PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 3 / c3.1
Quick Wins Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.1 Enable encryption at rest by default (EBS, S3, RDS)

Turn on default encryption at rest for the storage services that may hold account data, rendering PAN unreadable wherever it is stored. This is a high-impact quick win enabled at the account/Region level.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

Requirement 3

Protect Stored Account Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

3.5 PAN is secured wherever it is stored
  • 3.5.1 PAN rendered unreadable wherever stored (hash/truncation/tokenization/encryption) Covered

How to implement on AWS

Enable EBS default encryption at the Region level. Apply encryption on S3 buckets (SSE-KMS) and block unencrypted objects via policy. Enable encryption on RDS/Aurora at instance creation. Use AWS KMS with customer managed keys (CMKs) for the CDE. Detect unencrypted resources with AWS Config.

Practical implementation

How this control is implemented in each reference architecture:

Turn on encryption at rest by default for every storage service in the data tier, keyed by a customer managed KMS key scoped to the CDE, and detect anything unencrypted.

  1. Enable EBS default encryption for the Region so every new volume is encrypted automatically.
    Account/Region baseline Amazon EC2 AWS KMS
  2. Turn on SSE-KMS on the CDE S3 buckets and RDS instances using a customer managed KMS key scoped to the CDE, and add an S3 bucket policy that denies unencrypted PutObject.
    Data tier (CDE) Amazon S3 Amazon RDS AWS KMS
  3. Detect any unencrypted volume, bucket, or database with the AWS Config managed rules (encrypted-volumes, rds-storage-encrypted, s3-bucket-server-side-encryption-enabled).
    Account-wide detection AWS Config

How to validate: The three Config encryption rules report COMPLIANT, and a test PutObject without SSE-KMS to a CDE bucket is denied by the bucket policy.

Avoid: Relying on the default AWS-managed key for CDE data. Use a customer managed key so you control the key policy, rotation, and can separate key admins from data admins.

Single-account, 3-tier →

Make encryption at rest non-optional across the whole PCI OU with preventive SCPs plus detective Config, and keep keys per-account for blast-radius isolation.

  1. Attach SCPs to the PCI OU that deny creating unencrypted EBS volumes, RDS instances, and S3 buckets (and deny turning off EBS default encryption).
    PCI OU (guardrail) AWS Organizations
  2. Deploy a Config conformance pack org-wide so every CDE account is evaluated against the same encryption rules and reported to the delegated admin.
    Security tooling account → PCI OU AWS Config
  3. Keep customer managed KMS keys per CDE account (no shared data keys across accounts) so a key compromise stays contained.
    Each CDE workload account AWS KMS

How to validate: The conformance pack shows encryption rules COMPLIANT across all PCI OU accounts, and an SCP test blocks creating an unencrypted RDS instance in a CDE account.

Avoid: Sharing one KMS key across all CDE accounts for convenience. It defeats blast-radius isolation; scope keys per account and grant use via key policy.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine documentation about the system used to render PAN unreadable (vendor, type, algorithms) to verify PAN is rendered unreadable by an approved method (3.5.1.a).
  • Examine data repositories and audit logs, including payment application logs, to verify PAN is rendered unreadable wherever stored (3.5.1.b).
  • If disk/partition-level encryption is used, verify logical access is managed independently of the OS authentication and that access is separated (3.5.1.2, 3.5.1.3).

Evidence in AWS

  • EBS default-encryption configuration enabled in the Region.
  • S3 bucket policies and active SSE-KMS encryption.
  • AWS Config report of encrypted storage resources (encrypted-volumes, rds-storage-encrypted, s3-bucket-server-side-encryption-enabled).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 3.5 — Cleartext PAN cannot be read from storage media.

AWS services

AWS KMS Amazon EBS Amazon S3 Amazon RDS AWS Config

Learning resources

References

  • AWS Security Maturity Model: Encryption at rest