An application stores sensitive user data and includes a CloudFront distribution plus multiple Lambda functions that handle requests. Each request contains more than 20 data fields; certain fields must be encrypted and only specific components of the application should be able to decrypt them. Which solution meets these requirements?

CloudFront field-level encryption allows you to encrypt specific data fields at the edge before they are cached or forwarded to your origin. This directly addresses the requirement to encrypt certain fields. Using an asymmetric AWS KMS key for the encryption configuration ensures that only authorized application components with access to the corresponding private key can decrypt the data, meeting the specific decryption access requirement. HTTPS and signed URLs/cookies protect data in transit and control access to files, but don't provide field-level encryption for specific data within a request. Lambda@Edge for asymmetric encryption would be a custom solution, whereas CloudFront field-level encryption is a managed service designed for this purpose. AWS WAF provides protection but not field-level encryption, and self-managed keys increase operational overhead.