Geth (GoEthereum) full nodes on Amazon Managed Blockchain for testnets and mainnet are secured by Sigv4 to prevent unauthorized use of your node, therefore you must append the appropriate Sigv4 signature to requests to the endpoints for the node.
In order to connect MetaMask to the node via an endpoint, you can create a proxy using AWS services such as API Gateway and AWS Lambda that will accept requests from MetaMask and append the Sigv4 signature to those requests and forward them to your node(s) in Amazon Managed Blockchain. This effectively provides a public endpoint from API Gateway that you can use with MetaMask as the custom RPC URL. Please note that this will open your node up to the public, so anyone with knowledge of that API Gateway endpoint will be able to send requests to the node.
For client applications, there are also helper libraries available to manage Web3 providers with Sigv4, e.g. https://github.com/awslabs/aws-web3-http-provider
!! Be mindful about protecting your AWS Access Key ID and Secret Access Key, as anyone who has your access keys has the same level of access to your AWS resources that you do.