A Kinesis Data Firehose delivery stream receives customer records that include personally identifiable information. The developer must remove customer identifier patterns before saving the data to an S3 bucket. What is the appropriate way to meet this requirement?

The correct option leverages Kinesis Data Firehose's built-in data transformation capability, which allows you to invoke an AWS Lambda function to process records before delivery to the destination. This is an efficient and serverless way to remove PII. The EC2 instance option introduces unnecessary operational overhead and complexity. An EC2 instance would require managing the instance, the application, and its scaling, which is not ideal for a streaming data transformation task that Lambda can handle serverlessly. Using Amazon OpenSearch Service for search-and-replace is not its primary purpose for real-time stream transformation and would be an inefficient and costly approach. OpenSearch is designed for search and analytics, not for inline data modification and re-export to S3 in this manner. While AWS Step Functions can orchestrate complex workflows, configuring it as a direct Kinesis Data Firehose destination is not a standard or efficient pattern for simple data transformation. Firehose's direct Lambda integration is designed precisely for this use case.