Yes, the AWS security groups allow TCP traffic on 7474, and 7687, for both IP4 and IP6, and pktstat shows that the requests to 7474 are making it to the neo4j machine.
Thanks! Inspired by your response, I had a closer look at the config file (network section) and found the following three lines:
# With default configuration Neo4j only accepts local connections.
# To accept non-local connections, uncomment this line:
# dbms.default_listen_address=0.0.0.0
I un-commented the third line and it now works fine.