A company's network engineer builds and tests VPC network designs in a development account. The company must track changes to network resources, enforce strict compliance with network security policies, and retain historical network configurations. Which solution satisfies these requirements?

The correct answer is to use AWS Config. AWS Config continuously monitors and records resource configurations, allowing you to track changes, audit configurations, and assess compliance against desired configurations using configurable rules. This directly addresses the requirements for tracking changes, enforcing security policies, and retaining historical configurations. The other options are less suitable: EventBridge and Lambda can detect changes but require significant custom development to build a comprehensive compliance and historical tracking solution comparable to AWS Config. CloudWatch Logs and custom metrics are primarily for operational monitoring and alerting, not for detailed resource configuration tracking and compliance enforcement. Systems Manager Inventory and State Manager are excellent for managing and enforcing configurations on EC2 instances and on-premises servers, but AWS Config is specifically designed for tracking and evaluating compliance of a broader range of AWS resources, including VPC components.