A company stores customer records in S3 and needs every GET request made by a specific reporting application to receive the records with certain sensitive fields automatically redacted, without maintaining a second, separately stored redacted copy of every object. Which S3 feature is designed for this on-the-fly transformation of GetObject responses?
- S3 Select, which permanently rewrites the stored object with sensitive fields removed
- S3 Lifecycle rules, configured to delete sensitive fields after a retention period
- S3 Same-Region Replication, replicating a redacted copy to a second bucket
- S3 Object Lambda, which invokes a Lambda function to process and transform the data returned by a GetObject request in real time
Why D? And why not the others?
Correct answer: D. S3 Object Lambda, which invokes a Lambda function to process and transform the data returned by a GetObject request in real time
S3 Object Lambda lets you add your own code, packaged as an AWS Lambda function, that runs automatically as data is returned to an application through a standard GetObject request, transparently transforming or filtering that data, such as redacting sensitive fields, before the application receives it, all without creating, storing, or maintaining any additional copy of the underlying data. This is exactly the reporting-application requirement described: only that access path sees the transformed response, while the original object in the bucket stays untouched. Lifecycle rules only expire, transition, or delete whole objects (or parts) based on age; they have no ability to selectively strip individual fields from an object's content on a per-request basis, and deleting fields permanently would destroy the original data for every consumer, not just the reporting application. Same-Region Replication would require creating, storing, and continuously maintaining a second physical copy of every object, exactly the overhead and duplication the requirement explicitly rules out, and replication has no field-level redaction capability of its own regardless. S3 Select can extract a subset of an object's data using a SQL-like query, but it does not transform or rewrite the object it reads, and it certainly does not permanently modify the stored object; describing it as rewriting the stored object misstates how S3 Select works entirely.
Source: AWS S3 documentation: What is S3 Object Lambda? — using a Lambda function to add custom transformation code to standard GetObject requests without duplicating data