c10.1 Enable CloudTrail across the organization
Log all API calls and access to system components with an AWS CloudTrail organization trail, the foundation for reconstructing events and tying actions to individual users.
Requirement 10
Log and Monitor All Access to System Components and Cardholder Data
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity
- 10.2.1 Audit logs enabled and active for all system components Covered
- 10.2.1.1 Audit logs capture all individual user access to CHD Covered
- 10.2.1.2 Audit logs capture all admin actions Covered
- 10.2.1.3 Audit logs capture all access to audit logs Covered
- 10.2.1.4 Audit logs capture invalid logical access attempts Covered
- 10.2.1.5 Audit logs capture changes to identification/authentication credentials Covered
- 10.2.1.6 Audit logs capture init/stop/pause of audit logs Covered
- 10.2.1.7 Audit logs capture creation/deletion of system-level objects Covered
- 10.2.2 Audit logs record the required details for each event Covered
How to implement on AWS
Create an AWS CloudTrail organization trail covering all accounts and Regions, delivered to a centralized S3 bucket in a dedicated logging account. Enable data events for CDE resources when necessary. Verify coverage with Security Hub/Config.
Practical implementation
How this control is implemented in each reference architecture:
Capture all API activity as the foundation for reconstructing events and tying actions to individuals.
- Enable an AWS CloudTrail trail capturing management events, and add data events for the CDE resources (e.g. the CHD S3 buckets).Account logging
CloudTrail - Deliver the trail to a dedicated S3 bucket with restricted access.Account logging
Amazon S3 - Verify logging coverage with Config/Security Hub controls (cloudtrail-enabled).Account-wide detection
AWS Config 
Security Hub
How to validate: CloudTrail is active for management (and CDE data) events, logs land in the dedicated bucket, and the cloudtrail-enabled control passes.
Avoid: Logging management events only. Access to CHD in S3 needs data events; enable them for the CDE resources.
Log every account automatically with one organization trail delivered to a dedicated, centralized log-archive bucket.
- Create a CloudTrail organization trail from the management account so every current and future account is logged without per-account setup.Management account → PCI OU CloudTrail
AWS Organizations - Deliver all trails to the centralized bucket in the dedicated log-archive account.Log archive account Amazon S3
- Enable data events for CDE resources and confirm coverage via the Config aggregator.Security tooling account AWS Config
How to validate: The organization trail shows all accounts enrolled, logs arrive in the log-archive bucket, and CDE data events are captured.
Avoid: A separate trail per account. New accounts get missed; use one organization trail.
PCI validation
Testing procedures
- Interview the administrator and examine configurations to verify audit logs are enabled and active for all system components (10.2.1).
- Examine audit log configurations and log data to verify capture of individual user access to CHD, all administrative actions, access to audit logs, invalid access attempts, credential changes, and creation/deletion of system-level objects (10.2.1.1 through 10.2.1.7).
Evidence in AWS
- CloudTrail organization trail active across all accounts/Regions.
- Log delivery to the centralized S3 bucket in the logging account.
- Data-events configuration for CDE resources where applicable.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 10.2 — Records of all activities affecting system components and cardholder data are captured.
AWS services
AWS CloudTrail Amazon S3 AWS Organizations Learning resources
References
- AWS Security Maturity Model: API audit logging