A financial company must retain original customer records (which include PII) in Amazon S3 for 10 years. Only certain internal users may access PII; third parties must receive records with PII removed. A Lambda function named removePii can strip PII. How can the developer ensure a single stored object is returned either intact or with PII removed depending on the requester?

The correct answer is to create an Amazon S3 Object Lambda access point. S3 Object Lambda allows you to process data retrieved from S3 using an AWS Lambda function before returning it to an application. By attaching the removePii function to an S3 Object Lambda access point, requests made through this specific access point will automatically trigger the Lambda function to remove PII, returning the transformed object. Original objects remain untouched and can be accessed directly via the standard S3 endpoint. Incorrect options: S3 event notifications for GET requests do not modify the object returned by the GET request itself; they are asynchronous and trigger after the GET. S3 event notifications for PUT requests are for when an object is uploaded or modified, not for retrieving it. GetObjectLegalHold is used for managing legal holds on objects, not for transforming object content with a Lambda function.