Yes, this is possible now for HTTPS endpoints (launched at re:Invent): https://aws.amazon.com/about-aws/whats-new/2024/12/amazon-eventbridge-step-functions-integration-private-apis/