While making changes to AWS resources e.g. adding a new Security Group Ingress rule, I need to capture & record all these changes that will be helpful during an audit. Which of the following AWS service helps me do that?

Answer options:

A.AWS Trusted Advisor
B.AWS CloudWatch
C.AWS Config
D.AWS CloudFormation

Answer: C
Option A is incorrect because AWS Trusted Advisor cannot record the details of configuration changes in the AWS account.
Option B is incorrect because CloudWatch is a monitoring tool that captures different metrics like CPU utilization, Memory Utilization etc. Once the data is captured, they can then be used for creating dashboards for displaying usage patterns, creating alarms for automating resource creation, e.g. creating a new EC2 instance due to average CPU utilization of an Auto Scaling group going above 70%
Option C is CORRECT. AWS Config records & captures all configuration changes done to AWS resources using the Configuration Recorder. Configuration Items crated by AWS Config can be sent to S3 to be stored as log files. These log files can be retained depending on the S3 lifecycle policies defined & can be referred to during any audit. Using an automated configuration management tool helps an Organization to track compliance of its resources elegantly.
Option D is incorrect because AWS CloudFormation is used for automating the creation of AWS resources in Organizations that are huge and use a complex infrastructure that may be difficult to create manually.
References:
https://aws.amazon.com/config/
https://youtu.be/kcwy_DWU8ao