Question

A healthcare analytics company stores patient records as objects in an Amazon S3 bucket. The data science team must access the full records for model training, while a reporting team must only see records with personally identifiable information (PII) fields removed. The company wants to avoid maintaining two separate copies of the data and wants the redaction to happen automatically when the reporting team retrieves objects. Which approach best meets these requirements?

Accepted Answer

Create an S3 Object Lambda Access Point for the reporting team that invokes a Lambda function to redact PII, while the data science team uses a standard access point to retrieve the original objects.

Answer

Enable S3 Batch Operations to periodically create a redacted copy of every object into a second bucket that the reporting team accesses.

Answer

Apply an S3 bucket policy with a condition that strips PII fields from GetObject responses for the reporting team's IAM role.

Answer

Use Amazon Macie to automatically remove PII from objects before the reporting team downloads them.