What are the ports to be opened inboud/outbound from Amazon EC2 instances to Splunk cloud.
Generally if you are using a universal forwarder, you need to only open whatever port you have set up for the UF. If you accept the defaults, it's 9997.
See the docs here.