Skip to content

PCI DSS v4.0

The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 is an information security standard for organizations that handle branded credit cards from major card schemes. Released in March 2022 by the PCI Security Standards Council, this version modernizes requirements with enhanced flexibility through customized implementation and expanded multi-factor authentication requirements. It applies globally to all entities that store, process, or transmit cardholder data and became mandatory for compliance assessments after March 31, 2024.

Terraform Registry Subdomain: pcidss

module "..." {
  source  = "pcidss.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://pcidss.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with PCI DSS v4.0 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=api_gatewayv2_route_authorization_type_configured,apigateway_rest_api_stage_use_ssl_certificate"
}