A company uses a hybrid cloud environment.

The core requirement is to identify and remove sensitive data from content stored in Amazon S3 with minimal operational overhead. Amazon Macie is purpose-built to automatically discover, classify, and protect sensitive data (such as PII) in Amazon S3 using machine learning. Macie continuously scans S3 objects and produces findings that identify sensitive data types and locations without requiring custom ML pipelines or infrastructure.

Once Macie identifies sensitive data, AWS Lambda can be used to automate remediation—such as redacting, masking, or deleting sensitive fields—based on Macie findings. This event-driven approach is serverless, scales automatically, and minimizes operations.

Option A increases overhead by moving the model and building custom detection logic. Option B introduces unnecessary compute orchestration (ECS/Fargate and Batch). Option D uses Amazon Comprehend for entity detection, which is not optimized for broad S3 data discovery and requires EC2 management.

Therefore, using Amazon Macie for detection and Lambda for remediation is the most efficient and AWS-recommended solution.