A developer is adding AWS X-Ray to an application that handles personally identifiable information (PII). The app runs on EC2 instances. Trace messages include encrypted PII and are sent to Amazon CloudWatch. The developer must ensure that no PII leaves the EC2 instances. Which solution meets this requirement?

Manually instrumenting the application code with the X-Ray SDK allows the developer to precisely control what data is included in X-Ray traces. They can ensure that PII is filtered or redacted before it leaves the EC2 instances and is sent to X-Ray, thus preventing any PII from being transmitted. Using the X-Ray auto-instrumentation agent or AWS Distro for OpenTelemetry (ADOT) would automatically capture data, which might inadvertently include PII before it can be filtered. Amazon Macie detects PII but doesn't prevent it from being sent to X-Ray; calling the X-Ray API from a Lambda function after Macie detection would be a post-transmission step, meaning PII would have already left the EC2 instance.