How do you continuously monitor an AWS account for security and compliance drift, instead of only finding out during an annual audit?

Core Summary

Point-in-time audits catch a configuration that was wrong when someone happened to look. AWS Config evaluates resources continuously against rules and records every configuration change, CloudTrail records who made it, and Security Hub aggregates both into one place with a severity score so drift gets flagged the hour it happens, not the quarter someone checks.