A security auditor needs to verify that a company's AWS environment is continuously monitored for compliance with security best practices, such as ensuring S3 buckets are not publicly accessible, IAM policies adhere to least privilege, and security groups restrict unnecessary ports. The auditor requires a consolidated view of compliance status across all accounts and regions, with automated checks and remediation capabilities. Which AWS service provides this comprehensive compliance monitoring and reporting?

Why the other options are wrong

• A. AWS Security Hub aggregates security findings from various AWS services (including Config) and partner products, but AWS Config (especially with Conformance Packs) is the underlying service that *performs* the continuous compliance checks against best practices.
• B. Amazon Inspector is a vulnerability management service for EC2 instances and container images, not a comprehensive compliance monitoring service for all AWS resources and configurations.
• C. AWS Trusted Advisor provides best practice recommendations across cost optimization, performance, security, fault tolerance, and service limits, but it's not a continuous, automated compliance engine with reporting and remediation like Config.