Private MWAA with custom domain - connection timeout

I've set up a PRIVATE_ONLY mwaa instance and created an ALB, which points to private addresses of the VPC endpoint based on this guide:
https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-vpe-access.html
(I also added a new A record for my ALB in Route53 zone pointing to my ALB)

Target group reports both targets to be healthy and I can actually access the custom domain, which shows the Airflow login page (Sign in to Airflow). But after clicking on the login button and logging in, the URL I'm taken to is the URL of the vpce, not my custom domain. And because the mwaa instance is private and I'm not in the VPC, I get a connection timeout.

I also tried to use CNAME record instead of A record as mentioned in the docs: https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-faqs.html#custom-dns
But the same result - connection timeout.

Seems like after logging in, AWS no longer uses the custom domain, but instead tries to use the default (vpce) url. Is there something I'm not doing correctly?

Edited by: vlmsgst on Aug 25, 2021 12:28 AM