I setup an unlicensed (BYOD) CSR1000v on AWS per the steps I outlined on Deploying Cisco CSR1000v on an AWS EC2 Instance. I configured the REST api per Cisco CSR 1000v Series Cloud Services Router Software Configuration Guide's Configuring Support for Management Using the REST API chapter. The REST api is up/up per the show command. user cisco password cisco priv level 15 is also configured. Lastly, I opened the AWS firewall up to allow everything and can both ping my CSR1000v and can view it via my Web browser.
My issue is that I cannot get the REST api connection started. It just times out. Debug shows nothing. Using CURL, and pasting in the example directly from Cisco IOS XE REST API Management Reference Guide's Introducing the IOS XE REST API chapter:
curl -v -X POST https://<my address>/api/v1/auth/token-services -H "Accept:application/json" -u "cisco:cisco" -d "" --insecure -3