Funny you should say that, didn't elasticsearch have a default setting last year which caused thousands of servers to be compromised?

Amazon even has an article about securing ES

https://aws.amazon.com/blogs/security/how-to-control-access-...

EDIT: https://www.zdnet.com/article/elasticsearch-ransomware-attac...

> Elasticsearch was never meant to be wide-open to internet users. Elastic, the company behind Elasticsearch, explained all this in 2013. This post is filled with such red-letter warnings as "Elasticsearch has no concept of a user." Essentially, anyone that can send arbitrary requests to your cluster is a "super user."