Site port 443 can be reached by itself, but 403 Forbidden from outside ( like WAN, public IP visit ) - apache

Question

I'm stuck around this problem for days, anyone here can point me out?
I installed Phoenix CTMS on a clean aws CentOS9 instance, now it seems okay by check from terminal:
curl -k https://localhost/login.jsf
It returns the correct html of that page. and then I did these:
Allow 80 and https 443 in security list of this instance;
confirmed tomcat8 and apache2 service are running;
but, when try to visit site https://public_ip/login.jsf it goes 403 Forbidden.
There are 4 conf under /etc/apache2/:
000-default.conf
default-ssl.conf
00_ctsms_http.conf
00_ctsms_https.conf
The last one is like
#<IfDefine SSL>
#<IfDefine !NOSSL>
<VirtualHost *:443>
ServerName localhost:443
TransferLog /var/log/apache2/access.log
ErrorLog /var/log/apache2/error.log
Include /etc/apache2/blocklist.conf
#Alias /documents /ctsms/documents/
#<Directory "/ctsms/documents">
#Options Indexes Multiviews
#AllowOverride None
#Require all granted
#</Directory>
Alias /signup/css /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/css
Alias /signup/fonts /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/fonts
Alias /signup/images /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/images
Alias /signup/js /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/js
Alias /signup/themes /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/themes
ScriptAliasMatch ^/signup(.*) /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public/dispatch.fcgi$1
#DocumentRoot /ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public
<Directory "/ctsms/bulk_processor/CTSMS/BulkProcessor/Projects/WebApps/Signup/public">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
#Order allow,deny
#Allow from all
Require all granted
AddHandler fcgid-script .fcgi
</Directory>
SetEnvIf Request_URI "/static/*" no-jk
SetEnvIf Request_URI "/signup/*" no-jk
Alias /resources /var/lib/tomcat8/webapps/ROOT/resources
<Directory "/var/lib/tomcat8/webapps/ROOT/resources">
#Options FollowSymLinks
#allow from all
AllowOverride None
Require all granted
</Directory>
Alias / /var/lib/tomcat8/webapps/ROOT/
<Directory "/var/lib/tomcat8/webapps/ROOT">
#Options FollowSymLinks
#allow from all
AllowOverride None
Require all granted
</Directory>
<Location "/WEB-INF/">
#AllowOverride None
deny from all
</Location>
DocumentRoot /var/lib/tomcat8/webapps/ROOT
JkMount /*.jsf ajp13
JkMount /rest/* ajp13
JkMount /inputfieldimage ajp13
JkMount /file ajp13
JkMount /beacon/* ajp13
JkMount /unsubscribe/* ajp13
SSLEngine on
#SSLProtocol -ALL +SSLv3 +TLSv1
#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
#SSLCertificateChainFile /etc/apache2/ssl.crt/ComodoIntermediateCertificates.crt
</VirtualHost>
#</IfDefine>
#</IfDefine>
I tried uncomment the line allow from all then restart apache2, still got 403 error.