ran into an exactly the same problem. this thread helped me get through. if your health check does not work when you update your security group to allow only cloudflare IPs, check your port configuration - your server might be running on port 8000 but health check in the target group may be doing it on port 80. Stupid oversight, but a critical one nonetheless.