Which AWS service records API activity and user actions in your AWS account so you can see when API calls are made against your resources?

AWS CloudTrail is the correct answer because it provides a record of actions taken by a user, role, or an AWS service in AWS. It logs API calls made against your resources, including who made the call, when it was made, from which IP address, and what resources were affected. This makes it invaluable for security analysis, resource change tracking, and compliance auditing. Amazon CloudWatch is incorrect because it primarily monitors resources and applications, collecting and tracking metrics, and setting alarms, but it doesn't log API calls. Amazon Inspector is incorrect because it is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS, not an API activity logger. AWS IAM (Identity and Access Management) is incorrect because it manages access to AWS services and resources, defining who can do what, but it does not record API activity.