Elasticsearch can use IAM roles, which makes the interaction with AWS API much simpler -- no need to store secret credentials anywhere, etc.