ECE services should require 26 GB; can you explain to me this difference?
Those numbers are very safe/conservative - if you filled up 3x 128GB with lots of small ES clusters and were very aggressive in the load you placed on it, you might get close to needing that much.
(In fact my 15GB/zone is even more aggressive than it sounds because it includes 2 system ES clusters, one for AC searches and one for logging and metrics)
if I want just 1 ES cluster (16 gb) and 3 Kibana (1 gb) spread on 3 zones
We wouldn't normally recommend running 3 zones of Kibanas and 1 zone of ES - if you don't care about the HA-ness of your one cluster, might as well just run ECE as a non-HA 1x64 host (or just run ES directly from the docker images and not worry about the ECE infra at all)
Probably a minimum point where it's worth the overhead of ECE is something like
EC2 #1 48GB: ECE (15GB) + ES data nodes (+ misc other stack services)
EC2 #2 48GB: ECE (15GB) + ES data nodes (+ misc other stack services)
EC2 #3 32GB: ECE (15GB) + ES master eligible nodes (+ misc other stack services)