A company uses AWS across multiple Regions. A security audit highlighted some issues that must be addressed. The company must track all configuration changes affecting AWS resources and have detailed records of who has accessed the AWS environment. The data should include information such as which user has logged in and which API calls they made What actions should be taken to meet these requirements?