Raw data is stored in an S3 bucket. Three different applications must access the raw data, but each application requires different redaction before reading it. What solution meets this requirement so each app gets redacted data independently?

The correct solution uses S3 Object Lambda access points, which allow you to process data retrieved from S3 with a custom Lambda function before it's returned to the requesting application. This enables on-the-fly redaction tailored to each application's specific needs without modifying the original data in the S3 bucket. Each application gets its own S3 Object Lambda access point, ensuring independent redaction. Creating separate S3 buckets with SRR would duplicate data and require managing multiple copies, which is inefficient. Kinesis is for streaming data and doesn't directly address on-demand redaction of existing S3 objects. Using S3 access points with a Lambda triggered on object creation would store multiple redacted copies, increasing storage costs and complexity, rather than performing on-demand redaction.