https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...
Edit: Seemingly it could be free, but you must manually handle your certs to some degree.
Edit 2: Cloudfront now comes with "AWS Shield Standard" automatically to protect from DDOS?