X-Pack alternative

The most common approach is to introduce a Proxy EC2 instance in front of Amazon ES and Kibana as described in the 2nd part of the following blog post: https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/

You can then implement whatever form of authentication/authorization you want on e.g. NGINX. An alternative would be to use API Gateway and AWS Lambda for a server-less approach.