An application accepts customer data via an API Gateway API that calls Lambda functions. The Lambdas store data in an Amazon Aurora MySQL cluster. After adding a CloudFront distribution with field-level encryption that uses an AWS KMS key, all data in the database changed from plaintext to ciphertext. You must ensure data is stored in the database as plaintext rather than as the ciphertext produced by CloudFront field-level encryption. What should you do?

The correct solution is to add a Lambda function to decrypt the data. CloudFront field-level encryption encrypts data at the edge before it reaches your origin. If you want to store this data in plaintext in your Aurora database, you must decrypt it after CloudFront but before it's persisted. A Lambda function, invoked by API Gateway, can use the same KMS key CloudFront used to decrypt the specific fields. Changing the viewer protocol policy to HTTPS only (Option A) is a security best practice but doesn't address the decryption requirement. Enabling encryption on the DB cluster (Option C) encrypts the entire database at rest, which is different from decrypting specific fields that were encrypted by CloudFront. Requesting a new SSL/TLS certificate (Option D) is for securing communication, not for decrypting field-level encrypted data.