Correct answers - "Look in CloudTrail for a 'delete' event in Elastic Beanstalk & Look in IAM
for Policy changes & Look in CloudFormation for deletions" : CloudTrail provides event
history of your AWS account activity, including actions taken through the AWS Management
Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies
security analysis, resource change tracking, and troubleshooting. Filtering the CloudTrail data
for delete events should help you in debugging the situation. Verify that appropriate policies
have been attached to AWS Identity and Access Management (IAM) users or groups for accessing the
target Elastic Beanstalk environments.
As Beanstalk is backed by CloudFormation, if you can't see the backing stack in CloudFormation,
that means it is the reason why the Beanstalk environment has been deleted.
Incorrect:
"Look in CodePipeline for changes" - CodePipeline has not been modified.
"Look in S3 for access logs" - Access logs in S3 pertain to requests occurring in an S3 bucket