Yes, you can use API Gateway without lambda. "API Gateway" is an industry term and not specific to Amazon. The point is exactly your line of reasoning, a funnel/gateway to your APIs. You can handle Auth, Throttling, etc at that point. AWS does provide other products for use against DDOS, WAF, Shield. ELB, Cloudfront, VPCs/SG. Their idea is to be able to scale, deflect if possible and absorb the attack. They also mention that with AWS API Gateway you can get Layer & & 3 DDOS protection and throttling for your backend. I've no practical experience nor have read any reports on how it holds up.
