In one sentence
CloudWatch monitors operations, CloudTrail records API activity, and AWS Config tracks resource configuration and compliance.
Key points
- CloudWatch uses metrics, logs, alarms, and dashboards to answer how systems are behaving.
- CloudTrail answers who called which AWS API, when, from where, and with what result.
- AWS Config records configuration changes and evaluates resources against rules.
Exam takeaway
For object-level S3 access auditing, enable relevant CloudTrail data events rather than relying on metrics alone.