Given a scenario where you need to secure an API gateway that is exposed to the internet, which AWS services would you integrate to provide a robust security layer against common web threats and DDoS attacks?