AWS is a fairly complex enterprise platform. You really need to learn the platform in order to use it to ensure you're doing things properly, securely. Training helps a lot.
Your question is slightly difficult to answer as you're not using standard AWS terminology. But the short answer is the security group that is associated with your IIS server needs to have inbound ports 80 and 443 open. You don't need an ELB if you only have one EC2 server, but ELBs provide some additional protection against some forms of DDOS attacks. You do need an internet gateway in your VPC, routed to your public subnet, but the route table for your private subnet should not route to the internet gateway. The private subnet should not allocate public IPs either.
Update - if you want to run multiple web servers then use an application load balancer in one security group with 443 / 80 open to the world, then another security group for your EC2 instances open only to the ALB. EC2 instances best in a private subnet, no route to / from the internet and no public IP.
If that makes no sense I suggest either getting some training or hiring someone to help :)
Update re SSL
I wouldn't do TLS offload at CloudFlare, that would leave your traffic unencrypted across the internet and wouldn't be compliant with anything. You can terminate TLS at an ALB and use http to your EC2 instances fairly safely as the traffic within AWS is generally considered safe, it's isolated by the AWS Hyperplane. The ALB can receive traffic on port 443, decrypt, then pass on to EC2 on port 80. I haven't done it myself but I think you just set up your target group listening to port 80 rather than 443. Create a TLS certificate using AWS certificate manager.
Personally I would do the TLS on the EC2 instances unless I had a good reason or the workload wasn't sensitive. It's easier to use an ALB certificate than install certificates on each EC2 instance though.
