I'm using AWS Elasticsearch service to run a publicly available ES domain, which is called by Lambda functions deployed outside of any VPC. I've configured a resource policy attached to the ES domain to restrict access only to an IAM role that my Lambda functions assume. Given the policy and the fact that all requests to my domain need to be signed, is there any additional security benefit of placing the ES domain inside a VPC in my scenario?
I understand that inside a VPC my ES domain will not be even available from the Internet, which from security perspective is a benefit for sure. On the other hand, that will require to put all my Lambda functions inside the same VPC, which poses a lot of configuration and performance challenges that I'd love to avoid.
My understanding is as follows: if we consider DynamoDB, S3, SNS, SQS or other AWS serverless services secure, and they use the same IAM security model, I should also consider my ES configuration safe. Of course you can always misconfigure the domain and make it publicly available for everyone, but the same is true for S3 buckets, and it doesn't prevent people from keeping private files there.
Am I missing something? Do you see any security holes in my thought process which should convince me to put the ES domain inside a VPC despite all the challenges related to Lambda functions configuration?