diff --git a/cloudfront_opsec.sh b/cloudfront_opsec.sh
new file mode 100644
index 0000000..612e1c5
--- /dev/null
+++ b/cloudfront_opsec.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+apt install ufw
+ufw allow ssh
+ufw default deny incoming
+ufw default allow outgoing
+for ip in $(curl https://ip-ranges.amazonaws.com/ip-ranges.json | jq '.prefixes[] | select(.service? == "CLOUDFRONT") | .ip_prefix?' | tr -d '"'); do ufw allow proto tcp from $ip to any port 80,443; done
+ufw enable