For production: use a current-generation Graviton instance — r7g.large.search (or larger per references/sizing.md) — with 3+ data nodes and 3 dedicated cluster managers (the AWS API still uses “DedicatedMaster” in CLI/SDK; prose: “cluster managers”). r6g is previous-generation and only used with explicit compatibility justification.
WARNING: NEVER use internal users in production. Production deployments MUST use IAM-based authentication (shown above). Internal user database is for local development/testing only.
Development: Public access with IP-based policies + fine-grained access control
Warning: Never use 0.0.0.0/0. Always restrict to specific source CIDR ranges.
AWS WAF for any public domain (defense-in-depth, beyond throwaway dev): associate an AWS WAF web ACL with the domain to block common web exploits, rate-limit by IP, and apply AWS-managed rule groups (AWSManagedRulesCommonRuleSet, AWSManagedRulesKnownBadInputsRuleSet, AWSManagedRulesAmazonIpReputationList). Without WAF, public domains are exposed to the open internet with no L7 protection beyond the IP allowlist.