A database specialist working with an Amazon RDS database would like to be notified if the master password is changed. What service provides the optimal solution for this requirement?

Answer options:

A.AWS CloudTrail
B.AWS CloudWatch
C.AWS Config
D.Amazon RDS Event Notification

Answer: D
Option A is incorrect because AWS CloudTrail is a log of AWS services API activity and not RDS database logs.
Option B is incorrect because AWS CloudWatch is a service for monitoring and collecting RDS metrics (e.g., CPU, RAM, Network consumption). It is possible to configure RDS to send logs to CloudWatch logs. However, configuring notifications based on those logs would require additional manual configuration steps such as setting up filters, alarms, SNS topics and subscriptions. This is not the optimal solution.
Option C is incorrect because AWS Config is a service for tracking and monitoring configuration changes of AWS resources at the resource/service management plane.
Option D is CORRECT because Amazon RDS Event Notification is a native capability of RDS that can be enabled and provides notifications for various categories of database events. Specifically, a configuration change event with id RDS-EVENT-0016 is created when an RDS instance master password is reset.
Reference:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Events.html