AWS Config and AWS CloudTrail are two services that can help you watch your AWS resources. AWS Config records point-in-time configuration details for your AWS resources as Configuration Items (CIs). Using CloudTrail, you can get full details about API actions such as the identity of the caller, time of the call, request parameters, and response elements. AWS CloudTrail can tell you who changed the status of your resources, while AWS Config can tell you if the changes are compliant with your policies.