Amazon Nova PII redaction: Nova 2 Lite pipeline on AWS

Amazon Nova now guides a multi-step image redaction workflow that uses Nova 2 Lite to detect and remove PII from images. The solution routes S3 uploads through EventBridge and AWS Step Functions, uses Nova 2 Lite in Amazon Bedrock to decide whether and how to process an image, and stores redacted outputs in S3 folders such as redacted/ and noPII/.

How does the pipeline work?

The pipeline is a six-step workflow that begins when an image is uploaded to S3 and ends with a Nova-guided verification of the redaction. The sequence: an S3 event triggers EventBridge and Step Functions; the workflow validates file formats; Nova 2 Lite performs an initial PII screen and can exit early by moving images with no PII to S3 noPII/; when PII is detected, Nova routes the image to parallel visual and textual subprocesses; outputs are merged and a Lambda function uses the Pillow (PIL) library to redact pixels and save the result to S3 redacted/; finally Nova reviews the redacted image and either releases it to noPII/ or moves it to a quarantine folder for manual review.

This front-to-back orchestration puts Nova 2 Lite at the decision point for routing and verification, and it explicitly supports early exits to avoid unnecessary downstream invocations when "Most business images contain no PII." The architecture list in the solution enumerates steps 1 through 6 covering upload, validation, parallel detection, redaction, and final verification.

Which tools does Nova coordinate to find and redact PII?

Nova 2 Lite directs two complementary subprocesses: a visual process that uses SAM 3 on Amazon SageMaker AI for pixel-level segmentation, and a textual process that uses Amazon Textract for OCR and text coordinates. SAM 3 produces segmentation masks that trace object contours rather than simple bounding boxes. Amazon Textract returns axis-aligned bounding box and polygon coordinates for detected text elements, which Nova evaluates in image context to decide what to obscure.

The solution uses AWS building blocks to move data and run logic: S3 for storage, EventBridge to start the workflow, AWS Step Functions to orchestrate the parallel visual and textual analyses, and AWS Lambda to merge coordinates and redact pixels with Pillow. Nova 2 Lite runs via Amazon Bedrock, and SAM 3 is deployed on SageMaker AI as the segmentation backend. The textual subprocess uses Amazon Textract to extract text and coordinates, which Nova assesses for PII such as names, addresses, identification numbers, telephone numbers, MAC addresses, VINs, faces and fingerprints.

What kinds of PII does the system target and how?

The pipeline treats PII as two modalities: textual items (for example, name, identification number, address, telephone number, asset or property identification) and visual items (personal characteristics such as faces, and biometric data such as fingerprints). Nova first classifies the detected PII type and routes processing accordingly. For textual PII, Amazon Textract extracts text and coordinates, and Nova evaluates those elements in context—for example, combining separate text fragments into a full address that should be obscured. For visual PII, SAM 3 creates pixel-precise segmentation masks that allow the Lambda RedactPII function to obscure only the sensitive pixels.

Why it matters

Putting Nova 2 Lite in the loop reduces blind spots that single-purpose tools miss: it reasons about image context and routes work to specialized services, improving coverage for edge cases such as reflections, partial faces, documents captured at odd angles, or split text fragments that together form an address. The design also reduces cost by short-circuiting processing for images Nova deems clean and by invoking heavier services only when needed. The solution warns that it will incur AWS charges for S3 storage, Lambda invocations, Step Functions state transitions, SageMaker AI endpoint hosting, Amazon Bedrock API calls, and Amazon Textract API calls.

What to watch

Look for operational signals: whether the final Nova verification stage reduces false negatives that require quarantine, and how often Step Functions takes the early-exit path to S3 noPII/. Also watch any updates to Nova 2 Lite availability in Amazon Bedrock and the deployed SAM 3 configuration on SageMaker AI, since the solution requires access to both services in your AWS Region.