I would like to know how to access an AWS ES instance created in a VPC and secured with IAM policies from an AWS API Gateway setup as a HTTP Proxy.

I am able to access a public AWS ES instance via the API Gateway. I tried the following first to test using signed (v4 Signing) of the API requests to the ES instance

1. I created an AWS ElasticSearch public instance (https://search-*******-******.us-west-2.es.amazonaws.com)
2. Setup IAM policies on ES to restrict access only to a particular user
3. Created an AWS API Gateway HTTP Proxy ({proxy+}) to forward all requests to the ES instance.
   • Used the public url of the ES instance from step 1 as the EndPoint URL for the API Gateway
   • (had to play around with headers to get the Authorization to be passed through to ElasticSearch successfully)
4. Created Signed HTTP requests (tested via javascript), sent to the public API Gateway and was able to successfully read data from ES

Now I would like to put the ES instance in a VPC so that it is accessible only via the API Gateway HTTP proxy. Is this possible? I am able to access the private vpc url of the ES instance from another EC2 machine in the same subnet but how do we do this for an API Gateway? I am new to AWS. I have been trying to look at documentation and I seem to be going around in circles, maybe there is something simple that I am missing. Any help is greatly appreciated.