That's exactly it, as other have said there is no "real" defense against DDOS beside outcapacity the attacker, Amazon's infrastructure is just "innate" in that regard. Basically they make sure they always have the capacity for holiday shopping (Prime day, Black Friday .etc.) when the traffic will increase many fold ... So to Amazon, a DDOS attack is no difference than the increase traffic spike they would see on a holiday, and they ALWAYS have more than enough capacity for it. Whenever an attack happens, Amazon's serve just look at it and thought "oh, is it Christmas today?" and scale up. Because of their ceiling is so high that I doubt any attacker would be able to exceed it.