The correct choice is Detect PII. AWS Glue (via DataBrew) provides a Detect PII transform that scans columns for known sensitive data types and enables actions such as masking, hashing, or redaction so that sensitive values are protected before the data is written to the warehouse. Filter transform is only for row-level filtering based on predicates and cannot locate or protect personally identifiable information. FindMatches transform is designed for entity resolution and deduplication, not for detecting or handling PII. Convert file format to Parquet changes how data is stored and optimized for analytics but offers no capability to classify or obfuscate sensitive fields. When the requirement is to automatically discover and mask sensitive fields in AWS Glue workflows, look for Detect PII. Do not confuse it with transforms for deduplication (FindMatches), row filtering (Filter), or file format conversion.