An online survey application runs as microservices in an auto-scaling Amazon ECS cluster behind an Application Load Balancer (ALB). The ALB is a custom origin for an Amazon CloudFront distribution. One survey collects sensitive data that must be encrypted while it moves through the application. Only the data-handling microservice should be able to decrypt that data. Which solution satisfies these requirements?

The correct solution uses CloudFront field-level encryption, which is designed for this exact scenario. You generate an RSA key pair, upload the public key to CloudFront, and CloudFront encrypts the specified fields using this public key. Only the data-handling microservice, which holds the private key, can decrypt the data. The first incorrect option is wrong because CloudFront field-level encryption uses asymmetric (RSA) keys, not symmetric KMS keys. The third and fourth options are incorrect because using Lambda@Edge for encryption adds unnecessary complexity and latency. CloudFront field-level encryption is a native, optimized service for this purpose. Additionally, the fourth option incorrectly suggests using the RSA private key for encryption; public keys are used for encryption, and private keys for decryption.