@sds
If trying to remain on AWS for all infra, Shield will be your only option, but the pricing ain't cheap.
If willing to delegate your DNS to Cloudflare, you can get pretty awesome (IMO) built-in DDoS protection for free, and optional analytics for $25/mth on their Business plan.