The IP address that the request originated from. If the WebACL
is associated with a CloudFront distribution, this is the value of one of
the following fields in CloudFront access logs:
The two-letter country code for the country that the request originated
from. For a current list of country codes, see the Wikipedia entry ISO 3166-1
alpha-2.