EC2 504 Gateway Timeout Through Discord Proxy

Since the request arrives at your server and the response leaves (visible in your logs), the issue is not with EC2 or your security groups. Something between your server's response and the Discord client is dropping it.

The traffic path is: Discord Client → Discord Proxy → Cloudflare Tunnel → EC2 (works inbound) → EC2 response → Cloudflare Tunnel → Discord Proxy → Discord Client (fails on the return).

Most likely causes:

1. Host header mismatch

Discord's proxy rewrites the Host header when forwarding requests. If your Cloudflare tunnel routes based on the Host header (which it does by default), the response path may break if Cloudflare doesn't recognise the proxied domain. Check your Cloudflare tunnel's ingress rules and ensure they match on a path or wildcard rather than a specific hostname.

2. Cloudflare blocking the Discord proxy

Cloudflare's bot protection may be challenging or blocking requests from Discord's proxy servers. Check your Cloudflare dashboard under Security > Events for any blocked or challenged requests from Discord's IP ranges during the timeframe of your 504s.

3. Response headers incompatible with Discord's proxy

Discord embedded activities run in iframes. If your response includes X-Frame-Options: DENY or a restrictive Content-Security-Policy header, Discord's proxy may not relay it. Remove or relax these headers for responses going through the Discord proxy path.

To isolate the culprit:

Compare the request headers your server receives from a browser vs from Discord. Log the full headers for both. The difference (likely Host, Origin, or a missing header) will point you to which layer is causing the mismatch. If the headers look identical and your server responds the same way to both, the issue is Cloudflare rejecting or timing out the return path from Discord's proxy.

This is not an AWS-side issue. Your EC2 instance and networking are working correctly.