Which AWS service is used to monitor and log API calls and actions across AWS services?

AWS CloudTrail is a governance, compliance, and operational monitoring service that records every API call made in your AWS account. Each event contains the identity of the caller, the action performed, the resources involved, and the time of the call. CloudTrail stores logs in an S3 bucket and can publish events to CloudWatch Logs or EventBridge for real‑time analysis. The service is essential for forensic investigations, security audits, and regulatory compliance because it provides an immutable audit trail of all activity. By enabling CloudTrail in all regions and integrating it with CloudWatch Alarms, you can detect suspicious behavior, such as unauthorized API usage or changes to critical resources. CloudTrail also supports integration with AWS Config for configuration drift detection and with AWS Security Hub for centralized security findings. In short, CloudTrail is the primary tool for logging and monitoring API activity across AWS services. CloudTrail also integrates with AWS Config to provide a comprehensive view of configuration changes.