AWS Security group rule for certbot renewal
You just can not because from Let's Encrypt FAQ:


  
  What IP addresses does Let’s Encrypt use to validate my web server?
  
  We don’t publish a list of IP addresses we use to validate, because
  they may change at any time. In the future we may validate from
  multiple IP addresses at once.
  


You will need a reverse proxy (usually a WAF), routing /.well-know/acme to a machine and answering the challenges (from anywhere) and doing the IP filtering before forwarding to your application all other requests.