Your authentication happens in AWS CloudFront. You have whitelisted all "swagger stuff". You could probably allow all "swagger stuff" excluding the swagger.json, but it won't work for a user visiting the page. The Swagger UI needs the swagger.json (or an equivalent openapi.json)... So if a user visits your Swagger UI unauthenticated, the user will see nonworking Swagger pages because he or she won't be able to load the necessary swagger.json.

Another idea is to generate the static web pages using a tool like swagger-ui-dist and host that publicly. You could do this in a build step of the API, so that the information is up to date with the actual implementation. Note that the swagger.json can likely be reverse engineered from this static code.

Most importantly, I don't see why you would be okay showing the API documentation, but not the swagger.json. They basically contain the same information... So why not share the swagger.json as well?