You have a highly available, cross-region application behind a global external HTTP(S) load balancer. You observe significant traffic spikes from multiple IP addresses of unknown intent and are concerned about application availability. You need to limit the traffic from these clients within a specified time interval.

What should you do?