FreeRADIUS MFA with Amazon Active Directory

Best Practices documentation recommends your WorkSpaces and AD infrastructure reside in a private subnet: https://docs.aws.amazon.com/whitepapers/latest/best-practices-deploying-amazon-workspaces/vpc-design.html#example-of-a-typical-configuration

As the FreeRadius server you deploy per this blog needs to communicate with the AD infrastructure it should be deployed in a subnet which is reachable from your AD subnet. The Reachability Analyzer may be able to help you troubleshoot further.