Refactor Sign In From Outside Country Detection

[bryan-robitaille]

Leverage the ability of the WAF to inject headers into a request so that the Application is aware the request is from outside the country and can trigger alerts as required.

Acceptance Criteria:

• WAF adds specific header to the request when the request is detected from outside of the accepted Geo Zone.
• Application verifies header during the JWT callback to ensure that any authenticated action is done from within the accepted Geo Zone.
• Application produces different alarms based on forbidden action:
  • Sign In at Cognito Level from outside Geo Zone
  • Sigin In Mfa level from outside Geo Zone
  • Authenticated action from outside Geo Zone.

[srtalbot]

Could we also provide the email address of the user in the alarm? Addresses coming from Global Affairs Canada would have a legitimate reason for logging in, whereas email domains from TBS would not.