A solutions architect is building an Amazon S3 data lake for a company. The company uses Amazon Kinesis Data Firehose to ingest customer personally identifiable information (PII) and transactional data in near real- time to an S3 bucket. The company needs to mask all PII data before storing the data in the data lake. Which solution will meet these requirements?