For non-PrivateLink clusters, the security group of the default router's AWS Load Balancer must have these rules exactly. Investigation is needed to determine if this is also the case for PrivateLink clusters.
"securityGroupRuleSet": {
"items": [
{
"isEgress": false,
"ipProtocol": "tcp",
"fromPort": 80,
"toPort": 80,
"cidrIpv4": "0.0.0.0/0"
},
{
"isEgress": false,
"ipProtocol": "tcp",
"fromPort": 443,
"toPort": 443,
"cidrIpv4": "0.0.0.0/0"
},
{
"isEgress": false,
"ipProtocol": "icmp",
"fromPort": 3,
"toPort": 4,
"cidrIpv4": "0.0.0.0/0"
}
]
}