Early stage startup is irrelevant detail, unless you mean to say you can’t spend a lot of money right now. Attackers don’t care where you are in your financing

Early stage startup is irrelevant detail, unless you mean to say you can’t spend a lot of money right now. Attackers don’t care where you are in your financing rounds. If the traffic gets to nginx or your app you’ve already lost. You need to block the traffic farther out. AWS Shield is where you should focus, that’s what it’s for. If it’s only blocking a small percentage of the unwanted traffic consult with an expert about Shield configuration. Cloudflare is another widely-used option.