Site-to-site VPN to AWS is up with BGP, but no traffic passes

A new AWS site-to-site VPN connects the head office router R1 (IOS-XE, public IP 198.51.100.10, AS 65010, LAN summary 192.168.0.0/16) to a virtual private gateway on VPC 10.30.0.0/16 (Amazon side AS 64512). Both tunnels show UP in the console and BGP is established. From PC1 (192.168.0.50), pings and SSH to APP1 (10.30.10.20) time out. The app team says "the VPN is broken".