Funny you should say that, didn't elasticsearch have a default setting last year which caused thousands of servers to be compromised? Amazon even has an articl

Funny you should say that, didn't elasticsearch have a default setting last year which caused thousands of servers to be compromised? Amazon even has an article about securing ES https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/ https://aws.amazon.com/blogs/security/how-to-control-access-... EDIT: https://www.zdnet.com/article/elasticsearch-ransomware-attacks-now-number-in-the-thousands/ https://www.zdnet.com/article/elasticsearch-ransomware-attac... > Elasticsearch was never meant to be wide-open to internet users. Elastic, the company behind Elasticsearch, explained all this in 2013. This post is filled with such red-letter warnings as "Elasticsearch has no concept of a user." Essentially, anyone that can send arbitrary requests to your cluster is a "super user."