I get where your coming from, and you’re right that it’s a complex setup. It comes with certain privacy trade-offs, but for this use case I’d seriously consider something like CloudFlare tunnels rather than trying to roll your own.
My suspicion is nginx on the AWS instance hijacking /.well-known/* for its own uses. That said if the homeserver is for the same domain as it’s publically reachable from, the .well-known should be unnecessary, but it might be to change the port, it’s been a while since I’ve looked.
You shouldn’t ultimately need to port forward anything extra beyond 443, heck I’m pretty sure my homeserver isn’t reachable on anything besides 443 even internally with how I’m running my proxies.
Might be worth giving [email protected] a cross post, and if you want to check federation with an actual human I’m @ghost:itsg.host on matrix 👻