Skip to content

PCI DSS v3.2.1

Deprecated Framework

This framework has been superseded by PCI DSS v4.0. Organizations should migrate to the newer version, which became mandatory for compliance assessments after March 31, 2024.

The Payment Card Industry Data Security Standard (PCI DSS) version 3.2.1 is an information security standard for organizations that handle branded credit cards from major card schemes. Maintained by the PCI Security Standards Council, this version provides requirements for securing cardholder data including network security, access control, and vulnerability management. It applies globally to all entities that store, process, or transmit cardholder data including merchants, processors, acquirers, issuers, and service providers.

Terraform Registry Subdomain: pcidssv321

module "..." {
  source  = "pcidssv321.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://pcidssv321.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with PCI DSS v3.2.1 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://pcidssv321.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_stage_cache_encryption_at_rest_enabled,apigateway_stage_logging_enabled"
}