A security group does not allow traffic. The security groups associated with the instances must allow traffic on the listener port from client IP addresses (if targets are specified by instance ID) or load balancer nodes (if targets are specified by IP address).
https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-troubleshooting.html

