PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 1 / c1.5
Optimized Infrastructure ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c1.5 Outbound traffic control and automated remediation of network deviations

Optimize network posture by strictly controlling CDE egress and automatically remediating network configurations that drift from the approved secure state.

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: Medium Applies to CDE: Yes

Requirement 1

Install and Maintain Network Security Controls

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

1.3 Network access to and from the CDE is restricted
  • 1.3.1 Inbound traffic to the CDE is restricted to what is necessary Covered
  • 1.3.2 Outbound traffic from the CDE is restricted to what is necessary Covered
  • 1.3.3 NSCs installed between all wireless networks and the CDE Covered
1.4 Network connections between trusted and untrusted networks are controlled
  • 1.4.1 NSCs between trusted and untrusted networks Covered
  • 1.4.2 Inbound traffic from untrusted networks to trusted is restricted Covered
  • 1.4.3 Anti-spoofing measures detect and block forged source IPs Covered
  • 1.4.4 System components storing CHD not directly reachable from untrusted networks Covered
  • 1.4.5 Disclosure of internal IP/routing information is limited Covered
1.5 Risks to the CDE from computing devices that connect to untrusted networks are mitigated
  • 1.5.1 Controls on computing devices with dual CDE/untrusted connectivity Covered

How to implement on AWS

Define the desired network state as code (IaC) and detect drift with AWS Config. Automate remediation of non-compliant rules (e.g. reopened ports) through Config Rules with auto-remediation (SSM Automation) or EventBridge + Lambda. Route all egress through inspection points and domain allow-lists.

Practical implementation

How this control is implemented in each reference architecture:

Reach the optimized state: the approved network config lives as code, drift is detected automatically, and non-compliant changes are reverted without human intervention.

  1. Define the VPC, subnets, and security groups as infrastructure as code (CloudFormation/CDK) so the approved state is versioned and reviewable.
    Account baseline (IaC) CloudFormation
  2. Enable AWS Config drift detection and attach auto-remediation (SSM Automation documents) to the network rules, so a reopened administrative port is reverted automatically.
    Account-wide detection AWS Config Systems Manager
  3. Route all egress through the Network Firewall allow-lists so outbound traffic stays limited to approved destinations.
    CDE egress path Network Firewall

How to validate: Config shows the network rules COMPLIANT with auto-remediation history, and a test change (reopening a port) is reverted automatically within minutes.

Avoid: Fixing drift by hand each time. Manual fixes do not scale and leave a window of exposure; wire remediation to Config so correction is automatic.

Single-account, 3-tier →

Operate the approved network state as code centrally and enforce it across the whole PCI OU, so every CDE account self-heals and deviations surface in one place.

  1. Manage the approved network baseline as IaC centrally and deploy Config rules with auto-remediation across the PCI OU via a conformance pack.
    PCI OU (all CDE accounts) AWS Config CloudFormation AWS Organizations
  2. Let each CDE account correct deviations automatically (SSM Automation) and aggregate all findings and remediation status in the security tooling account.
    Security tooling account Systems Manager Security Hub
  3. Keep all egress flowing through the central inspection path so outbound control is uniform across accounts.
    Network/inspection account Network Firewall Transit Gateway

How to validate: The conformance pack shows network rules COMPLIANT org-wide with remediation history, and a deliberate drift in one CDE account is auto-corrected and visible in Security Hub.

Avoid: Detecting drift centrally but remediating manually per account. Attach auto-remediation to the org-wide rules so correction is consistent and immediate.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine NSC configurations to verify that outbound traffic from the CDE is restricted to only what is necessary (1.3.2.b).
  • Examine policies, configuration standards, and settings on computing devices that connect to both untrusted networks and the CDE to verify the specific security controls are implemented (1.5.1.a, 1.5.1.b).

Evidence in AWS

  • IaC definition of the approved network state and its version history.
  • AWS Config rules with auto-remediation and their execution history (SSM Automation).
  • EventBridge events and Lambda executions that remediate network rule deviations.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 1.3 — Unauthorized traffic cannot enter the CDE.
  • 1.4 — Unauthorized traffic cannot traverse network boundaries between trusted and untrusted networks.
  • 1.5 — Devices that connect to untrusted environments and also connect to the CDE cannot introduce threats to the entity's CDE.

AWS services

AWS Config AWS Systems Manager Automation Amazon EventBridge AWS Lambda AWS Network Firewall

Learning resources

References

  • AWS Security Maturity Model: Automate deviation correction in configurations