We have configured CloudFront as a proxy, using Grafana URL as source, with a custom domain alias. This mostly works for us, the issue we are having doing this way is SAML is not working using CloudFront, but does using the Grafana URL. We have an open ticket at the moment with AWS support for the SAML issue.