What people often forget is that cross-AZ traffic is included in those .elasticsearch instance prices. In a 3-AZ deployment and given the frequent rebalancing/replication traffic that is a significant line item if you run it yourself. I'm not arguing it's not expensive, but when you look at the TCO it's less obscene than if you just look at EC2 pricing alone.