Create a “production-elastic-search” security group and add it to all of your ES instances. Add a custom rule to allow traffic between instances in that security group - otherwise, they will not be able to see each other and connect to the cluster.
Custom TCP Rule / Protocol: TCP / Port Range: 9200-9400 / Source: sg-xxxxxx (the same sg-xxxxx as “production-elastic-search"
(You may need to also allow your own IP to access this security group to aid in debugging.)