Customer data that includes PII is stored in Amazon Redshift. Different teams require different levels of access: marketing needs obfuscated claim details but full contact info; claims needs customer info for each claim they process; analytics needs only obfuscated PII. Which approach enforces these access rules with the least admin overhead?

The correct approach leverages Amazon Redshift's native data masking capabilities. Creating distinct Redshift database roles for each team allows for granular permission management. Defining masking policies per team ensures that sensitive PII is obfuscated or revealed according to each team's specific requirements. Attaching these policies to the respective roles enforces these rules with minimal administrative overhead, as the masking is applied automatically at the query level. Provisioning separate clusters is inefficient and costly. Creating database views can work but requires maintaining multiple views and doesn't offer the dynamic masking capabilities of policies. Moving data to S3 and using Lake Formation is a valid data lake strategy but introduces additional complexity and overhead for a scenario that Redshift can handle natively and efficiently.