The verified answer is A. Configure Amazon Macie to detect sensitive information in the documents that are uploaded to Amazon S3. The data is stored in Amazon S3, and the company wants automated sensitive information detection with the least development effort. AWS documentation states that Amazon Macie can automate discovery, logging, and reporting of sensitive data in an Amazon S3 data estate. Macie can use automated sensitive data discovery or sensitive data discovery jobs, and it can analyze S3 objects using AWS-managed data identifiers, custom data identifiers, or both.
This fits the requirement better than a custom ML or regex-based approach because Macie is purpose-built for discovering sensitive data in S3. AWS states that managed data identifiers can detect many types of sensitive data, including personally identifiable information, financial information, and credentials. Macie also produces sensitive data findings and discovery results, which can be monitored and processed by other AWS services.
Option B is incorrect because deploying an LLM on SageMaker would require model selection, deployment, prompt design, testing, security controls, and possibly custom redaction logic. That is not the least development effort.
Option C is incorrect because manually developing regex patterns is brittle and maintenance-heavy. It also requires custom development and does not fully automate sensitive information detection across many data types.
Option D is incorrect because asking customers not to share sensitive data is not a technical control and cannot guarantee detection or alerting.
Because the documents are in Amazon S3 and sensitive data detection must be automated, Amazon Macie is the correct solution.
