CGPulse

Sign In

PCI DSS v4.0

AWS 51 automated checks

Payment Card Industry Data Security Standard v4.0 compliance checks for AWS resources

Access Control

IAM root user must not have access keys 7.2.1 · Critical
IAM group should be used for permission management 7.2.2 · Low
IAM policy must be attached and in use 7.2.1 · Low

Authentication

IAM user must have MFA enabled 8.3.1 · Critical
Cognito user pool must enforce MFA 8.3.1 · Critical
RDS cluster must have IAM database authentication enabled 8.3.1 · Medium

Data Protection

S3 bucket encryption should use SSE-KMS with a customer-managed key 3.5.1 · Medium
RDS instance must have storage encryption enabled 3.5.1 · High
EBS volume should use a customer-managed KMS key 3.5.1 · Medium
KMS key must have automatic key rotation enabled 3.6.1 · High

Encryption in Transit

Load balancer listener must use a secure SSL policy 4.2.1 · High
Elasticsearch domain must enforce HTTPS 4.2.1 · High
ElastiCache replication group must have in-transit encryption enabled 4.2.1 · High
CloudFront distribution must enforce HTTPS viewer protocol 4.2.1 · High

Incident Response

Organization should maintain a PCI incident response plan 12.10.1 · Critical
Organization should test the incident response plan annually 12.10.2 · High

Logging & Monitoring

CloudTrail trail must be multi-region 10.2.1 · Critical
CloudTrail trail must have log file validation enabled 10.3.2 · High
CloudTrail trail should be encrypted with a KMS key 10.3.1 · High
CloudWatch log group must have a retention period configured 10.7.1 · Medium
S3 bucket must have access logging enabled 10.2.1 · Medium

Malware Protection

Inspector coverage must be active 5.2.1 · Medium

Network Security

Security group must not allow unrestricted ingress (0.0.0.0/0) 1.3.1 · Critical
RDS instance must not be publicly accessible 1.3.2 · Critical
Redshift cluster must not be publicly accessible 1.3.2 · Critical
S3 bucket must block all public access 1.3.2 · Critical
Redshift cluster should use enhanced VPC routing 1.3.1 · Medium
Organization should maintain current network diagrams 1.1.2 · High
Organization should maintain cardholder data flow diagrams 1.1.3 · High

Personnel Security

Organization should perform background checks for CDE access personnel 12.7 · High

Physical Security

IAM password policy must require minimum length of 14 9.2.1 · Medium
Organization should implement physical access controls to the CDE 9.1 · High
Organization should securely destroy cardholder data media 9.4 · High

Risk Assessment

Organization should conduct annual PCI risk assessments 12.2 · High

Secure Configuration

CloudFront distribution must use TLS 1.2 minimum 2.2.7 · High
EC2 instance must not use a deprecated instance metadata version 2.2.6 · High
Lambda function must not use a deprecated runtime 2.2.1 · High

Secure Development

ECR repository must have image scan on push enabled 6.2.4 · High
CodeBuild project should not run in privileged mode 6.2.2 · High
Organization should implement a secure software development lifecycle 6.3 · High

Security Awareness

Organization should conduct security awareness training for all personnel 12.6 · High

Security Policies

IAM password policy must require minimum length of 14 12.1.1 · Medium
IAM password policy must require minimum length of 14 12.6.1 · Medium

Security Policy

Organization should assign PCI DSS security responsibilities 12.1.1 · High
Organization should maintain a comprehensive information security policy 12.1 · High

Security Testing

IAM password policy must require minimum length of 14 11.3.1 · Medium
IAM password policy must require minimum length of 14 11.4.1 · Medium

Service Providers

Organization should manage service provider PCI compliance 12.8 · High

Testing

Organization should conduct penetration testing at least annually 11.4 · Critical
Organization should perform quarterly vulnerability scans 11.3 · High
Organization should implement change detection mechanisms 11.5 · Medium

Measure your PCI DSS v4.0 posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation