not too worried because amazon seems pretty generous but no need for cloudfront, the API gateway itself handles DDOS. A lot of times I find this to be a needless worry because the only time you are going to get DDOSed is if you piss some script kiddies or you are big enough on a competitors radar.
Didn't know about API gateway, so it's all good then. Also I meant to say "Cloudflare".