A technology firm is building a cloud-based messaging platform designed for global users. The system exposes its core functionality through APIs, which are delivered to the public using Amazon API Gateway. These APIs route requests to backend services running on Amazon EC2 instances behind a Network Load Balancer (NLB). The company wants to implement a robust security strategy that both protects against common web application attacks such as SQL injection and also offers strong defenses against large-scale Distributed Denial of Service (DDoS) attacks. What is the most effective combination of services to meet these requirements?