aws opensearch/elasticsearch in vpc private subnet times out after cognito redirection

nginx server redirects to cognito and authentication is successful but redirect to the elasticsearch URL times out. Both the EC2 and opensearch are in the same VPC, same security group. Opensearch is in private subnet, nginx EC2 is in public subnet. All other troubleshooting steps in user pool, user identity pool, opensearch cognito config including IAM roles/policies looks right to me. What am I missing? Please let me know for more details. Thanks for your help.