Getting "Elasticsearch responded with an error: Forbidden" when connecting to ElasticSearch/OpenSearch datasource from Appsync

Question

I am implementing GraphQL endpoint in AWS AppSync to search data within ElasticSearch/OpenSearch.

I've implemented this using the Serverless Framework.

serverless.yml

service: SearchAPI

frameworkVersion: "2"
useDotenv: true
custom:
  stage: ${opt:stage, self:provider.stage}
  accountId: "#{AWS::AccountId}"
  appSync:
    name: "searchapi-${self:provider.stage}"
    authenticationType: API_KEY
    mappingTemplates:
      - dataSource: SearchDataSource
        type: Query
        field: searchTitles
    serviceRole: "AppSyncServiceRole"
    dataSources:
      - type: AMAZON_ELASTICSEARCH
        name: SearchDataSource
        description: "AWS OpenSearch Data Source"
        config:
          endpoint: "${env:OPEN_SEARCH_END_POINT}"
          serviceRoleArn: { Fn::GetAtt: [AppSyncESServiceRole, Arn] }
          awsRegion: "us-east-1"

provider:
  name: aws
  runtime: nodejs12.x
  lambdaHashingVersion: 20201221
  stage: dev
  region: us-east-1
resources:
  Resources:
    AppSyncESServiceRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: "appsync-es-role-${self:provider.stage}"
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "appsync.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        Policies:
          - PolicyName: "appsync-es-role-${self:provider.stage}-Policy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - es:*
                  Resource:
                    - ${env:OPEN_SEARCH_ARN}/*

plugins:
  - serverless-bundle
  - serverless-appsync-plugin

I followed exact steps in this example github url

When trying to get data form graphql endpoint, i am getting this error in Cloudwatch logs...

Did anyone face this issue? Would be great if someone can help figuring this out.