PCI DSS v4.0
Best for: Any entity that stores, processes, or transmits payment card data from Visa, Mastercard, American Express, Discover, or JCB: merchants, payment processors, acquirers, issuers, and service providers. Transaction volume determines your validation path, a QSA-led Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ). Even a small e-commerce site that redirects to a hosted payment page must validate compliance.
| Mandatory? | Mandatory for any entity processing card data |
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
🏛 PCI Security Standards Council (PCI SSC), founded by American Express, Discover, JCB, Mastercard, and Visa. · PCI DSS v4.0 Official source →
Get Started
module "..." {
source = "pcidss.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Encryption at Rest: Checks encryption configuration on API Gateway caches, Athena workgroups, and AWS Backup recovery points, and verifies that KMS-managed keys are applied where available.
- Encryption in Transit: Validates TLS enforcement on CloudFront distributions and API Gateway stages (SSL certificate attachment), and checks ACM certificate properties including RSA key length (2048-bit minimum) and expiration within 30 days.
- Access Control: Verifies that API Gateway v2 routes have authorization types explicitly configured, confirms AWS Organizations governance at the account level, and checks IMDSv2 enforcement on Auto Scaling launch configurations to prevent credential exposure.
- Logging and Monitoring: Confirms logging is enabled on API Gateway stages and AppSync GraphQL APIs (field-level), checks X-Ray tracing on REST API stages, and validates CloudFormation stack notification configuration for change detection.
- Data Protection and Backup: Validates that backup plans enforce a minimum 35-day retention period, that recovery points are encrypted, and that manual deletion of recovery points is disabled.
- Network Security: Checks that API Gateway stages are associated with WAF web ACLs, providing layer 7 filtering on public-facing endpoints.
What you handle
- Encryption at Rest: Key management procedures must be documented per Requirement 3.6, including rotation schedules, split knowledge and dual control for custodians, and the cryptographic key inventory. None of this is enforceable through infrastructure code alone.
- Encryption in Transit: TLS policy version selection (ensuring TLS 1.2 or higher), cipher suite configuration review, documenting authorized protocols per Requirement 4.2.1, and certificate lifecycle management processes beyond expiration monitoring.
- Access Control: You own the RBAC design, user provisioning and deprovisioning workflows, quarterly access reviews (Req 7.2.4), and MFA implementation for all access into the CDE (Req 8.4.2).
- Logging and Monitoring: Log aggregation, correlation, and 12-month retention (Req 10.5.1). Daily log review processes, SIEM integration, alerting rules for security events per Requirement 10.4.1, and defining which events trigger incident response.
- Data Protection and Backup: Backup restoration testing, documented data retention and disposal policies per Requirement 3.1, and secure media destruction processes for Requirement 9.4.
- Network Security: WAF rules need human tuning. Annual penetration testing to validate segmentation (Req 11.4.6), firewall rule reviews every six months (Req 1.2.7), and documentation of all inbound and outbound traffic flows are outside what any scanning tool can assess.
Controls by Category
Requirement 10: Log and Monitor All Access (4 controls)
Assessors want logs that capture user identification, event type, timestamp, and success or failure for all access to system components and CHD per Requirement 10.2.1. Disabled logging on API Gateway stages is one of the most common PCI findings in AWS environments. X-Ray tracing and CloudFormation stack notifications both contribute to Requirement 10.4.1's expectation of timely detection for security-relevant changes.
Requirement 12: Maintain Security Policies and Data Retention (1 control)
Manual deletion being enabled on backup recovery points is a red flag. It signals weak protection against insider threats and ransomware, and directly conflicts with Requirement 12.3.1's mandate for formal data retention schedules. Assessors also cross-check retention periods against documented organizational policy and the disposal requirements under Requirement 3.1.
Requirement 3: Protect Stored Account Data (2 controls)
Requirement 3.6 is what assessors focus on: are encryption keys managed separately from the data they protect? They will check every data store, cache, and backup connected to the CDE for strong cryptography. Unencrypted backup recovery points and API Gateway caches holding response data are among the most reliably flagged findings.
Requirement 4: Protect Data in Transit with Strong Cryptography (3 controls)
All CHD transmissions over open, public networks must use TLS 1.2 or higher per Requirement 4.2.1. Assessors check certificate validity, RSA key strength (2048-bit minimum), and HTTPS enforcement on all public-facing endpoints. Expired ACM certificates and CloudFront distributions with HTTP fallback are the gaps that surface most reliably.
Requirement 7-8: Access Control and Authentication (1 control)
The first question is whether authorization types on API routes are explicitly configured rather than left open by default. Assessors also want evidence that access is restricted by business need to know (Req 7.2) and that every user has a unique ID (Req 8.2.1). A registered security contact demonstrates incident response readiness tied to Requirement 12.10.1.
Additional Controls (159)
AWS CloudTrail (4)
AWS CodeBuild (4)
AWS Database Migration Service (3)
AWS IAM (9)
AWS Lambda (2)
AWS Secrets Manager (1)
AWS Step Functions (1)
Amazon CloudFront (4)
compliance.tf moduleCloudFront distributions should use SNI to serve HTTPS requestscompliance.tf moduleCloudFront distributions should use custom SSL/TLS certificatescompliance.tf moduleCloudFront distributions should have AWS WAF enabledcompliance.tf moduleAmazon CloudWatch (2)
Amazon CloudWatch Logs (1)
Amazon DocumentDB (3)
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (2)
Amazon EBS (3)
Amazon EC2 (10)
compliance.tf moduleEC2 instances should have IAM profile attachedcompliance.tf moduleEC2 instances should be in a VPCcompliance.tf moduleEC2 instances should not use key pairs in running statecompliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleEC2 instances should use IAM instance roles for AWS resource accesscompliance.tf moduleEC2 launch templates should not assign public IPs to network interfacescompliance.tf moduleEC2 transit gateways should have auto accept shared attachments disabledAmazon ECS (3)
Amazon EFS (4)
Amazon EKS (4)
compliance.tf moduleEKS clusters endpoint public access should be restrictedcompliance.tf moduleEKS clusters endpoint should restrict public accesscompliance.tf moduleEKS clusters should be configured to have kubernetes secrets encrypted using KMScompliance.tf moduleAmazon ElastiCache (5)
compliance.tf moduleElastiCache for Redis replication groups should be encrypted at restcompliance.tf moduleElastiCache for Redis replication groups should be encrypted with CMKcompliance.tf moduleElastiCache for Redis replication groups should be encrypted in transitcompliance.tf moduleAmazon Kinesis (2)
Amazon Neptune (4)
Amazon OpenSearch Service (7)
compliance.tf moduleOpenSearch domains should have encryption at rest enabledcompliance.tf moduleOpenSearch domains should have fine-grained access control enabledcompliance.tf moduleOpenSearch domains should use HTTPScompliance.tf moduleOpenSearch domains should be in a VPCcompliance.tf moduleOpenSearch domains should have logging to CloudWatch Logs enabledcompliance.tf moduleOpenSearch domains node-to-node encryption should be enabledcompliance.tf moduleAmazon RDS (18)
compliance.tf moduleAurora PostgreSQL DB clusters should publish logs to CloudWatch Logscompliance.tf moduleRDS DB clusters should have automatic minor version upgrade enabledRDS DB clusters should be encrypted with CMKcompliance.tf moduleRDS DB clusters should be encrypted at restcompliance.tf moduleRDS DB clusters should have IAM authentication configuredcompliance.tf moduleRDS DB instance automatic minor version upgrade should be enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have iam authentication enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (10)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift clusters should have automatic upgrades to major versions enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have enhanced VPC routing enabledcompliance.tf moduleRedshift clusters should have KMS encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should have Multi-AZ deployments enabledcompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (21)
compliance.tf moduleS3 buckets should have cross-region replication enabledcompliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have event notifications enabledcompliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have MFA delete enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object lock enabledcompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should restrict cross-account permissionscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 Multi-Region Access Points should have block public access settings enabledS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (6)
Amazon VPC (1)
Elastic Load Balancing (4)
compliance.tf moduleELB application and network load balancers should only use SSL or HTTPS listenerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should be configured with defensive or strictest desync mitigation modecompliance.tf moduleOther (11)
compliance.tf moduleFSx for Lustre file systems should be configured to copy tags to backupscompliance.tf moduleAPI Gateway V2 stages should have access logging configuredcompliance.tf moduleNetwork Firewall policies should have default stateless action set to drop or forward for fragmented packetscompliance.tf moduleNetwork Firewall policies should have default stateless action set to drop or forward for full packetscompliance.tf moduleRedshift Serverless workgroups should have enhanced VPC routing enabledRelated Frameworks
NIST 800-53 Rev 5 — 🟢 High overlap (65%)
PCI DSS v4.0 maps extensively to NIST 800-53 Rev 5 control families, especially SC (System and Communications Protection), AC (Access Control), AU (Audit and Accountability), and IA (Identification and Authentication). NIST 800-53 is broader in scope and covers federal information systems, while PCI DSS narrows focus to cardholder data protection. Organizations already compliant with NIST 800-53 will find significant reuse when scoping a PCI assessment.
SOC 2 — 🟡 Medium overlap (50%)
SOC 2 Trust Services Criteria for Security, Availability, and Confidentiality partially overlaps with PCI DSS requirements for access control, logging, encryption, and change management. SOC 2 does not prescribe the same technical specificity (no explicit TLS version requirement or key length mandate), so PCI DSS controls generally satisfy SOC 2 criteria but not the reverse.
NIST CSF v1.0 — 🟡 Medium overlap (55%)
The NIST Cybersecurity Framework maps to PCI DSS across Identify, Protect, Detect, Respond, and Recover functions. PCI SSC publishes an official mapping between PCI DSS v4.0 and NIST CSF. NIST CSF is risk-based and outcome-oriented, while PCI DSS prescribes specific implementation requirements.