A company saves customer data in an S3 bucket encrypted with SSE-KMS. The data includes PII (for example, social security numbers). Any data tagged as PII must be masked before it is used for analytics. A subset of users must have secure access to the raw PII during pre-processing. The company wants a low-maintenance approach to mask and protect PII throughout the engineering pipeline. Which combination of solutions meets these requirements? (Choose two.)

AWS Glue DataBrew is a visual data preparation tool that can be used to clean, normalize, and transform data, including masking PII, before it's used for analytics. This provides a low-maintenance, managed solution for masking. AWS Identity and Access Management (IAM) is crucial for controlling access to the raw PII data for authorized users during pre-processing, ensuring only specific users can access it. Amazon GuardDuty is a threat detection service, not a data masking or access control solution. Amazon Macie is for discovering sensitive data, not for masking it or controlling access. Developing custom masking scripts would require significant development and maintenance effort, which goes against the requirement for a low-maintenance approach.