One of the main issues i had with it was that getting the IAM policies correct on the cluster was an extremely slow process. Each change requires a rolling cluster update, replacing the underlying EC2 instances with the correct roles.

Secondly access control sucks. You can only whitelist by external IP, and you cant access elasticsearch from your VPCs directly, as they sit outside your VPC.

I abandoned it, wrote some chef and terraform and had a much more stable and flexible setup. However at an increased management overhead. If it works for you thats cool, but there are caveats, so beware.