A company serves proprietary content through a CloudFront distribution and must restrict access to only users from the corporate office IP ranges. A WAF web ACL is attached to the distribution and the ACL’s default action is currently Count. What is the lowest-operational-overhead way to enforce access only from the corporate IP ranges?

The most efficient method is to create an AWS WAF IP address set containing the corporate IP ranges. Then, modify the existing web ACL's default action to Block. Finally, add a priority-0 rule to this ACL that explicitly allows requests originating from the created IP address set. This configuration ensures that only traffic from the corporate IP ranges is permitted, while all other traffic is blocked by default, minimizing operational overhead by reusing the existing WAF and avoiding new ACLs or complex regex. Incorrect options: Creating a new web ACL with a default action of Block and a regex pattern set is overly complex and introduces more management overhead than modifying the existing ACL. Setting the default action to Allow and then trying to allow specific IPs is a misconfiguration for restricting access; it would allow all traffic by default. Using a regex pattern set for IP ranges is less efficient and more error-prone than a dedicated IP address set.