There are multiple AWS services that can help with this, and it depends really on your exact needs as to which would suit you best. Different features (and costs) apply to each.
CloudTrail has been mentioned, but the the first option that comes to mind for me given your question (and it's mentioned in a comment on @Evgeny's answer) is the AWS Config Service. It stores 'snapshots' of your AWS configuration at points in time (in an S3 bucket), but helpfully also sends any changes to an SNS topic. You can then deal with these however you like. For example, on a low traffic account I have these going straight into Slack; on a high traffic account I am tracking the
NumberOfMessagesPublished metric on that SNS topic to notice if a larger number of changes are made than usual.
AWS Config also offers a 'rules' service; these are a bit more pricey than I would expect them to be but depending on your needs they could be useful. Just don't activate them all at once like I did when I was playing around... the month's charge for each rule applies right away. ;) (But you can use Config without using the rules - that is what I am doing at the moment).
There's also Trusted Advisor, which doesn't do what you asked for exactly but might be handy to perform certain checks against how engineers configure your infrastructure, such as whether anyone's left S3 buckets open. It's most useful with a Business level Support plan or above, as many of its checks are blocked otherwise.
Then there's third party tools like CloudCheckr, which combine aspects of AWS Cost Explorer, Trusted Advisor, Config, CloudTrail, CloudWatch, Inspector and GuardDuty. Useful if you want to get in really deep but save time configuring everything yourself.
Alternatively, you could manage your infrastructure using a tool such as Terraform or CloudFormation, and mandate that all changes must be made through those. You can then commit your config files/templates to source control, and even test them against the live infrastructure in CI and fail the build if someone's made non-tracked changes. That way, your commit history becomes your audit log - but it does require your engineers to be disciplined!