A compliance officer wants to detect when AWS resources drift from approved settings — for example, when a security group or S3 bucket configuration no longer matches policy. Which service records and evaluates resource configurations for that purpose?
Select an answer to reveal the explanation.
Short Explanation
Config is like a continuous inventory clipboard that also flags when a truck’s safety sticker expires — it remembers how resources are set up and checks them against rules. Shield and Route 53 are about DDoS and DNS health, not configuration compliance. Amplify Hosting is an app hosting path, not a posture recorder.
Full Explanation
AWS Config continuously records AWS resource configurations and can evaluate those configurations against Config rules to detect noncompliance or drift. That purpose matches governance needs such as flagging undesired security group or bucket settings. Shield, Route 53 health checks, and Amplify Hosting address different problems and do not serve as the primary configuration-compliance service.