I am biased, as I work for a content delivery network as a security Presales engineer.
However, leveraging a Ddos mitigation solution on a content delivery network ensures that you never run out of resources at the origin. It's similar to putting an F5 load balancer in front of your site, but spread to thousands of locations around the world.
A good cdn will allow you to cloak the origin with a whitelist which you install on the aws firewall. So when attackers perform their reconnaissance on Amazon, your IP address will come up empty as everything will be blocked.
So the Ddos attacks are blocked when the traffic hits a node as close as possible to the attacker. This ensures you mitigate Ddos attacks as far away from the asset you are trying to protect.
A good cdn can also perform health checks and failover traffic to other locations eg another ego on in ass, Azure, rack space, soft layer, a physical dc etc. It should also have a WAF to ensure you can block application layer exhaustion attacks like RUDY, slowpost, slowloris as well as sqli, xss, rfi, lfi etc.
By default the cdn also blocks network layer attacks like teardrop, icmp attacks, synfloods etc.
A cdn is able to mitigate Ddos attacks because trey have vast amounts of capacity to accept the requests, filter out bad traffic and pass on the good traffic.
So amplifying attacks like ntp, DNS, ssdp, chargen and snmp volumetric attacks can be blocked.
The largest attack I have seen to date has been 321gbps in July 2014. During this attack there was also a DNS protocol attack at 20gbps. So you will need to ensure you DNS infrastructure is also resilient to withstand a huge number of requests.
From the description you provided, it looks like you were subject to an exhaustion attack, where thr attacker opened up lots of threads such that all the threads were consumed up on the web server, app server or firewall. It's similar to something like a slowpost, slowloris or RUDY.
To block against application layer exhaustion attacks you will need to get a web application firewall (WAF). A typical network firewall (including amazons firewall and next generation firewalls) won't be able to block it. Sent work firewalls these days can only block about 30% of all the attacks these days (Nov 2014).