Try setting frontentUrl to loadbalancer's host and port in realm settings. In your case, https://scdf-01.aws.net/

Keycloak is very picky about URLs. It adds a backend URL to access token claims (the issuer claim IIRC), and if it doesn't match a hostname/port from request url, it will reject the token after successful authentication.