On iOS, app users are confused by a warning about `amazoncognito.com` when choosing `Sign-in w/ Google`.

Answering my own question:

• Apple displays the message with a domain extracted from the URL used to reach Cognito. There's no way to interfere with the process.
• However, we can add a custom domain to the Cognito user pool so the URL exposes our own domain. With that update, I can have a message like:

"Mogaland" Wants to Use "mogaland.io" to Sign In. This allows the app aand website to share information about you. Cancel / Continue.

• As Apple cuts the URLs to expose a limited part of it, having different domains like auth.cert.mogaland.io and auth.prod.mogaland.io has no impact on the final user experience.

For CDK users, it's just a matter of calling addDomain():

    // Create user pool
    const userPool = new UserPool(this, ..., ...);

    // Set a custom domain for the authorization path
    const certificate = Certificate.fromCertificateArn(this, 'domainCert', props.acmCertificateARN);
    const domainName = `auth.${props.stageName}.mogaland.io`;
    userPool.addDomain('Custom Domain', {
        customDomain: {
            domainName,
            certificate,
        }
    });