That can work, but it means you simply outsourced the problem to AWS. It's not a bad idea per se, but it means your service needs to talk, in some way, http.

You could use the service mesh thing from AWS, along with cognito jwts, for authenticatetion and authorization