Cloudflare tunnel only requires outbound port opened, check if you’ve allowed all outbound ports in EC2 security group (the default VPC should have this already).
Otherwise it’s probably a misconfiguration reaching the IP/port of the cloudflared service on the EC2. Have you tried checking cloudflared logs? Does your tunnel status show up as healthy?