Depends on exactly what youre after. AWS Config acts as an inventory and audit of resources, with some enforcement state features. Eventbridge events are produc

Depends on exactly what youre after. AWS Config acts as an inventory and audit of resources, with some enforcement state features. Eventbridge events are produced on resource state change and CloudTrail on API actions. Those are super easy to wire with “post” hooks using eventbridge rules. Those dont really provide for generic “pre” hooks as they fundamentally represent changes. Getting arbitrary customer logic in to the API call chain has a lot of scary implications for fault isolation, timing, resource use, etc. In my opinion it would also provide very very sharp edges for users to cut themselves on. And, of course, getting consistent behavior and coverage across the ~300 existing AWS services is a pretty big implementation challenge. Disclaimer: Principal at AWS, but no inside knowledge of the Cloudformation changes or mentioned services.