Which service would you use to monitor AWS account activity?

Monitoring AWS account activity is primarily the function of AWS CloudTrail. This service enables you to log and continuously monitor account activity, capturing details about API calls made on your account, including who made the call, what actions were taken, and from where the calls originated. CloudTrail provides a history of AWS API calls for your account, which is essential for security, compliance, and operational auditing purposes.

When you enable CloudTrail, it automatically tracks every API call made within your AWS environment, allowing you to investigate changes or unusual activity, troubleshoot issues, and comply with regulatory requirements. This capability ensures that you have a clear and detailed view of all interactions with your AWS resources, which is crucial for maintaining the security and integrity of your account.

In contrast, AWS Config focuses on monitoring the configuration of your AWS resources and notifying you of any changes to those configurations. AWS Inspector is used for automated security assessments of applications running on AWS, which does not provide comprehensive account activity monitoring. AWS CloudWatch primarily monitors metrics and logs related to the performance of your AWS resources but does not provide detailed records of API calls made within your account. Therefore, among the services listed, AWS CloudTrail is the most appropriate choice for monitoring AWS account activity.