He mentioned he was looking at cloudflare logs. So its making an out bound tunnel and when the ec2 firewall is on it doesnt make a connection. If its an outbound tcp connection he should still be able to do a packet capture and see if the handshake is being performed.