What is the solution or alternative for really good DDoS protection plus some type of WAF?
On AWS you can get your DNS, load balancers and EC2 instances directly protected from DDoS attacks by Amazon but it's $3,000 a month with an annual commitment ($36,000 / year) + outgoing usage rates at about 5 cents per GB with AWS Shield Advanced. Although to be fair with Cloudflare in the enterprise world you'll end up being about equal to AWS' prices, but for a smaller business coming up with 36k / year isn't feasible. That could be more than your entire business makes.