New environments are given a new, uniquely named security group (SG) by the service. Additional SGs can be supplied to allow access to the environment. There is a situation you can get into if you supply an SG auto-created by another environment which might be what is happening here? The documentation has a note that calls out how to avoid this dependency issue [1]. If that is not what is happening here, I am happy to help but might need more information about your environments.

[1] - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using...

My understanding is that EB is a packaging together of lower-level AWS components (like auto-scaling groups) that you can use individually and patch together yourself if you wish. Maybe that could be a route to look into?

It is, I've gone through before and done that, took me a couple hours. But either way, this seems like it should be obvious to the AWS maintainers and should be fixed.

I would recommend separation of those applications into respective sub-accounts. The hierarchy can be defined in AWS Organizations and you avoid resource overlapping of any kind.

All these applications use the same backend and what not. This makes it easier to share access / permissions vis security groups and IAM role. Its actually separated quite well, just rediculous that if I try to destroy an environment I can't.

Oh, makes sense then.