A service that logs every AWS API call made within an account. It provides an activity history for auditing, regulatory compliance, and security incident investigation.
On CLF-C02 and SAA-C03 this is distinguished from CloudWatch: CloudTrail records "who did what and when" (API auditing); CloudWatch monitors performance (metrics). Question: who deleted that S3 bucket? CloudTrail.
AWS CloudTrail is a concept that can show up on the exam. Check the full guide to see it in context.