Which combination of actions should the developer take to log the LARGEST amount of AWS API operational information without exposing the PII?

Explanations:

Configuring the DynamoDB stream to record KEYS_ONLY events ensures that only the primary keys of the items that changed are captured in the stream. This approach does not expose PII, as it excludes sensitive data from being logged.

Configuring the DynamoDB stream to record NEW_IMAGE events captures the entire item after the change, including any PII. This would expose sensitive information, which is not compliant with the requirement to avoid exposing PII.

Logging the received event and fetching items from the source DynamoDB table exposes the PII in the response. Even if the response metadata is logged instead of the full data, the initial fetch could still lead to logging of sensitive information, violating the requirement to avoid exposing PII.

This option logs the full response from the API after fetching items from DynamoDB, which includes PII. Logging the complete response exposes sensitive data, contrary to the requirement to avoid exposing PII.

This option suggests processing data and logging workflow events without referencing PII. By not logging any PII and only focusing on operational metrics, it adheres to the requirement of minimizing exposure of sensitive information while still logging important operational details.