Please note that this post, first published over a year ago, may now be out of date.
For businesses dealing with payment card transactions, complying with the Payment Card Industry Data Security Standard (PCI DSS) is a crucial requirement. You’re required and expected to protect cardholder data and prevent potential fraud.
In this blog post, I’ll explore how Amazon Web Services (AWS) Control Tower can serve as a foundational tool to help you build a secure, multi-account AWS environment aligned with PCI DSS requirements. By using AWS Control Tower in conjunction with other AWS services and best practices, you can streamline your path to achieving PCI DSS compliance.
Understanding AWS Control Tower
AWS Control Tower is a service that assists you in setting up and governing a secure, multi-account AWS environment. It is designed to help implement AWS best practices and compliance standards effectively. While not explicitly designed for PCI DSS compliance, Control Tower lays the groundwork for building a secure AWS infrastructure aligned with various security requirements.
Account structure and isolation
One of the essential aspects of PCI DSS compliance is isolating cardholder data environments to minimise the scope of compliance assessments. AWS Control Tower facilitates the creation of well organised AWS accounts, providing separate accounts for different environments, such as development, testing, and production. We’d recommend using this capability to create a separate set of accounts for storing and processing cardholder data. This account isolation ensures that cardholder data is compartmentalised, reducing the risk of unauthorised access, and reducing the scope of audits.
Implementing guardrails and security baselines
AWS Control Tower enables you to implement AWS Config rules and Service Control Policies (SCPs) as guardrails and security baselines. By defining and enforcing security standards, you can ensure that all AWS accounts within your environment comply with necessary security measures, which align with PCI DSS requirements.
Automating provisioning
With AWS Control Tower, you can automate the provisioning of AWS accounts using AWS Organizations and AWS Service Catalog. By utilising predefined templates and configurations, you can consistently enforce security settings across all accounts, simplifying the process of adhering to PCI DSS requirements.
Logging and monitoring
Complying with PCI DSS means showing that you’ve got robust logging and monitoring practices in place. AWS Control Tower encourages the use of AWS CloudTrail for logging, and AWS CloudWatch for monitoring AWS resources and applications. Properly configuring these services allows you to capture and retain the audit logs required for PCI DSS compliance assessments.
You can use Control Tower just for the AWS control plane logs (cloud API calls), but I usually recommend also storing your critical audit-relevant events into CloudTrail. As a managed service, CloudTrail gives you strong guarantees of durable, tamper-protected log storage.
Access control and identity management
AWS Identity and Access Management (IAM) is a vital component of ensuring secure access to AWS resources. AWS Control Tower advocates IAM best practices, allowing you to manage user access effectively. By following these IAM principles, you can control access to cardholder data, meeting key PCI DSS access control requirements. AWS IAM Identity Center (formerly AWS Single Sign-On) allows you to easily manage access to multiple AWS accounts centrally.
Compliance check automation
While AWS Control Tower itself does not conduct PCI DSS compliance checks, it can work in tandem with other AWS services and third-party tools to automate compliance checks and continuously monitor the security posture against PCI DSS requirements. This automation helps ensure - and demonstrate - your ongoing adherence to the standard.
Conclusion
In conclusion, achieving PCI DSS compliance is a shared responsibility between AWS and your organisation. AWS Control Tower serves as a powerful tool for building a secure, multi-account AWS environment aligned with best practices, thus providing a strong foundation for meeting PCI DSS requirements.
By leveraging AWS Control Tower alongside other AWS services and following AWS’s guidance on PCI DSS compliance, you can enhance your security posture and confidently handle payment card transactions in the cloud. Remember, maintaining compliance is an ongoing process, and regular assessments and improvements are crucial to safeguarding cardholder data effectively.
Designing effective systems security for your SaaS business can feel like a distraction from delivering customer value. Book a security review today.
This blog is written exclusively by The Scale Factory team. We do not accept external contributions.
