I don't agree with the GP about "routers route" (at least in the context of a cloud VPC), but a more serious problem that IS seen all the time in the wild is SS

I don't agree with the GP about "routers route" (at least in the context of a cloud VPC), but a more serious problem that IS seen all the time in the wild is SSRF, and as I understand it elastisearch presents an HTTP REST interface, which makes it a fine target for such attacks (where as, say, Postgres, will not accept HTTP connections). Relying solely on routability for authorization means that you're authorizing everything that can route to it in any context. Maybe that's fine.