AWS Releases Security Reference Architecture Deep Dive for PCI DSS Compliance

New PCI DSS Deep Dive Guide

Amazon Web Services (AWS) announced the release of the AWS Security Reference Architecture (SRA) Payment Card Industry (PCI) Data Security Standard (DSS) Deep Dive. This new guide expands upon the existing AWS SRA to offer specific, architecture-level guidance for organizations that store, process, or transmit cardholder data within the AWS environment.

Addressing Compliance Needs

The guide aims to bridge the gap between general AWS security best practices and the technical and organizational controls necessary for PCI DSS compliance. It demonstrates how AWS SRA patterns can address PCI DSS requirements, covering aspects from account scoping and network segmentation to encryption, logging, and access control.

Extending the AWS SRA

The PCI DSS deep dive does not replace the core AWS SRA but extends it by mapping AWS SRA account types to PCI DSS scoping boundaries, indicating which accounts are in scope, connected-to, security-impacting, or out-of-scope in a typical payment architecture. It also layers PCI-specific controls, such as additional logging granularity, encryption requirements, or network restrictions, onto existing AWS SRA service configurations. The architectural patterns and controls described are applicable to both merchants and service providers.

Intended Audience

The guide is designed for security architects creating or expanding AWS multi-account landing zones for PCI DSS workloads, compliance engineers mapping AWS controls to PCI DSS requirements, cloud platform teams building shared security services for cardholder data environments, and Qualified Security Assessors (QSAs) and Internal Security Assessors (ISAs) seeking to understand how AWS SRA patterns meet PCI DSS intent.