Timeout after login in Private MWAA behind ALB with Custom Domain

Could you please validate the 1) target group's (Registered Targets [1])which are attached to the ALb and also the security groups attached to the ALB ? "If this does not work, please open open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/create "? We can debug the issue and raise a request with Service team if needed.

[1] https://aws.amazon.com/blogs/aws/new-application-load-balancing-via-ip-address-to-aws-on-premises-resources/

I know it's an old question, but the issue still seems relevant.

It seems that AWS SSO does not support a custom domain redirect, and will always try to send you back to the MWAA environment's URL, even if you started from a custom domain.

The only way we managed to work around this isn't very satisfying. We created this script to launch the MWAA dashboard:

#!/bin/bash
HOST=custom-domain.example.com
URL=https://$HOST/aws_mwaa/aws-console-sso?login=true#
WEB_TOKEN=$(aws mwaa create-web-login-token --name my-airflow-env --query WebToken --output text)
open $URL$WEB_TOKEN

(Note that the open command in the last line is specific to macOS. It opens the URL in the default browser.) This isn't original, but I can't immediately find where I got this idea to credit it.

Obviously, this requires having CLI credentials and won't be appropriate for all users. I would love to see a "real" solution to this issue.