There is a print-ready PDF

This screen is not made for printing. Please use the print-ready PDF.

PDF version: https://hannctl.com/KimJunHyun_Portfolio_EN.pdf

https://hannctl.com/en/print

Skip to content
KO EN
PDF ↓
← Field notes

FIELD NOTE · E16

"Turned on" and "actually blocking" are different things

Finding where a block policy could be bypassed, fixing it, and proving it with logs

In one line
In a CDN and load balancer setup, I found where a geo-block policy could be bypassed, fixed it, and proved the block with logs. This case is already fixed.
Highlights
  • Found the bypass by tracing the architecture
  • Fixed it by moving the check to the outer edge
  • Verified the block through log analysis
Tech
WAF · CloudFront · Athena · Log Analysis
Act 2 · AfterOuter gateCloudFrontInner gateALBServerKRGuard (checkpoint)Trusts the noteChecks the real IPProof that it blocksSourceCountryResult203.0.113.xAbroadBlocked203.0.113.xAbroadBlocked
The empty country column in the log fills in and gets a check. The block is proven.

Read the full record in Control Plane ↗

© 2026 Kim JunHyun · The infrastructure of this site is managed as code, too

Choose a theme

Click a badge to switch to that theme on the same content. Dragging only swings it.

Back to the front page →