AWS really needs to step up and provide DDOS mitigation if they want to be a challenger to CloudFlare and other DDOS-protected VPS services. While some companies can certainly just scale up to 1,000 instances to "out-compute" a DDOS, that is not feasible for a majority of AWS users. Although, it's unlikely they will provide such a service, since doing so would mean fewer AWS resources and hence, less money for them.