We have a SSO workflow that use both Okta SAML2 and AWS Cognito User Pool
For some reason after few years it decided to stop working all of a sudden and returned 401 Authorisation Required and an error with Cloudfront.
We had Cloudfront -> ELB -> ELB rule to Auth -> Target group to EC2
So if you’re in the same situation you may want to check at your Cloudfront DefaultCachePolicy on the Cloufront Behaviour that calls your ELB.
We needed to include in the Cache key settings: Cookies: AWSALBAuthNonce (as well as AWSELBAuthSessionCookie-0 and AWSELBAuthSessionCookie-1)