I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is scanned with different attacks multiple times a week (i.e., management of this is not simple). This environment is mostly for B2B and does not host a great deal of traffic, so my thought would be that we should block away.

I would think for other environments that are very high in consumer traffic, blacklisting IPs may not be the best idea because, as we know, IP addresses can change frequently and be assigned to non-malicious users. We wouldn't want to block a potential customer from our website.

A follow up question would be, is it best practice to then remove these blacklisted IPs after some time in case they no longer are associated with an attacker?