A company stores customer data in an Amazon S3 bucket. Multiple teams in the company want to use the customer data for downstream analysis. The company needs to ensure that the teams do not have…

Amazon Macie is a data security and privacy service that discovers and reports on sensitive data, but it does not remove or redact PII from data files, thus failing to prevent access to PII for analysis teams.

S3 Object Lambda allows a Lambda function to process data retrieved from S3 on the fly, transforming it (e.g., redacting PII using Amazon Comprehend) before it reaches the requesting application, providing sanitized data without altering the original S3 objects or incurring overhead for pre-processed copies.

Amazon Data Firehose is designed for delivering streaming data to destinations and is not typically used for on-demand processing and redaction of existing data at rest in S3; it would involve re-ingesting data, which adds operational overhead.

Using AWS Glue DataBrew to store PII data in a second S3 bucket implies creating and managing a separate, potentially redacted, copy of the dataset, which increases storage, data duplication, and synchronization overhead compared to dynamic, on-access redaction.