Answer – A, B and C
The AWS Config service is specifically used for this purpose. Any resource changes can trigger a lambda function and notifications via the SNS service. The AWS Documentation mentions the following on the AWS config service.
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
Option D is invalid because CloudFormation is already used as a service in the question.
Option E is invalid because this is used for creating stacks of resources like CloudFormation.
Option F is invalid because this will not give a trail of what resources got created.
For more information on the AWS Config service, please refer to the below URL
https://aws.amazon.com/config/