A company uses Amazon Simple Notification Service (Amazon SNS) topics to publish messages from application components to custom logging services. The company is concerned that sensitive data could be published and then exposed in transaction and debug logs. Which solution protects sensitive data in these SNS messages from accidental exposure?

The correct solution is to configure an inbound message data protection policy for the SNS topics with the De-identify operation. This is a native SNS feature designed specifically to detect and automatically mask or redact sensitive data types (like PII, financial data, etc.) within messages before they are delivered to subscribers. This proactive approach prevents sensitive data from ever reaching the logging services in an unmasked state. Using Amazon Macie to scan messages after they are published and then triggering a Lambda function to mask them is reactive and introduces a delay, meaning the sensitive data could still be exposed in logs before remediation. Enabling server-side encryption with KMS encrypts the message at rest and in transit but does not mask the content of the message itself; subscribers with decryption permissions would still see the sensitive data. Creating a GuardDuty finding and a Security Hub remediation action to block delivery is also reactive and would prevent the message from being delivered entirely, which might not be the desired outcome if the non-sensitive parts of the message are still valuable for logging.