We used a CloudFront viewer-request 301 redirect. and it works good. The only “downside” is cosmetic: the browser URL changes to the Grafana workspace hostname.