A company wants to monitor and analyze API activity within their AWS environment to detect unauthorized access attempts. They also want to ensure compliance with security policies by keeping track of configuration changes to resources over time. The company has enabled AWS CloudTrail to log all API activity. Which additional service should they configure to ensure they are also tracking configuration changes to AWS resources?