AWS CloudTrail as the audit log of API activity
'Who, when, which API operation' points to AWS CloudTrail (the audit log of operations). Performance/metrics monitoring is CloudWatch, and tracking resource configuration is Config — keep the roles separate.