Restricting the geographic … – docs.aws.amazon.com

If you enable CloudFront access logging, you can identify the requests that CloudFront rejected by searching for the log entries for which the value of sc-status (the HTTP status code) is 403. However, using only the access logs, you can’t distinguish a request that CloudFront rejected based on the location of the user from a request that …

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html