I have CloudFlare for domains that point to AWS instances. I set up a CloudFlare firewall rule to block traffic by country, where I manually included embargoed countries.
AWS has the Web Application Firewall that can do the same:
AWS WAF provides inline inspection of inbound traffic at the application layer to detect and filter against critical web application security flaws from common web exploits that could affect application availability, compromise security, or consume excessive resources.
We have customers in public sector and financial services who use AWS WAF to block requests from certain geographical locations, like embargoed countries, by applying geographic match conditions.
Lightsail also has a firewall which can block traffic by IP address. I could not find a tutorial to set up an AWS Web Application Firewall to Lightsail instances.
Is that possible?