Just for the record: if you've got ALB or CloudFront or something like that in front of the site, AWS WAF is worth giving a try. It has a lot of configurability, can block bot traffic and also prevent other types of attack attempts, and best part is that it blocks all that harmful traffic before it...
