It works!

Request reached: CloudFront -> APIGW -> ALB -> Lambda

Origin protection is active.