PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 10 / c10.2
Foundational Threat DetectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c10.2 Centralize and protect logs against tampering

Protect audit logs against unauthorized modification or deletion and retain them per the required period (at least 12 months, with 3 months immediately available).

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: High Applies to CDE: Yes

Requirement 10

Log and Monitor All Access to System Components and Cardholder Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

10.3 Audit logs are protected from destruction and unauthorized modifications
  • 10.3.1 Read access to audit log files limited to those with a need Covered
  • 10.3.2 Audit log files protected to prevent modifications Covered
  • 10.3.3 Audit log files promptly backed up to secure central location Covered
  • 10.3.4 File integrity monitoring/change detection on audit logs Covered
10.5 Audit log history is retained and available for analysis
  • 10.5.1 Audit log history retained >=12 months, 3 months immediately available Covered

How to implement on AWS

Enable CloudTrail log file validation. Apply S3 Object Lock (WORM) and restrictive policies on the log bucket, with limited access in a dedicated account. Encrypt logs with KMS. Define S3 Lifecycle for retention >= 12 months (Glacier for archival, with 3 months immediately available).

Practical implementation

How this control is implemented in each reference architecture:

Make the logs tamper-resistant and retained for at least 12 months, with 3 months immediately available.

  1. Enable CloudTrail log file validation so tampering is detectable.
    Account logging CloudTrail
  2. Apply S3 Object Lock (WORM) and a restrictive bucket policy, and encrypt logs with a KMS key.
    Account logging Amazon S3 AWS KMS
  3. Set an S3 Lifecycle policy for >=12 months retention (archival tier for older logs), keeping the most recent 3 months immediately available.
    Account logging Amazon S3

How to validate: Log file validation is on, Object Lock protects the bucket, and Lifecycle proves >=12 months retention with 3 months readily queryable.

Avoid: A log bucket that admins can delete from. Use Object Lock (WORM) and restrict access so logs cannot be altered or removed.

Single-account, 3-tier →

Centralize all logs in a dedicated log-archive account so they are tamper-resistant and out of reach even for the rest of the org.

  1. Deliver all trails to the dedicated log-archive account with Object Lock and KMS.
    Log archive account Amazon S3 AWS KMS
  2. Restrict access to the log-archive bucket so even org administrators cannot modify or delete logs.
    Log archive account AWS Organizations Amazon S3
  3. Apply consistent Lifecycle retention (>=12 months) across the consolidated logs.
    Log archive account Amazon S3

How to validate: All CDE accounts' logs land in the locked log-archive bucket, access is restricted org-wide, and retention meets 12 months.

Avoid: Keeping logs in the same account that generates them. A compromised account could tamper with its own logs; centralize in a locked archive account.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine configurations and privileges to verify read access to audit logs is limited to those with a job-related need and that logs are protected from modification (10.3.1, 10.3.2).
  • Examine backup configurations to verify logs are promptly backed up to a secure central server difficult to modify, with file integrity/change detection in use (10.3.3, 10.3.4).
  • Examine retention configurations to verify audit log history is retained at least 12 months with the most recent 3 months immediately available (10.5.1.b, 10.5.1.c).

Evidence in AWS

  • CloudTrail log file validation enabled.
  • S3 Object Lock (WORM) and log bucket policy with restricted access.
  • S3 Lifecycle rules evidencing retention >= 12 months and KMS encryption.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 10.3 — Stored activity records cannot be accessed by unauthorized personnel and are protected from destruction and unauthorized modification.
  • 10.5 — Historical records of activity are available immediately to support incident response and are retained for at least 12 months.

AWS services

AWS CloudTrail Amazon S3 AWS KMS Amazon CloudWatch Logs

Learning resources

References

  • AWS Security Maturity Model: Centralized logging
  • PCI DSS v4.0.1 Requirements 10.3, 10.5