Setup simple maintenance page for (private) ECS services within AWS

Question

Our current setup: corporate network is connected via VPN with AWS, Route53 entry is pointing to ELB which points to ECS service (both inside a private VPC subnet).

=> When you request the URL (from inside the corporate network) you see the web application. ✅

Now, what we want is, that when the ECS service is not running (maintenance, error, ...), we want to directly provide the users a maintenance page. At the moment you will see the default AWS 503 error page. We want to provide a simple static HTML page with some maintenance information.

---

What we tried so far:

1. Using Route53 with Failover to CloudFront distributing an S3 bucket with the HTML

   This does work, but:

   1. the Route53 will not failover very fast => Until it switches to CloudFront, the users will still see the default AWS 503 page.
   2. as this is a DNS failover and browsers (and proxies, local dns caches, ...) are caching once resolved entries, the users will still see the default AWS 503 page after Route53 switched, because of the caching. Only after the new IP address is resolved (may take some minutes or up until browser or os restart) will the user see the maintenance page.
   3. as the two before, but the other way around: when the service is back running, the users will see the maintenance page way longer, than they should.

   As this is not what we were looking for, we next tried:

2. Using CloudFront with two origins (our ELB and the failover S3 bucket) with a custom error page for 503.

   This is not working, as CloudFront needs the origins to be publicly available and our ELB is in a private VPC subnet ❌

   We could reconfigure our complete network environment to make it public and restrict the access to CloudFront IPs. While this will probably work, we see the following drawbacks:

   1. The security is decreased: Someone else could setup a CloudFront distribution with our web application as the target and will have full access to it outside of our corporate network.
   2. To overcome this security issue, we would have to implement a secure header (which will be sent from CloudFront to the application), which results in having security code inside our application => Why should our application handle that security? What if the code has a bug or anything?
   3. Our current environment is already up and running. We would have to change a lot for just an error page which comes with reduced security overall!

3. Use a second ECS service (e.g. HAProxy, nginx, apache, ...) with our application as target and an errorfile for our maintenance page.

   While this will work like expected, it also comes with some drawbacks:

   1. The service is a single point of failure: When it is down, you can not access the web application. To overcome this, you have to put it behind an ELB, put it in at least two AZs and (optional) make it horizontally scalable to handle bigger request amounts.
   2. The service will cost money! Maybe you only need one small instance with little memory and CPU, but it (probably) has to scale together with your web application when you have a lot of requests!
   3. It feels like we are back in 2000s and not in a cloud environment.

---

So, long story short: Are there any other ways to implement a f*****g simple maintenance page while keeping our web application private and secure?