Correct answer - "CloudTrail": CloudTrail records API calls made and will list details such as
who did it and when call was made. This is a great way to start investigating.
Incorrect:
"EC2 Logs" - These logs only pertain to the system within and not help to determine who deleted
an instance
"CloudWatch" - Will help you monitor but not determine who deleted an instance
"Config" - Helps determine what change but not who changed it