I haven't run Xenforo so I can't comment on that in particular, but I do have a pretty decent depth of experience with AWS and their CloudFront/WAF offerings. Happy to chat sometime, see if that's something that could be of use.
Thanks for the offer, but possibly way overkill, complexity and expense than I could find time for. Other than this recent attack, we've been golden.

