The company wants to review user activity by recording and analyzing API calls. Which AWS service provides this capability?

AWS CloudTrail is the correct answer because it records API calls and related events made by users, roles, or AWS services in your AWS account. This allows you to track user activity, audit changes to your AWS resources, and maintain security posture. You can use CloudTrail logs for security analysis, resource change tracking, and compliance auditing. AWS WAF (Web Application Firewall) protects web applications from common web exploits, but it doesn't record API calls for auditing. Amazon Detective helps analyze, investigate, and quickly identify the root cause of security findings or suspicious activities, but it relies on data sources like CloudTrail, not generating the API call logs itself. Amazon CloudWatch monitors resources and applications, collecting metrics and logs, but its primary function is not API call auditing like CloudTrail.