[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud CDN](../../index.md) > [Step-by-step guides](../index.md) > Resources > Configuring a country-based access policy

# Configuring a country-based access policy

You can use a [country-based access policy](../../concepts/geo-acl.md) to allow or deny access to a CDN resource for users from specific countries.

{% note warning %}

When you use country-based access policies, the system tracks client locations by running their IP addresses through GeoIP databases. Occasionally, this data may be inaccurate or out-of-date, e.g., due to IP address reallocation among providers, change of address range ownership, or delayed updates of public sources.

{% endnote %}

To configure a country-based access policy:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where your resource is located.
  1. [Navigate](https://console.yandex.cloud/link/cdn) to **Cloud CDN**.
  1. Click the resource name.
  1. Navigate to the ![image](../../../_assets/console-icons/shield.svg) **Security** tab.
  1. In the top-right corner, click ![image](../../../_assets/console-icons/pencil.svg) **Edit**.
  1. Enable **Country-based access**.
  1. In the **Access policy** field, select:

      * `Block specified countries` to restrict access to the resource from countries listed in the **Country list** field and allow access from all other countries.
      * `Allow specified countries only` to allow access to the resource only from countries on the **Country list** and deny access from all other countries.

  1. In the **Country list** field, enter two-letter uppercase [country codes](../../concepts/geo-acl.md#country-codes) separated by commas, e.g., `RU, KZ`.
  1. Click **Save**.

- REST API {#rest-api}

  To configure a policy, add the `geoAcl` section when using the [create](../../api-ref/Resource/create.md) or [update](../../api-ref/Resource/update.md) method for a [Resource](../../api-ref/Resource/index.md):

  ```json
  "geoAcl": {
    "enabled": "boolean",
    "mode": "string",
    "countries": [
      "string"
    ]
  }
  ```

  Where:

  * `enabled`: Enables the country-based access policy.
  * `mode`: Policy type:
      * `MODE_ALLOW`: Allow access only from countries specified in `countries`.
      * `MODE_DENY`: Restrict access from countries specified in `countries`.

  * `countries`: List of two-letter uppercase [country codes](../../concepts/geo-acl.md#country-codes).

- gRPC API {#grpc-api}

  To configure a policy, add the `geo_acl` section when using the [ResourceService/Create](../../api-ref/grpc/Resource/create.md) or [ResourceService/Update](../../api-ref/grpc/Resource/update.md) call:

  ```json
  "geo_acl": {
    "enabled": "bool",
    "mode": "Mode",
    "countries": [
      "string"
    ]
  }
  ```

  Where:

  * `enabled`: Enables the country-based access policy.
  * `mode`: Policy type:
      * `MODE_ALLOW`: Allow access only from countries specified in `countries`.
      * `MODE_DENY`: Restrict access from countries specified in `countries`.

  * `countries`: List of two-letter uppercase [country codes](../../concepts/geo-acl.md#country-codes).

{% endlist %}

It may take up to 15 minutes for the new settings of the existing resource to apply to the CDN servers. After that, we recommend [purging the resource cache](purge-cache.md).

#### Useful links {#see-also}

* [Country-based access policy](../../concepts/geo-acl.md)
* [Creating a resource](create-resource.md)