A healthcare platform logs PHI in CloudWatch Logs and publishes order alerts via SNS where email bodies must hide patient IDs but retain auditability. Which data protection configuration should the engineer implement to mask sensitive data in transit through logs and notifications?

CloudWatch Logs data protection policies use managed data identifiers and custom patterns to detect and mask sensitive fields in log events. A Lambda function using Amazon Bedrock Guardrails can inspect SNS messages before delivery, log detections, and publish a redacted copy to the subscriber topic. This preserves auditability and notification delivery while preventing PHI exposure. This is the recommended pattern now that native SNS message data protection is closed to new customers, effective April 30, 2026. KMS encryption with SSE protects data at rest and in transit from infrastructure access, but does not hide field values from authorized log readers or email recipients, so PHI remains visible. CloudTrail log file validation and S3 Object Lock ensure integrity and immutability, but do not detect or mask sensitive content inside payloads. IAM deny policies for logs:Unmask and sns:Publish control who can unmask or publish, but do not transform payloads; allowed principals can still encounter unmasked data, and notification workflows may be blocked. For the exam, remember that encryption provides confidentiality from outsiders, while data protection policies provide field-level masking or redaction. In practice, verify identifier detection, audit findings, and which roles can unmask data.