.DomainName
          Prefix: 'cloudfront-geo-logs/'
          IncludeCookies: true  # Include cookies for geographic analysis

  # Geographic Cache Policy
  GeographicCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub '${ApplicationName}-geo-cache-policy'
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          QueryStringsConfig:
            QueryStringBehavior: none
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - CloudFront-Viewer-Country
              - CloudFront-Viewer-Country-Region
              - Accept-Language
          CookiesConfig:
            CookieBehavior: none

  # S3 Bucket for Geographic Logs
  GeoLoggingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${ApplicationName}-geo-logs-${AWS::AccountId}-${AWS::Region}'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - Id: ArchiveOldLogs
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA
              - TransitionInDays: 90
                StorageClass: GLACIER
            ExpirationInDays: 2555  # 7 years for compliance

  # Lambda@Edge for Advanced Geographic Logic
  AdvancedGeographicFunction:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt GeographicLambdaDeployment.Arn
      
  GeographicLambdaDeployment:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${ApplicationName}-advanced-geographic-logic'
      Runtime: python3.12
      Handler: index.lambda_handler
      Role: !GetAtt GeographicLambdaRole.Arn
      Code:
        ZipFile: |
          import json
          import re
          
          def lambda_handler(event, context):
              """
              Advanced geographic logic for CloudFront requests
              """
              request = event['Records'][0]['cf']['request']
              headers = request['headers']
              
              # Extract geographic information
              country = headers.get('cloudfront-viewer-country', [{}])[0].get('value', '')
              region = headers.get('cloudfront-viewer-country-region', [{}])[0].get('value', '')
              
              # Business hours restriction by geography
              if country in ['US', 'CA']:
                  # Additional logic for business hours restrictions
                  import datetime
                  current_hour = datetime.datetime.utcnow().hour
                  if current_hour < 6 or current_hour > 22:  # Outside business hours
                      return {
                          'status': '403',
                          'statusDescription': 'Forbidden',
                          'body': 'Access restricted outside business hours'
                      }
              
              # VPN/Proxy detection enhancement
              user_agent = headers.get('user-agent', [{}])[0].get('value', '')
              if 'VPN' in user_agent or 'Proxy' in user_agent:
                  # Additional verification required
                  request['headers']['x-geo-verification-required'] = [{'key': 'X-Geo-Verification-Required', 'value': 'true'}]
              
              return request

  GeographicLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # SSL Certificate (assume pre-existing or create separately)
  SSLCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref OriginDomainName
      ValidationMethod: DNS

  # CloudWatch Dashboard for Geographic Analytics
  GeographicDashboard:
    Type: AWS::CloudWatch::Dashboard
    Properties:
      DashboardName: !Sub '${ApplicationName}-geographic-analytics'
      DashboardBody: !Sub |
        {
          "widgets": [
            {
              "type": "metric",
              "x": 0, "y": 0, "width": 12, "height": 6,
              "properties": {
                "metrics": [
                  ["AWS/WAFV2", "AllowedRequests", "WebACL", "${GeographicWebACL}", "Rule", "AllowedCountriesRule"],
                  [".", "BlockedRequests", ".", ".", ".", "."]
                ],
                "period": 300,
                "stat": "Sum",
                "region": "us-east-1",
                "title": "Geographic Access Control Overview"
              }
            },
            {
              "type": "metric", 
              "x": 12, "y": 0, "width": 12, "height": 6,
              "properties": {
                "metrics": [
                  ["AWS/WAFV2", "BlockedRequests", "WebACL", "${GeographicWebACL}", "Rule", "BlockedCountriesRule"],
                  [".", ".", ".", ".", ".", "ComplianceMonitoringRule"]
                ],
                "period": 300,
                "stat": "Sum", 
                "region": "us-east-1",
                "title": "Blocked Access by Rule"
              }
            }
          ]
        }

Outputs:
  WebACLId:
    Description: 'Geographic WAF Web ACL ID'
    Value: !GetAtt GeographicWebACL.Arn
    Export:
      Name: !Sub '${ApplicationName}-geo-waf-acl-id'
      
  CloudFrontDistributionId:
    Description: 'CloudFront Distribution ID'
    Value: !Ref GeographicCloudFrontDistribution
    Export:
      Name: !Sub '${ApplicationName}-cloudfront-id'
      
  CloudFrontDomainName:
    Description: 'CloudFront Domain Name'
    Value: !GetAtt GeographicCloudFrontDistribution.DomainName
    Export:
      Name: !Sub '${ApplicationName}-cloudfront-domain'
      
  LoggingBucket:
    Description: 'S3 Bucket for Geographic Logs'
    Value: !Ref GeoLoggingBucket
    Export:
      Name: !Sub '${ApplicationName}-geo-logs-bucket'