I suggest you block direct access to the server as that's a back door into the server and a DDOS attack. I would do this by putting the Tomcat instance into a private subnet. If you must have it in a public subnet I would ensure only a few things can reach it - the ALB (using VPC CIDR range is easiest) and specified IPs. If it's private you can use AWS ...
With John on this one, you're likely missing or have incorrectly set up your ingress rule. You'll want to use something like below, though not exact.
Specific target tags input a network tag assigned to the VM
IP range(s) you want to be able to access your app
Protocols and Ports:
This is an educated guess. I think this might be a case of both the Manager part and Apache using HTTP authentication headers for authentication.
When the client connects to http://localhost/manager, Apache asks for authentication credentials for LDAP authentication. The client will then send the authentication information to Apache, which accepts the ...
based on https://stackoverflow.com/questions/5808206/how-to-fix-tomcat-http-status-403-access-to-the-requested-resource-has-been-den
it seems that you are missing a role definition.
In the tomcat-users.xml file add a user with the role manager :
<user username="admin" password="admin" roles=&...