How to Block Traffic From a Single IP in AWS
Yes, we can block traffic from single IP or IP range. Please follow below steps to do this

Open VPC dashboard



Open the Network ACLs view



Open the ACL editor


Select the subnet to which your EC2 instances or load balancers are connected.

Click Inbound Rules

Click Edit




Add a rule to block the traffic/IP

You will now see the ACL editor. On the last row, you can add a new rule.

Here is how you should fill out the fields:
Rule
Use any number less than 100, which is the number of the default accept-all rule. This is important because rules are evaluated in order, and your rule needs to come before the default.
Type
Select “All traffic” or Particular Protocol which you want to Block
Source
The CIDR you want to block. To match a single IP address, enter it here and append /32. For example, I blocked 22.87.45.187/32
Allow/Deny
Select “DENY”
Now click Save and you should see the updated rules table.
Fore more details visit https://www.serverkaka.com/2018/05/block-traffic-from-single-ip-in-aws.html

UPDATE: How to do it in CLI

NOTE: This example command includes --dry-run option, so it is safe to run. It will not create NACL rule. Run it without this option, if you want to apply it.

aws ec2 create-network-acl-entry --dry-run --network-acl-id acl-146adb6f --ingress --rule-number 20 --protocol tcp --port-range From=80,To=80 --cidr-block 22.87.45.187/32 --rule-action deny

More examples:
https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html#examples