Identifying and Removing Sensitive Data in a Hybrid Cloud Model with Amazon Macie and Lambda

Why the Answer Is Correct

The task splits cleanly into two parts: identifying the sensitive data and removing it. Amazon Macie is the managed service built to discover and classify sensitive information in S3 automatically, with no custom code, which is the least operational overhead for the identification half. Because Macie reports what it finds programmatically, a set of Lambda functions can consume those findings and remove or mask the sensitive values, which handles the removal half with no infrastructure to manage. The two services together cover the requirement without moving the model out of the on-premises environment. The vote was unanimous at 100 for C. Saransundar summarized the split concisely as Macie for identifying sensitive data, and Sid4ops noted that Macie automates the process that makes the whole approach low overhead.

Why the Other Options Are Wrong

Deploying the model on Amazon SageMaker and creating Lambda functions to identify and remove the sensitive data (A) misassigns the work, because SageMaker is a managed environment for training, deploying, and hosting models, not a sensitive data discovery service, so nothing in it identifies the sensitive fields. Deploying the model on an ECS cluster using Fargate and creating an AWS Batch job (B) has the same category error compounded by more infrastructure, since a Fargate cluster and a Batch job add container and job management on top of a discovery capability neither provides. Using Amazon Comprehend to identify the sensitive data and launching EC2 instances to remove it (D) fails on both halves: Comprehend is a natural language processing service for entities, sentiment, and key phrases rather than a general sensitive data scanner, and standing up EC2 instances to do the removal is the highest-overhead option in the list.

Community Comment Notes

The community was unanimous at 100 for C, and the comments are brief but all point the same way. Saransundar laid out the two-step split of the answer, identifying sensitive data with Macie. Sid4ops added that Macie automates the process, which is precisely why it carries the least operational overhead. GiorgioGss observed that Comprehend can also handle PII, so option D is not entirely without merit on the identification side, but paired it with the observation that launching EC2 instances for the removal step is the wrong operational choice, which leaves C as the only option whose two halves are both low overhead.