Restrict Lightsail machine to be accessed from cloudfront

I have a website (https://www.cakexpo.com) hosted on lightsail. Few days ago, we faced a DDOS Attack on the IP which forced me onboard my website to cloudfront.

I moved my website to cloudfront, yet my ip address is still publicly available and making it vulnerable for more attacks again.

I am trying to understand how I can hide my ip from public access.

I found that in vpc, you can get the list of corresponding cloudfront ips and whitelist them in security group., which I tried

It worked for some time, but later on I realised that cloudfront uses lots of Ips which are not listed here and thus not whitelisted in my security group. This makes my site intermittent unavailable.

nslookup shows a different ip, which is not listed in the above list, and this link says that there 190+ ips associated with Cloudfront, which security group cannot handle, IMO. https://ip-ranges.amazonaws.com/ip-ranges.json

Finally I ended up reverting the config and made my IP public.

Is there any other way to hide the lightsail machines from public access?

you can do this in 2 ways. easy Way: Create a ngnix reverse proxy instance in lightsail, allow access to ur lightsail main instance only from that reverse proxy instance. then Create a distribution instance (with is cloudfront for lightsail) then point as Origin the reverse proxy instance. Hard Way: vpc peering to Aws, from there you Create a cloudfront instance. allows access from it.