How should a solutions architect track configuration changes and record API call history for AWS-hosted multi-tier applications to meet compliance, governance, auditing, and security requirements?