Annex B: PCI DSS

PCI DSS controls built into your Terraform modules. Enforced before apply.

Cardholder data protection starts at the infrastructure layer: encryption, access controls, logging and key management on AWS resources. The modules enforce these controls before apply and list the PCI DSS v4.0 requirement ID each one maps to, where the catalog names one.

Modules enforce 109 of 168 PCI DSS controls in the catalog. Of the 128 that cite a PCI DSS clause, they enforce 76. The controls they do not enforce stay with your team, with your SAQ or QSA assessment, penetration testing and network segmentation.

Start free trial View all controls

No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.

Annex B: PCI DSS

Framework: PCI DSS v4.0
For: Your team, on Terraform

B.1

Scope for PCI DSS

If your application stores, processes or transmits card numbers, PCI DSS applies. Even if you use Stripe, your AWS infrastructure may be in scope.

B.1.1

Covers

Infrastructure controls on AWS resources that map to PCI DSS v4.0 requirement IDs, by requirement in B.3.
terraform-aws-modules through the PCI DSS framework host or your org endpoint, and resources written by hand outside modules once your team switches to the compliance.tf provider.

B.1.2

Stays with your team

Your PCI DSS scope. Where cardholder data flows decides it; compliance.tf does not change it.
SAQ completion and submission.
QSA engagement and on-site assessments.
Penetration testing and vulnerability scanning.
Security awareness training.
Physical security of cardholder data environments.
Application-level security controls.
Network segmentation and firewall rules.
Resources outside compliance.tf module coverage, and every control B.4 lists as Mapped: 52 with a PCI DSS clause and 7 without one.

B.2

The source line

Point a module at the PCI DSS framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.

-  source  = "terraform-aws-modules/s3-bucket/aws"
+  source  = "pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws"
   version = "~> 5.0"

With an org endpoint, the source names your org host instead, and PCI DSScomes from your org's configuration.

B.3

Enforced and mapped, by requirement

Of the 128 PCI DSS controls in the documented catalog that cite a clause, modules enforce 76. A control appears once under each requirement it maps to.

Req. 829 of 55

Req. 1032 of 50

Req. 324 of 39

A120 of 36

Req. 116 of 25

Req. 514 of 23

A37 of 13

Req. 76 of 9

Req. 25 of 9

Req. 44 of 8

Req. 67 of 7

Req. 114 of 7

Req. 123 of 5

The catalog maps 40 more controls to PCI DSS without naming a clause, 33 of them enforced. They are listed apart at the end of B.4 and left out of these counts.

Every row is a control your QSA can look up.

Filter the register, or search by control name or clause, for example 3.5.1.

Search controls

128 of 128 shown

Each control links to its public docs page.

Enforced: Modules set this control before anything is deployed.
Mapped: Documented on its docs page, not set by modules. Your team owns it.

B.4

Control register

Control	Status	PCI DSS clauses
ACM RSA certificates should use a key length of at least 2,048 bits	Enforced	3.7.1
AppSync GraphQL APIs should have field-level logging enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
CloudFront distributions access logs should be enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
CloudFront distributions should have AWS WAF enabled	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 6.4.1, 6.4.2, A1.1.2
CloudWatch alarms should have an action configured	Enforced	10.2.1.1, 10.4.1, 10.4.1.1, 10.4.2, 10.4.3, 10.6.3, 10.7.1, 10.7.2, 11.5.2, 11.6.1, 12.10.5, A3.3.1, A3.5.1
CloudWatch log groups should have retention period of at least 365 days	Enforced	3.2.1, 3.3.1.1, 3.3.1.3, 3.3.2, 3.3.3, 5.3.4, 10.5.1
DynamoDB tables should have AWS KMS encryption enabled	Enforced	3.5.1, 8.3.2
DynamoDB tables should have encryption enabled	Enforced	3.5.1, 8.3.2
DynamoDB tables should have point-in-time recovery enabled	Enforced	3.2.1, 3.3.1.1, 3.3.1.3, 3.3.2, 3.3.3, 10.3.3, 10.5.1
Attached EBS volumes should have encryption enabled	Enforced	3.5.1, 8.3.2
EC2 instances should have detailed monitoring enabled	Enforced	10.2.1.1, 10.4.1, 10.4.1.1, 10.4.2, 10.6.3, 10.7.1, 10.7.2, A3.3.1, A3.5.1
EC2 instances should have IAM profile attached	Enforced	7.2.1, 7.2.2, 7.2.5, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4
EC2 instances should be in a VPC	Enforced	1.4.4
EC2 instances should not use key pairs in running state	Enforced	8.3.11
EC2 instances should not have a public IP address	Enforced	11.5.2
EC2 instances should use IMDSv2	Enforced	8.2.8
EC2 launch templates should not assign public IPs to network interfaces	Enforced	1.4.5
ECR repositories should have image scan on push enabled	Enforced	11.3.1, 11.3.1.3
ECS task definitions should not share the host's process namespace	Enforced	1.4.5
EFS file systems should have encryption at rest enabled	Enforced	3.5.1, 8.3.2
EKS clusters should have control plane audit logging enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
EKS clusters endpoint public access should be restricted	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, A1.1.2
EKS clusters should be configured to have kubernetes secrets encrypted using KMS	Enforced	3.5.1, 8.3.2
ElastiCache for Redis replication groups should be encrypted at rest	Enforced	3.5.1, 8.3.2
ElastiCache for Redis replication groups should be encrypted in transit	Enforced	2.2.7, 4.2.1, 4.2.1.1, 8.3.2
ELB application and classic load balancer logging should be enabled	Enforced	5.3.4, 6.2.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
EMR cluster Kerberos should be enabled	Enforced	8.3.2
FSx for Lustre file systems should be configured to copy tags to backups	Enforced	10.3.3
API Gateway V2 stages should have access logging configured	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
KMS CMK rotation should be enabled	Enforced	3.7.4, 3.7.5
Lambda functions should be in a VPC	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, A1.1.2
Lambda functions should use latest runtimes	Enforced	6.3.3, 12.3.4
Log groups should have encryption at rest enabled	Enforced	3.5.1, 8.3.2, 10.3.2, 10.3.3, 10.3.4, A1.2.3
MSK clusters should require TLS for client-broker connections	Enforced	2.2.7, 4.2.1, 4.2.1.1, 8.3.2
Network Firewall policies should have default stateless action set to drop or forward for fragmented packets	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.4.3, 1.5.1, A1.1.2
Network Firewall policies should have default stateless action set to drop or forward for full packets	Enforced	1.2.6, 1.4.3
OpenSearch domains should have audit logging enabled	Enforced	5.3.4, 10.5.1
OpenSearch domains should have encryption at rest enabled	Enforced	3.5.1, 8.3.2
OpenSearch domains should have fine-grained access control enabled	Enforced	7.2.1, 7.2.2, 7.2.5, 7.2.6, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4, 10.6.3
OpenSearch domains should have logging to CloudWatch Logs enabled	Enforced	5.3.4, 10.5.1
OpenSearch domains node-to-node encryption should be enabled	Enforced	1.2.5, 2.2.5, 2.2.7, 4.2.1, 4.2.1.1, 8.3.2
Aurora MySQL DB clusters should have audit logging enabled	Enforced	10.6.3
RDS DB clusters should be encrypted at rest	Enforced	3.5.1, 8.3.2
RDS DB clusters should have IAM authentication configured	Enforced	7.2.1, 7.2.2, 7.2.5, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4
RDS DB instance automatic minor version upgrade should be enabled	Enforced	6.3.3
RDS DB instance backup should be enabled	Enforced	10.3.3
RDS DB instances should be integrated with CloudWatch logs	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
RDS DB instance encryption at rest should be enabled	Enforced	3.5.1, 8.3.2
RDS DB instances should have iam authentication enabled	Enforced	7.2.1, 7.2.2, 7.2.5, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4
Redshift clusters should have audit logging enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
Redshift clusters should have automatic upgrades to major versions enabled	Enforced	6.3.3
Redshift cluster encryption in transit should be enabled	Enforced	1.2.5, 2.2.5, 2.2.7, 4.2.1, 4.2.1.1, 8.3.2
Redshift clusters should have enhanced VPC routing enabled	Enforced	1.3.1, 1.3.2, 1.4.1, 1.4.2, 1.4.4
Redshift clusters should have KMS encryption enabled	Enforced	3.5.1, 8.3.2
Redshift clusters should have required maintenance settings	Enforced	6.3.3
Redshift clusters should have Multi-AZ deployments enabled	Enforced	3.5.1, 5.3.4, 6.3.3, 8.3.2, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
S3 buckets should not use ACLs for user access control	Enforced	7.2.1, 7.2.2, 7.2.5, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4
S3 buckets should have default encryption enabled	Enforced	3.5.1, 8.3.2
S3 buckets should have event notifications enabled	Enforced	11.5.2, 11.6.1, 12.10.5, A3.3.1, A3.5.1
S3 buckets should have lifecycle policies configured	Enforced	3.2.1, 3.3.1.1, 3.3.1.3, 3.3.2, 3.3.3, 10.5.1
S3 buckets should have logging enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
S3 buckets should have MFA delete enabled	Enforced	3.5.1.3, 8.4.1, 8.4.2, 8.4.3, 10.3.2, A1.1.2, A3.4.1
S3 buckets should not be accessible to all authenticated users	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 3.5.1.3, 10.3.2, 10.3.3, 10.3.4, A1.1.2, A1.2.3, A3.4.1
S3 buckets should have object lock enabled	Enforced	10.3.4, 10.5.1
S3 buckets should restrict cross-account permissions	Enforced	7.2.1, 7.2.2, 7.2.5, 7.2.6, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4, 10.6.3
S3 buckets should prohibit public read access	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 3.5.1.3, 10.3.2, 10.3.3, 10.3.4, A1.1.2, A1.2.3, A3.4.1
S3 buckets should prohibit public write access	Enforced	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 3.5.1.3, 10.3.2, 10.3.3, 10.3.4, A1.1.2, A1.2.3, A3.4.1
S3 buckets with versioning enabled should have lifecycle policies configured	Enforced	3.2.1, 10.5.1
S3 buckets should have versioning enabled	Enforced	10.3.4
S3 public access should be blocked at bucket level	Enforced	10.3.4
Secrets Manager secrets should be encrypted using CMK	Enforced	8.3.2
Step Functions state machines should have logging enabled	Enforced	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
SNS topics should be encrypted at rest	Enforced	2.2.1, 3.5.1, 8.3.2
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Enforced	1.3.1, 1.3.2
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced	1.3.1
API Gateway routes should require an authorization type	Mapped	1.5.1
API Gateway REST API stages should have a client certificate configured	Mapped	11.5.2
API Gateway REST API stages should have AWS X-Ray tracing enabled	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.4.1, 10.4.1.1, 10.4.2, 10.6.3, 10.7.1, 10.7.2, A1.2.3, A3.3.1, A3.5.1
API Gateway stages should have logging enabled	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
Athena workgroups should be encrypted at rest	Mapped	3.5.1, 8.3.2
Backup plan rules should retain recovery points for at least 35 days	Mapped	10.5.1
CloudFormation stacks should have notifications enabled	Mapped	12.10.5
CloudTrail trails should be integrated with CloudWatch logs	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.4.1.1, 10.6.3, 11.5.2, 11.6.1, 12.10.5, A1.2.3, A3.3.1, A3.5.1
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped	3.5.1, 8.3.2, 10.3.2, 10.3.3, 10.3.4, A1.2.3
CloudTrail trails should have log file validation enabled	Mapped	10.3.2, 10.3.3, 10.3.4, A1.2.3
CodeBuild projects should have artifact encryption enabled	Mapped	8.3.2
CodeBuild projects should not have privileged mode enabled	Mapped	7.2.3
CodeBuild projects should have logging enabled	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
CodeBuild projects should have S3 logs encrypted	Mapped	3.5.1, 8.3.2
DynamoDB Accelerator (DAX) clusters should be encrypted at rest	Mapped	3.5.1, 8.3.2
DynamoDB Accelerator clusters should be encrypted in transit	Mapped	2.2.7, 4.2.1, 4.2.1.1, 8.3.2
DMS endpoints for Redis OSS should have TLS enabled	Mapped	2.2.7, 4.2.1, 4.2.1.1, 8.3.2
DMS endpoints should use SSL	Mapped	2.2.7, 4.2.1, 4.2.1.1, 8.3.2
DocumentDB clusters should have an adequate backup retention period	Mapped	3.2.1, 3.3.1.1, 3.3.1.3, 3.3.2, 3.3.3, 10.5.1
DocumentDB clusters should have encryption at rest enabled	Mapped	3.5.1, 8.3.2
DocumentDB instance logging should be enabled	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
EBS snapshots should be encrypted	Mapped	3.5.1, 8.3.2
EC2 Client VPN endpoints should have client connection logging enabled	Mapped	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.1.2, A1.2.3
EC2 transit gateways should have auto accept shared attachments disabled	Mapped	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, A1.1.2
EFS access points should enforce a root directory	Mapped	3.5.1.3, 10.3.2, A1.1.2, A3.4.1
EFS access points should enforce a user identity	Mapped	3.5.1.3, 10.3.2, A1.1.2, A3.4.1
ElastiCache clusters should not use the default subnet group	Mapped	1.4.4
Elasticsearch domains should have audit logging enabled	Mapped	5.3.4, 10.5.1
ES domain encryption at rest should be enabled	Mapped	3.5.1, 8.3.2
ES domains should be in a VPC	Mapped	1.5.1
Elasticsearch domain node-to-node encryption should be enabled	Mapped	1.2.5, 2.2.5, 2.2.7, 4.2.1, 4.2.1.1, 8.3.2
IAM password policies should have minimum length set to 14 or greater	Mapped	8.3.6, 8.3.7
IAM password policies should require at least one lowercase letter	Mapped	8.3.6, 8.3.7
IAM password policies should require at least one number	Mapped	8.3.6, 8.3.7
IAM password policies should require at least one symbol	Mapped	8.3.6, 8.3.7
IAM password policies should require at least one uppercase letter	Mapped	8.3.6, 8.3.7
IAM password policies should prevent password reuse	Mapped	8.3.6, 8.3.7
IAM password policies should have strong configurations with minimum length of 8 or greater	Mapped	8.3.6, 8.3.7
IAM password policies should have strong configurations	Mapped	8.3.6, 11.5.2
IAM password policies should expire passwords within 90 days or less	Mapped	8.3.6, 8.3.7, 8.6.3
Kinesis streams should have server side encryption enabled	Mapped	3.5.1, 8.3.2
MQ brokers should have audit log streaming to CloudWatch enabled	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
Neptune DB clusters should publish audit logs to CloudWatch Logs	Mapped	5.3.4, 10.2.1, 10.2.1.1, 10.2.1.2, 10.2.1.3, 10.2.1.4, 10.2.1.5, 10.2.1.6, 10.2.1.7, 10.2.2, 10.3.1, 10.6.3, A1.2.3
Neptune DB clusters should have automated backups enabled	Mapped	10.3.3
Neptune DB clusters should be encrypted at rest	Mapped	3.5.1, 8.3.2
Neptune DB clusters should have IAM database authentication enabled	Mapped	7.2.1, 7.2.2, 7.2.5, 7.3.1, 7.3.2, 7.3.3, 8.2.7, 8.2.8, 8.3.4
S3 access points should have block public access settings enabled	Mapped	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.5.1, 3.5.1.3, 10.3.2, A1.1.2, A3.4.1
SageMaker endpoint configuration encryption should be enabled	Mapped	8.3.2
SageMaker notebook instances should not have direct internet access	Mapped	1.2.8, 1.3.1, 1.3.2, 1.4.2, 1.4.4, 1.5.1, 3.5.1.3, 10.3.2, A1.1.2, A3.4.1
SageMaker notebook instance encryption should be enabled	Mapped	3.5.1, 8.3.2
SageMaker notebook instances should be in a VPC	Mapped	1.2.8, 1.3.1, 1.3.2, 1.4.1, 1.4.2, 1.4.4, 1.5.1, A1.1.2
SageMaker notebook instances root access should be disabled	Mapped	7.2.1, 7.2.2, 7.2.3

Enforced or mapped without a named PCI DSS clause

The catalog lists these 40 controls under PCI DSS but names no PCI DSS clause for them, so the register and the counts in B.3 leave them out. Each still links to its docs page.

Control	Status
CloudFront distributions should require encryption in transit	Enforced
CloudFront distributions should use SNI to serve HTTPS requests	Enforced
CloudFront distributions should use custom SSL/TLS certificates	Enforced
DMS replication instances should not be publicly accessible	Enforced
ECS clusters should have container insights enabled	Enforced
ECS fargate services should run on the latest fargate platform version	Enforced
EFS file systems should be encrypted with CMK	Enforced
EKS clusters endpoint should restrict public access	Enforced
ElastiCache Redis clusters should have automatic backups enabled with a retention period of 15 days or greater	Enforced
ElastiCache for Redis replication groups should be encrypted with CMK	Enforced
ELB application and network load balancer listeners should use ACM certificates	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
FSx for OpenZFS file systems should be configured to copy tags to backups and volumes	Enforced
OpenSearch domains should use HTTPS	Enforced
OpenSearch domains should be in a VPC	Enforced
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs	Enforced
RDS DB clusters should have automatic minor version upgrade enabled	Enforced
RDS DB clusters should be encrypted with CMK	Enforced
RDS DB instances backup retention period should be greater than or equal to 7	Enforced
RDS DB instances should have logging enabled	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should not use public subnet	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should prohibit public access	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced
Redshift clusters should have automatic snapshots enabled	Enforced
Redshift clusters should have audit logging and encryption enabled	Enforced
Redshift clusters should prohibit public access	Enforced
S3 buckets should have cross-region replication enabled	Enforced
S3 buckets should have default encryption enabled using KMS	Enforced
S3 buckets should have policies that prohibit public access	Enforced
S3 public access should be blocked at account level	Enforced
WAFv2 rules should have CloudWatch metrics enabled	Enforced
API Gateway stages should have cache encryption at rest enabled	Mapped
CloudTrail trails should have at least one enabled trail present in a region	Mapped
Elasticsearch domain should send logs to CloudWatch	Mapped
Kinesis streams should be encrypted with CMK	Mapped
Redshift Serverless workgroups should have enhanced VPC routing enabled	Mapped
S3 buckets should have object logging enabled	Mapped
S3 Multi-Region Access Points should have block public access settings enabled	Mapped

Clause IDs for the QSA. Your stack stays as it is.

Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.

Start free trial See plans

B.5

Evidence

B.5.1

What compliance.tf gives your QSA

The PCI DSS clause IDs behind each enforced setting, with stable control IDs and public docs pages.
The config snapshot bound to each environment, and the per-action audit log of promotions between environments.

B.5.2

What comes from your AWS account and GRC tool

Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.

B.5.3

Plans for PCI DSS

PCI DSS is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.

B.7

Questions about PCI DSS

B.7.1

Is this PCI DSS v3.2.1 or v4.0?

Compliance.tf supports PCI DSS v4.0, mandatory for assessments since 31 March 2024. Controls are mapped to v4.0 requirement IDs. If you need v3.2.1 mappings for transition purposes, contact us.

B.7.2

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

B.7.3

What if we want to switch back?

Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.