Which AWS service or feature should be used to monitor an EC2 instance for possible spikes in disk write activity?

Amazon CloudWatch is the correct choice because it is a monitoring and observability service that provides data and actionable insights for AWS, hybrid, and on-premises applications and resources. It collects monitoring and operational data in the form of logs, metrics, and events, and can be used to set alarms for specific thresholds, such as spikes in disk write activity on an EC2 instance. AWS CloudTrail records API calls and related events made in your AWS account, primarily for governance, compliance, operational auditing, and risk auditing, not real-time performance monitoring. AWS Health Dashboard provides personalized views of the health of AWS services and alerts you to events that might affect your AWS resources, but it doesn't monitor individual EC2 instance metrics like disk write activity. AWS Trusted Advisor provides recommendations to optimize costs, improve performance, enhance security, and fault tolerance, but it's not a real-time monitoring service for operational metrics.