Which service only monitors and records AWS resource configurations and allows for automation of evaluations against desired configurations?

The correct answer is AWS Config because it is specifically designed to monitor and record the configurations of AWS resources. AWS Config continuously evaluates the state of your resources against the desired configurations that you define. This service allows for automation by automatically assessing, auditing, and evaluating the configurations of your AWS resources and identifying changes over time.

AWS Config provides a detailed view of the configuration history of your resources, helping you maintain compliance and operational governance. It can also trigger automated responses or notifications if resources deviate from your established configurations, enhancing your ability to manage and remediate issues effectively.

The other services mentioned, while they serve important roles within AWS, do not focus exclusively on monitoring and recording resource configurations. For instance, AWS CloudTrail is primarily focused on logging and monitoring API calls made in your AWS account, which is more about auditing actions rather than configurations. Amazon CloudWatch provides monitoring and observability of AWS resources and applications, mainly focusing on performance metrics and operational health rather than configuration. Amazon Inspector is a security assessment service that helps improve the security and compliance of applications deployed on AWS, but it does not track resource configurations directly.