AWS security Experts required for a project

I have an AWS EC2 instance with SQL DB installed on it. The instance has a several ports open to the internet for the technicians and developers who work throughout the country through POS terminals. And specifically some known ports which are exposed with no Firewall or WAF on it. I have had brute force attacks from different parts of the world as it is open to all internet. I need suggestions on blocking all the countries except allowing two countries to access this instance. The IP address is very crucial to us and we cannot afford to change the IP address of the instance as it will affect our production badly and all the technicians will have to be notified. Awaiting AWS experts solutions please? No trial/error solutions please.