An on-premises web app with a PostgreSQL database must upload non-sensitive daily data to Amazon S3 for model retraining. Sensitive data must never leave the data center and all cloud-bound traffic must use IPsec. How should you securely transfer only non-sensitive data to S3 each day?

The correct option leverages AWS Glue, a serverless ETL service, to connect directly to the on-premises PostgreSQL database. By specifying only the non-sensitive tables, Glue ensures that no sensitive data leaves the data center. The AWS Site-to-Site VPN connection provides the required IPsec-encrypted tunnel for all cloud-bound traffic, fulfilling the security requirement. The second option is incorrect because it transfers all tables, including sensitive data, to S3 before masking, violating the requirement that sensitive data never leaves the data center. The third option, AWS DMS, is primarily for database migration and replication, not for selective daily ingestion of non-sensitive data from an on-premises database to S3 while adhering to IPsec for all cloud-bound traffic. While DMS can use SSL, the question specifically requires IPsec for all cloud-bound traffic. The fourth option is overly complex and introduces unnecessary intermediate steps and infrastructure (EC2-hosted PostgreSQL), which is inefficient and not the most direct solution for the stated problem.