I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no access to the load balancer so I need to block access at the server's level.
I changed the apache access log to display IP's based on the X-Forwarded-For header provided by the load balancer (otherwise it just displays the load balancer's IP), so I can identify these IP's and block them (again by specifying the X-Forwarded-For) with something like:
<Directory api_dir> SetEnvIF X-FORWARDED-FOR "22.214.171.124" DenyIP Order allow,deny allow from all deny from env=DenyIP </Directory>
However, this still means that I need to manually handle every attack, and my server suffers some downtime as a result.
What is the recommended way to automatically block attacks of repeated HTTP calls, based not on IP but on the Forwarded-For header coming from the load balancer.