I actually spent the last 2 days working on this and I got it to work.
You could open AWS ES to the world and call it a day, but of course that's not safe at all.
What I have done is create a new ES domain with VPC access, no fine–grained access control and allow open access to access policy. Now you want only the servers to have access to the ES domain. Create a new Security Group giving 443 access to the Security Group that the servers are part of. By doing this you limit the access to the WEB servers and you don't need an username and password to connect.
To connect to AWS ES with username/password you need to send some headers and I am afraid Magento doesn't have this configured out of the box.
But if you decide to go with the steps above, you just need to add this to the Magento installation:
I am using port 443 because I enable to only accept HTTPS connections.
Just keep in mind that by doing this you won't have access to Kibana using public internet, as being on the VPC means it's on private network. You could create a VPN gateway and connect to it if you really want Kibana access.
Another option is to create a master user in the fine–grained access control option and use the following on the installation:
--elasticsearch-username magento \
As you can see I added single quotes to the password, because AWS ES needs special characters. With this setup you will be able to access Kibana.
I personally want minimum access from the world and don't care to access Kibana for the indexes. I have used Kibana/ES for Magento logs before, but I have found it to be problematic, so I just used EFS for the log folders and called it a day.
Let me know if this works out.