What service would you use for automated compliance checks in AWS?

AWS Config is the service used for automated compliance checks in AWS. It enables you to assess, audit, and evaluate the configurations of your AWS resources. With AWS Config, you can define rules that specify the desired configurations, and it continuously monitors your resources to ensure compliance with these rules. If any changes occur that violate the compliance standards, AWS Config can alert you or trigger automated remediation actions.

This service is particularly valuable for organizations that need to maintain compliance with various regulatory standards or internal governance policies. By continuously monitoring resource configurations and changes, AWS Config helps ensure that your environment remains compliant over time.

In contrast, other services listed serve different purposes. AWS CloudTrail provides a log of API calls and user activity for auditing and monitoring; AWS IAM focuses on identity and access management, helping to control user permissions; and AWS GuardDuty is a threat detection service that identifies malicious activities and unauthorized behavior within your AWS environment. Each of these services plays a unique role in the AWS ecosystem, but AWS Config is specifically designed for compliance checks.