A healthcare contact center logs caller verification details to CloudWatch Logs and publishes appointment reminders through SNS, but auditors flagged national IDs and phone numbers appearing in plaintext. The team must redact PII automatically using managed detection rather than hand-written parsing code. Which control should the engineer configure to mask sensitive data?

The correct control works because CloudWatch Logs data protection policies use managed data identifiers to detect national IDs, phone numbers and other PII as events are ingested and then mask or audit the findings, while for SNS the native message data protection feature is no longer available to new customers (effective April 30, 2026) and AWS recommends a Lambda function that applies Amazon Bedrock Guardrails sensitive-information filters to redact the reminder before it is published to the destination topic. Both use managed detection rather than hand-built patterns. The KMS encryption approach fails on mechanism because customer managed keys enforce encryption at rest and control decryption permissions, yet authorized log viewers and message subscribers still see plaintext values. The CloudWatch plus Macie approach fails on coverage because it treats SNS only as detective post-delivery analysis of S3 copies, leaving reminders unmasked in transit and replacing automatic enforcement with delayed manual remediation. The subscription-filter approach fails on mechanism because CloudWatch Logs subscription filters only forward copies of events and cannot alter the stored log data, and hand-written pattern replacement adds maintenance and error-handling burden. An exam caveat is to separate masking from encrypting, restricting access, or discovering sensitive data. A practical check is to enable policies in audit mode, ingest synthetic events and publish test reminders containing valid-format IDs and phones, then verify masked output and metrics before enforcing.