not too worried because amazon seems pretty generous but no need for cloudfront, the API gateway itself handles DDOS. A lot of times I find this to be a needless worry because the only time you are going to get DDOSed is if you piss some script kiddies or you are big enough on a competitors radar.