A medical company must transform large volumes of clinical trial data from several customers. Data is extracted from a relational database, transformed with complex rules, and then loaded to Amazon S3. All data must be encrypted while it is processed and before it is stored in S3, and each customer's data must be encrypted with a customer-specific key. Which solution meets these requirements with the LEAST operational effort?

The correct solution leverages AWS Glue for its serverless ETL capabilities, minimizing operational overhead compared to managing EMR clusters. Using one Glue job per customer allows for customer-specific processing. Crucially, attaching a security configuration with client-side encryption using AWS KMS managed keys (CSE-KMS) ensures that data is encrypted during processing and before storage in S3, and each customer's data can be encrypted with a unique KMS key. Incorrect options: Using SSE-S3 does not encrypt data during processing, only at rest in S3. EMR clusters require more operational effort to manage than Glue jobs. SSE-KMS encrypts data at rest in S3, but not necessarily during processing with client-side encryption, and EMR adds operational overhead.