This is ehy you can create budget limits in AWS. DDOS to your site is not legitimate traffic and AWS will provide you protection against it. Cloudfront is limit

This is ehy you can create budget limits in AWS. DDOS to your site is not legitimate traffic and AWS will provide you protection against it. Cloudfront is limited by default too. I cant remember the actual req/s but there is a limit. You can also limit access to certain countries where your legitimate users are.