A company keeps customer data in an Amazon S3 bucket that multiple teams need to analyze, but the teams must not see any personally identifiable information (PII). Which option provides PII detection and redaction with the least operational overhead?

S3 Object Lambda allows you to process data retrieved from S3 buckets as it is being accessed, without modifying the original object. By integrating Amazon Comprehend with S3 Object Lambda, you can detect and redact PII in real-time as teams request the data, providing a dynamic and serverless solution with minimal operational overhead. Using Amazon Macie for detection and removal would require creating copies or modifying the original data, which isn't ideal for real-time access or maintaining original data integrity. Amazon Data Firehose is primarily for streaming data ingestion, not for on-demand PII redaction during data retrieval. AWS Glue DataBrew can transform data, but storing PII separately still requires managing two datasets and doesn't offer the real-time, on-access redaction that S3 Object Lambda provides.