We have a very similar setup with Cognito, GSuite and ALBs. For CLI/API access we also have API Gateway which allows to authenticate with JWT tokens that we can

We have a very similar setup with Cognito, GSuite and ALBs. For CLI/API access we also have API Gateway which allows to authenticate with JWT tokens that we can issue via Cognito. It's not perfect: * This setup only deals with Authentication. There is no authorization at all. I.e ANYONE with org gmail account can get in. * There is no real SSO. Say you have an application you need to login to behind this proxy. The proxy will pass you through to the login page, where you need to login (again) via whatever it is configured. It's not to say that it's impossible to solve as you have enough info in the headers/cookies that are passed from ALB to sort something out with custom solution, but it takes time. * You need to be very careful with your OAuth config. With GSuite, as example, you can very easily configure the OAuth client to authenticate ANY @gmail user instead of your @company...