What service can be used to enforce compliance with data residency requirements?

AWS Config is the correct choice for enforcing compliance with data residency requirements because it is specifically designed to provide an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. With AWS Config, you can assess, audit, and evaluate the configurations of your AWS resources. This service allows you to create rules that check the compliance of your resources against desired configurations, ensuring that data is stored and processed in specific regions that comply with local regulations.

Using AWS Config, you can set up rules that specify where your data must reside and monitor your resources for compliance with these rules. Additionally, it provides a detailed record of how the configurations of your AWS resources have changed over time, which is crucial for meeting regulatory requirements and ensuring ongoing compliance.

In contrast, other services listed do not directly relate to compliance enforcement in terms of data residency. AWS Lambda is a serverless compute service that allows you to run code without provisioning servers, but it does not provide compliance or monitoring of data residency. AWS EC2 is a service that enables virtual server deployment, but it doesn't specifically focus on compliance or data residency. AWS IAM (Identity and Access Management) deals with access control and permissions for AWS resources rather than managing the data's location or compliance requirements. These