A team has set up a Cloudfront distribution with a web application hosted on an EC2 Instance as the Origin point. A security requirement mandates that all configuration changes to the Cloudfront distribution need to be recorded. Which of the following options is the most straightforward?

Answer options:

A.AWS Config resources.
B.AWS Config rule.
C.AWS CloudTrail that records all configuration changes.
D.AWS CloudWatch Event rule with a Lambda function as its target.

Answer – A
This is mentioned in the AWS Documentation.
You can use AWS Config to record configuration changes for CloudFront distribution settings changes. For example, you can capture changes to distribution states, price classes, origins, geo-restriction settings, and Lambda@Edge configurations.
Option B is incorrect since you have to configure a custom AWS Config rule and a Lambda function is required to provide the logic when the rule is evaluated. It is not the most straightforward method.
Option C is incorrect because, unlike AWS Config, CloudTrail does not show the detailed configuration changes for an AWS resource.
Option D is incorrect because you have to maintain the CloudWatch Event rule and the Lambda function. It is not the easiest approach.
For more information on tracking changes in AWS Config, please visit the below URL
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/TrackingChanges.html