A global ecommerce company hosts its website on AWS and uses Amazon CloudFront for content delivery. To comply with new data regulations, the company must block requests originating from certain countries. What is the most cost-effective solution?

CloudFront geo restriction is the most cost-effective solution because it is a built-in feature of CloudFront designed specifically for this purpose and incurs no additional cost beyond standard CloudFront usage. It allows you to create a whitelist or blacklist of countries. Using an AWS WAF web ACL with a geo match rule would also work, but WAF incurs additional costs per rule and per request, making it less cost-effective than CloudFront's native geo restriction for this specific use case. An IP match rule in WAF would be extremely complex and difficult to maintain due to the vast and frequently changing IP ranges for entire countries, making it impractical and costly. CloudFront geolocation headers provide country information but do not inherently block requests; they would require custom logic (e.g., Lambda@Edge) to implement blocking, adding complexity and cost.