Hi Remy,
I agree with your design: it fits the one my colleagues and I designed for our customer. What is changing is the use of the LoadBalancer. Our applications lives in a shared api enviroment and we need authorization on the edge. This is reason why we used an API Gateway.
I think, your recommendation to split subnets is the most important in a security point of view.