I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on
127.0.0.1 only. I was then intending to use a reverse proxy (nginx) to only allow search-type requests, and reject any others (e.g., updates, cluster management/stats, etc).
As I understand it, I could then do all updates locally on the box itself, and the reverse proxy would be enough security to prevent someone stomping all over my data.
So, my question is this: would a simple reverse proxy allowing/denying access based on URI be secure? What problems could I face with regards to malicious editing of data? Are there attack vectors on such a setup that I have not considered?
Note: I intend to tighten the firewall to only allow access to the proxy port, etc. The focus of this question is on the security of the reverse-proxy idea!