AWS WAF efficient rule for allowing specific IPs and Countries for specific URLs

You could accomplish this via rules in a Web ACL in AWS WAF. A geomatching rule like this:

Action": {
    "Block": {}
    "Statement": {
       "NotStatement": {
          "Statement": {
"GeoMatchStatement": {
          "CountryCodes": [
            "CA"
                      ]
        }

in your Web ACL would block all traffic except traffic originating in Canada.

You can also restrict access to an approved group of IP addresses by creating a list of addresses in WAF, and then creating a rule in the Web ACL to allow only those IP addresses.

You need to write a string match or regex match rule that looks at host header field AND put another condition to look for the country you want to allow. You may want to set web ACL default action to block as well.

Might want to look at this as well https://www.youtube.com/watch?v=ll-uvVgQ3Jg (skip to 50%)

{
  "Name": "test-rule",
  "Priority": 0,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "test-rule"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "Host"
              }
            },
            "PositionalConstraint": "STARTS_WITH",
            "SearchString": "abc.example.com",
            "TextTransformations": [
              {
                "Type": "LOWERCASE",
                "Priority": 0
              }
            ]
          }
        },
        {
          "GeoMatchStatement": {
            "CountryCodes": [
              "US"
            ]
          }
        }
      ]
    }
  }
}