We used the stock AMI. I would not be surprised if we had a configuration issue, but we spent a lot of time trying to debug it and were never able to find the root cause of the issue.
I'm wondering if Elastic Beanstalk is hiding this from us in some way. Or maybe just has a workaround built in?