问题:

I am looking for a way to drop connections from known spam ip addresses on an Amazon's Elastic Load Balancer (ELB)?

I am currently doing this at the web server level (multiple instances, running behind the ELB), but wondering if there is a way to do it at the ELB. This way, I can avoid configuring each web server instance for this.

I typically pull the Drop List from Spamhause.org every day and update my web server configuration

回答1:

I would try using VPC ACLs for that. First of all, ELBs inside VPC can use Security Groups but they only specify a traffic you allow in and out of an ELB. To actually block a traffic coming from a certain IP - an ACL would be the best.

For that to work - a pair of a public (internet-facing) and internal ELBs need to be used with internal ELB protected by subnet ACL DENY rules.

回答2:

You can't do this from an ELB that is not instantiated inside a VPC (at the date of this answer). If inside a VPC, check out the other answers. If not, you can switch to something more controlable, such as HAProxy or place CloudFlare (https://www.cloudflare.com/) in front of your ELB, which is probably a better option.