S3 Object Lambda for Redacting PII with Least Overhead

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

A Use an S3 Object Lambda Access Point with a Lambda function to dynamically redact PII from text files upon retrieval by the external service provider.

Question

A company stores text files in Amazon S3. The text files include customer chat messages, date and time information, and customer personally identifiable information (PII). The company needs a solution to provide samples of the conversations to an external service provider for quality control. The external service provider needs to randomly pick sample conversations up to the most recent conversation. The company must not share the customer PII with the external service provider. The solution must scale when the number of customer conversations increases. Which solution will meet these requirements with the LEAST operational overhead?
  1. Create an Object Lambda Access Point. Create an AWS Lambda function that redacts the PII when the function reads the file. Instruct the external service provider to access the Object Lambda Access Point. Correct Answer
  2. Create a batch process on an Amazon EC2 instance that regularly reads all new files, redacts the PII from the files, and writes the redacted files to a different S3 bucket. Instruct the external service provider to access the bucket that does not contain the PII.
  3. Create an Amazon DynamoDB table. Create an AWS Lambda function that reads only the data in the files that does not contain PII. Configure the Lambda function to store the non-PII data in the DynamoDB table when a new file is written to Amazon S3. Grant the external service provider access to the DynamoDB table.

Key Takeaways

The core concept is dynamic data transformation via S3 Object Lambda; the common trap is choosing batch processing or secondary storage (EC2/DynamoDB) which increases complexity and cost.

This question tests the use of S3 Object Lambda to dynamically redact sensitive data like PII from text files without storing separate copies. The correct solution leverages a Lambda function attached to an Object Lambda Access Point to handle redaction on retrieval, ensuring minimal operational overhead.

Common mistake: Learners often choose Option B (EC2 batch process) because it feels familiar, but it fails the 'least operational overhead' requirement by requiring instance management and scheduled jobs.

Expert Analysis

Why the Answer Is Correct

Option A is the correct choice because S3 Object Lambda allows you to add your own code to Amazon S3 GET requests that modifies the object returned to the caller. By creating an Object Lambda Access Point and attaching a Lambda function, the system automatically redacts PII every time the external provider reads a file. This approach requires no additional infrastructure like EC2 instances or DynamoDB tables, satisfying the 'least operational overhead' constraint while naturally scaling with S3.

Why the Other Options Are Wrong

Option B involves managing an EC2 instance for a batch process, which introduces significant operational overhead (patching, scaling, monitoring) and latency, violating the efficiency requirement. Option C requires maintaining a DynamoDB table and a complex trigger architecture to sync non-PII data, which is over-engineered for simple file access and adds unnecessary database management costs. Note: One comment incorrectly references RAID 0 (Option D in a different context), which is irrelevant here as there is no fourth option provided in this specific question text.

Community Comment Notes

The community overwhelmingly supports Option A, citing its simplicity and alignment with AWS best practices for dynamic data masking. As user osmk noted, official documentation confirms this pattern for redacting PII. Users like trinh_le emphasize that Object Lambda handles transformations 'on the fly' without needing extra buckets or instances, minimizing operational burden. Multiple users confirmed that while other methods might work technically, they fail the specific constraint of 'least operational overhead'.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least operational overhead' in AWS solutions, always look for managed services that eliminate infrastructure management (like EC2 or self-managed databases). If the requirement involves transforming data on access rather than storing it differently, S3 Object Lambda is likely the intended answer.

Frequently Asked Questions

Why is S3 Object Lambda better than batch processing?

Object Lambda processes data on-demand during retrieval, eliminating the need for scheduled jobs, EC2 instance management, and storage of duplicate redacted files, thus reducing operational overhead.

Does S3 Object Lambda support random sample access?

Yes, the external provider can request specific objects or ranges from the Object Lambda Access Point just like a standard S3 bucket, allowing them to pick samples as needed while receiving redacted content.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. osmk 👍 13 Answered A
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/tutorial-s3-object-lambda-redact-pii.html
  2. trinh_le 👍 3 Answered A
    Use AWS Lambda functions to change the Object before it is retrieved by the caller application. Only one S3 bucket is needed, on top of which we create S3 Access Point And S3 Object Lambda Access Points Use case: 1. Redact PII for analytics or non-production environment 2. Convert across data formats ex: XML to Json 3. Resizing and watermaking images on fly using caller-specific details ex: user who requested the object
  3. zinabu 👍 1 Answered D
    Creating a RAID 0 array allows you to achieve a higher level of performance for a file system than you can provision on a single Amazon EBS volume. Use RAID 0 when I/O performance is of the utmost importance. With RAID 0, I/O is distributed across the volumes in a stripe. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.html
  4. LeonSauveterre 👍 1 Answered A
    If you want to achieve the goal stipulated in the question, all 4 options work, but only option A minimizes operational overhead and ensures scalability while redacting PII dynamically.
  5. Andy_09 👍 5
    Option A
Show 2 more comments
  1. VIad 👍 3
    A is the correct choice.
  2. Umuntu 👍 3
    A is the best choice

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide