Both ELB and CloudFront provide some security. They prevent against specific layer 3 and layer 7 attacks by virtue of terminating the connection, before passing it on to your server. This include DDOS and SlowLoris.
CloudFront has the advantage that it has nodes all over the world, and massive amounts of bandwidth. That can mitigate many DDOS attacks simply because of scale. ELB also scales with traffic, but not as quickly as CloudFront, as it has to start or allocate new servers.
Incoming traffic is free on AWS. This means they absorb the attacks no charge to you.
Using either of those products increases your security. You don't need to use both. I suggest you just use CloudWatch for now.
I just set up CloudFront for my EC2 server, it's fairly easy, but with a few gotachas around https. The broad steps (including HTTPS) are:
- Use AWS certificate manager to create a certificate for your domains (including www subdomain) in the US-EAST-1 region (MUST be that region)
- Set up a new subdomain for your origin. CloudFront needs this. For example I used origin.example.com and configured Nginx to respond to that address.
- Set up CloudFront with that origin, with your domain and subdomains as alternate. Set up your behaviors carefully, taking into account what should and shouldn't be cached. Even if nothing is cached your website is likely to be faster than if it goes over the internet, as once the request hits CloudFront it travels over the private optimized AWS backbone, not the public internet. Dynamic content is fine, just set the TTL to 0.
- Ideally, set up Route 53, use alias records to point to CloudFront, move your DNS over, and change it to be your name servers
If you want to improve your security ever more you can use AWS WAF. it integrates with CloudFront. It's cheaper than most WAFs, but you'll probably spend low tens of dollars per month if it's set up comprehensively. Personally I don't bother, my service isn't critical.
If you want an even easier option, use CloudFlare. This isn't part of AWS, but it's super simple to set up, and they have a free tier. I use it for most of my websites.