An application stores PII in an S3 bucket encrypted with customer-managed KMS keys. All resources are deployed via CloudFormation. A dev environment in a different AWS account must be created from the template, and production S3 data must be copied weekly to the dev S3 bucket, but PII must be anonymized before leaving production. Each environment must use distinct KMS keys. Which combination of steps should the engineer take? (Choose two.)

The first correct option leverages Amazon Macie for PII discovery and a Step Functions state machine for redaction and cross-account copying. Macie effectively identifies PII, and the state machine orchestrates the redaction process before data leaves the production environment, ensuring compliance. Granting appropriate KMS permissions allows the state machine to decrypt production data and encrypt it with the development key. The second correct option addresses the environment creation and scheduling. Using the existing CloudFormation template ensures consistency between environments. An EventBridge rule provides a reliable, serverless way to trigger the Step Functions state machine weekly for the data transfer. Incorrect options: Configuring S3 replication with Macie on the development bucket would transfer PII before redaction, violating the requirement to anonymize before leaving production. Using S3 Batch Operations with a Lambda in the development account to redact PII after transfer also violates the requirement to anonymize before leaving production. S3 Object Lambda is for GET requests, not for modifying objects during a copy operation. Running a weekly cron on an EC2 instance to start an S3 Batch Operations job is less serverless and scalable than EventBridge and Step Functions for this type of orchestration.