I have written a web hook for PayPal IPN and I only want to allow access from PayPal servers on Port 80/443 to the EC2 instance hosting the end point.
In the EC2 security group console I can only filter by IP/Range. This isn't adequate as PayPal say they change IP address randomly and without no notice, so one must use the hostnames.
I've seen answers here that recommend widening the IP Block etc but no real direct solution. One proposed solution was to update the Security Group using the AWS API.
Is this the best option? What I could do is have a scheduled task to compare the current IP that the PayPal host resolves to the last known IP address. If they are different, then update the AWS EC2 group.
I would run that task on the same machine, because hey, if the machine stops then access to the endpoint won't be available anyway.
Is this the most appropriate solution? I will do the same for my home where I have a similar problem.