Introducing AWS WAF
This sounds like ModSecurity - AWS style. The problem with WAF has always been ensuring you have a good ruleset. You need to be extremely careful with aggressive rules or you can break your application in area's you don't expect. It takes lots and lots of trial and error writing out a safe ruleset that doesn't break stuff. I wonder what the cycle would look like trying to get this right on AWS?<p>One area I can see this being used for my purposes right now is to limit URL patterns down to IP restrictions for /admin type area's on a web app. 
This means this can be done A) Outside of app source code and B) without having to do any fancy reverse proxy work and setup of subdomains.