aws lightsail offers a firewall which is a pretty good option as a first line of defense for your server, but what doesn't work for me is that it only allows rule by ip.
on my use case most of our users have dynamic ips (working from home or on the road), so we would like to be able to add hosts (like dyndns.org) so the ip address is updated based on the users dynamic ip.
its not avaiable as a default option, will try to resolve.
on digital ocean we have the same problem, but i believe there is an option to get this updated via a script you can run and do the update.
you can check another posts.