AWS Port Forwarding Without Load Balancer – How It Was Done

I've got a real puzzle on my hands.

I've got a single Amazon EC2 instance, that I set up around 6 months ago. It's running an Apache HTTPD on ports 81 (unsecured) and 8000 (secured). It's also running a Tomcat on port 8443. But the outside world sees Tomcat (secured) on 443.

There's no load balancer involved (we have load balanced clusters; I know what that looks like).

The Tomcat and HTTPD servers are running independently of each other.

If I do a netstat on the EC2 instance, it shows that it's listening on 8443, but not 443. The active connector in the Tomcat's server.xml includes a "proxyPort" clause for 443.

If I do a curl from my desktop to the Tomcat server, on 443, I get something back.
If I do a curl from the EC2 instance to localhost, on 443, I get nothing; if I do so on 8443, I get a complaint about the cert being wrong for "localhost," so it's obviously connecting. So apparently, the mapping between 443 and 8443 is external to the instance.

And like a complete idiot, I left myself no notes whatsoever on what I did to make this thing work. Can anybody tell me what I did, and how I did it? Or at least tell me what to look for? I see a security group, but it doesn't say anything about remapping any ports.