PCI DSS v3.2.1
Deprecated Framework
Best for: Any merchant, service provider, payment processor, acquirer, or issuer that stores, processes, or transmits cardholder data from major card brands (Visa, Mastercard, Amex, Discover, JCB). PCI DSS v3.2.1 applied regardless of transaction volume, though validation requirements varied by merchant level (Level 1: over 6 million transactions/year required a QSA audit; Levels 2-4 could self-assess).
| Mandatory? | Mandatory for any entity processing card data |
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
🏛 PCI Security Standards Council (PCI SSC), founded by Visa, Mastercard, American Express, Discover, and JCB International. · PCI DSS v3.2.1 (superseded by v4.0) Official source →
Get Started
module "..." {
source = "pcidssv321.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Encryption in Transit: Runs 4 controls checking CloudFront distribution TLS configuration, SSL protocol versions, origin encryption settings, and ACM certificate expiration. Covers Requirement 4.1 enforcement for AWS CDN infrastructure.
- Audit Logging and Monitoring: Verifies CloudTrail is enabled across all regions with read/write events, S3 data event logging, CloudWatch integration, log file validation, 365-day log group retention, and Config recorder delivery. Ten controls total, mapping to Requirements 10.1-10.3 and 10.7.
- Encryption at Rest: Checks that CloudTrail logs are encrypted with customer-managed KMS CMKs rather than default S3 encryption. Maps to Requirement 3.4's mandate to render stored data unreadable.
- Network Security: Checks that Auto Scaling launch configurations do not assign public IPs and that API Gateway stages are associated with WAF web ACLs. Maps to Requirements 1.2 and 1.3 for restricting connections to the CDE.
- Secure Development Practices: Three controls: CodeBuild projects must not run in privileged mode, must not expose sensitive AWS values in plaintext environment variables, and must use OAuth for source repository access.
What you handle
- Encryption in Transit: Documenting all CHD transmission flows, verifying TLS configuration on non-AWS endpoints, and maintaining a protocol inventory across the CDE.
- Audit Logging and Monitoring: Setting up log alerting for Requirement 10.6 daily reviews, defining incident response procedures for log anomalies, and demonstrating that logs are reviewed by personnel or automated tooling.
- Encryption at Rest: Documenting key management procedures per Requirements 3.5-3.6, implementing key rotation, restricting key custodian access, and encrypting all other data stores (RDS, DynamoDB, EBS) that may contain cardholder data.
- Network Security: Maintaining network diagrams (Requirement 1.1.2), documenting all allowed services and ports (Requirement 1.1.6), performing firewall rule reviews every six months (Requirement 1.1.7), and configuring security groups and NACLs beyond what these controls check.
- Secure Development Practices: Implementing a full secure SDLC per Requirement 6.3, conducting code reviews (Requirement 6.3.2), deploying patches within one month (Requirement 6.2), and training developers on secure coding (Requirement 6.5).
Controls by Category
Requirement 10: Track and Monitor All Access to Network Resources and Cardholder Data (5 controls)
This is the largest control area in most PCI DSS assessments. The scope is broad: Requirements 10.2-10.3 specify which events must be captured, Requirement 10.7 sets retention at one year with three months immediately available, and Requirement 10.5.5 requires file integrity monitoring on the logs themselves, which CloudTrail's log file validation directly addresses. Failed Config recorder deliveries are a reliable audit flag because they mark a window where configuration changes went unrecorded.
compliance.tf moduleRequirement 3: Protect Stored Cardholder Data (1 control)
A common gap here is encrypting primary data stores while leaving audit logs unprotected. Requirement 3.4 applies to any mechanism that renders stored cardholder data unreadable, and assessors extend that scrutiny to CloudTrail logs that may reference CHD. Expect questions about KMS key rotation schedules and who holds key custodian access under Requirements 3.5-3.6.
Requirement 4: Encrypt Transmission of Cardholder Data Across Open Networks (1 control)
The check is straightforward: TLS 1.2 or higher on every data path touching the CDE, with SSLv3 and early TLS explicitly disabled. Expired ACM certificates get flagged not just as a hygiene issue but because a lapsed cert can force fallback to unencrypted connections or prompt staff to implement insecure workarounds under operational pressure.
Requirement 6: Develop and Maintain Secure Systems and Applications (1 control)
Plaintext AWS credentials in CodeBuild environment variables are a direct Requirement 6.3.2 violation and one of the first things an assessor checks in the build pipeline. Privileged mode in build containers draws similar scrutiny because it grants host-level access that can compromise pipeline integrity. Assessors also verify that source repository access uses OAuth rather than embedded credentials.
Additional Controls (85)
AWS Database Migration Service (1)
AWS IAM (2)
AWS Lambda (1)
AWS Secrets Manager (1)
AWS Step Functions (1)
Amazon API Gateway (1)
Amazon CloudWatch (1)
Amazon CloudWatch Logs (1)
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
Amazon EBS (2)
Amazon EC2 (3)
Amazon EFS (3)
Amazon EKS (2)
Amazon ElastiCache (1)
Amazon Kinesis (1)
Amazon OpenSearch Service (7)
compliance.tf moduleOpenSearch domains should have encryption at rest enabledcompliance.tf moduleOpenSearch domains should have fine-grained access control enabledcompliance.tf moduleOpenSearch domains should use HTTPScompliance.tf moduleOpenSearch domains should be in a VPCcompliance.tf moduleOpenSearch domains should have logging to CloudWatch Logs enabledcompliance.tf moduleOpenSearch domains node-to-node encryption should be enabledcompliance.tf moduleAmazon RDS (12)
compliance.tf moduleRDS database clusters should use a custom administrator usernamecompliance.tf moduleRDS DB instance automatic minor version upgrade should be enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have iam authentication enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS database instances should use a custom administrator usernamecompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleAmazon Redshift (7)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should not use the default admin usernamecompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (15)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have MFA delete enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (4)
Amazon VPC (1)
Elastic Load Balancing (7)
compliance.tf moduleELB application load balancers should be configured with defensive or strictest desync mitigation modecompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancers should only use SSL or HTTPS listenerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should be configured with defensive or strictest desync mitigation modecompliance.tf moduleRelated Frameworks
PCI DSS v4.0 — 🟢 High overlap (85%)
PCI DSS v4.0 is the direct successor. Most v3.2.1 requirements carry forward, but v4.0 adds 64 new requirements (many with extended timelines to March 2025), introduces a customized approach as an alternative to the defined approach, and strengthens multi-factor authentication and password requirements. Organizations should migrate assessments to v4.0.
NIST 800-53 Rev 5 — 🟡 Medium overlap (55%)
NIST 800-53 Rev 5 covers a much broader set of security and privacy controls. PCI DSS Requirements 1-2 map to NIST's SC and CM families, Requirement 10 maps heavily to AU controls, and Requirement 3 aligns with SC-28. NIST provides depth in areas PCI DSS does not emphasize, like supply chain risk management.
SOC 2 — 🟡 Medium overlap (45%)
SOC 2 Trust Services Criteria partially overlaps with PCI DSS in access control (CC6.x maps to Requirements 7-8), logging and monitoring (CC7.x maps to Requirement 10), and encryption (CC6.1 maps to Requirements 3-4). SOC 2 is broader in its scope of organizational controls but less prescriptive about specific technical configurations.