There are two IP addresses (172.31.42.243 and 172.31.19.188) that are hitting my site in AWS (Beanstalk hosted) repeatedly with garbage requests.
I have tried to block them using ACL deny rules. If I add only one I'm still able to hit my site. If I add both then I'm not able to hit my site.
Both the deny rules are using /32 for the CIDR notation and the deny rules I added are lower numbers than the default allow all rule. What am I doing wrong?
Those aren't the IP addresses of the machines that are attacking you; those are the internal IP addresses of your ELB. That's also why you can't access your site after blocking them - no one can!
You need to look at the access logs on the ELB, not on your application server, to determine which IP address(es) are attacking you. You can configure access logging on your ELB on the "Description" tab, under "Attributes".