For my EC2 instance on Apache, does AWS have any firewall product besides Cloudfront?
Yes, AWS offers what they call AWS "WAF", short for Web Application Firewall. As the name implies, it's intended purpose is to help you protect your applications from exploits that are known to affect availability, security, as well as consume excessive resources.
AWS WAF allows you to control traffic (allow/block) to your web apps by creating customized rules. WAF is free to use, to sign up use the following link: AWS Web Application Firewall