Security groups attach to network interfaces and provide stateful allow rules. If a permitted connection starts, return traffic is tracked. Network ACLs apply at the subnet boundary, use ordered rules, and are stateless. Their return path must be allowed explicitly, including the relevant ephemeral port traffic.
These controls don't supply a route, start a server, or create a public IP address. Work through the path one layer at a time. For an HTTPS listener, permit the required source and TCP port rather than opening every protocol. A database usually needs access from the application tier, not the entire internet. The difficult case is a connection that passes one direction and fails on return: a permissive security group can't override a subnet ACL deny.