Explanation:

AWS provides multiple services to help mitigate DDoS attacks:

• A. CloudFront: Amazon CloudFront is a Content Delivery Network (CDN) that can help mitigate DDoS attacks by:

  • Distributing traffic across multiple edge locations
  • Absorbing and filtering malicious traffic before it reaches your origin servers
  • Providing built-in DDoS protection capabilities

• B. AWS Shield: AWS Shield is a managed DDoS protection service that provides:

  • AWS Shield Standard: Automatic protection for all AWS customers at no additional cost
  • AWS Shield Advanced: Enhanced DDoS protection with additional features and 24/7 access to the AWS DDoS Response Team

• C. AWS EC2: Amazon EC2 instances themselves do not provide DDoS protection and can be vulnerable to attacks without additional protection services.

• D. AWS Config: This service is for compliance auditing and resource tracking, not DDoS protection.

The AWS documentation emphasizes minimizing attack surface area by using CDNs (like CloudFront) and load balancers, and AWS Shield provides dedicated DDoS protection capabilities.