Whitelist both IPv4 and IPv6 in AWS Security Group
Both address families require a rule for each. Note the restriction on source that you can provide one of a IPv4 prefix, or an IPv6 prefix, or some other syntaxes that are also only single single address family.
Some networks can get by as IPv6 only, disable v4 and use transition mechanisms. But most public access services available to anyone on the internet need to be dual stack.
Not as far as I know, IPv4 and IPv6 are separate. Why do you think it matters? I've had security groups with dozens of rules.