How to protect JAWS endpoints from abuse / DoS?

I plan to have the following setup:

1. Completely STATIC front-end web interface (built with AngularJS or the likes)
2. JAWS back-end APIs

I want to store my front-end in S3 and my back-end in Lambda. Since I'm charged every time the lambda function gets executed, I don't want everyone to be able to make requests directly to it. On the other hand, I want to store my front-end simply in S3 as opposed to a server.

How do I go about protecting my back-end API from abuse or DoS?