We don’t use cloudfront but we use a competitor. Before we used it there would be millions of malicious attempted requests on our api. It doesn’t block everything and it makes things a pain for 1% of users but not using it would put tons of users data at risk.