CloudTrail vs CloudWatch vs Config

A bucket policy was removed last Tuesday and the security team asks: which IAM principal made the DeleteBucketPolicy call, from which IP address, and when? Which service answers this directly?