I set up a private subnet for a Tomcat server (tomcat 9.0.68) and a public subnet for a Bastion host on AWS. I set up an application load balancer that forwards traffic to the Tomcat server. I can access Tomcat main page with the load balancer URL, but when I try to click into "Manage App", I get a 403 access denied error.
On the host server, I configured webapps/manager/META-INF/context.xml to allow remote access to Tomcat Manager. I tested this in the Bastion host and it works. It just doesn't work on the load balancer URL.