PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 3 / c3.3
Foundational Application SecuritySecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.3 Mask PAN when displayed

Mask PAN when displayed, showing at most the first six and last four digits, so that only personnel with a legitimate business need can see more.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: Yes

Requirement 3

Protect Stored Account Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

3.4 Access to displays of full PAN and the ability to copy PAN is restricted
  • 3.4.1 PAN masked when displayed (max BIN + last four) Covered
  • 3.4.2 Technical controls prevent copy/relocation of PAN on remote access Roadmap

How to implement on AWS

Implement masking at the application and API layer. Use tokenization where possible so that downstream applications never handle the full PAN. Record and control, via IAM/application, who has a need to view the full PAN.

Practical implementation

How this control is implemented in each reference architecture:

Show at most BIN + last four by default, gate full-PAN views to the few roles that need them, and prefer tokenization so most services never touch full PAN.

  1. Implement PAN masking in the application tier and expose only masked PAN through the API layer (e.g. transform in Lambda / API Gateway).
    App tier (CDE) AWS Lambda API Gateway
  2. Gate the few operators who may view full PAN with dedicated IAM roles, and log those accesses.
    App tier (CDE) IAM
  3. Prefer tokenization so downstream services and analytics handle a token, never the full PAN.
    App tier (CDE)

How to validate: Screens/receipts show masked PAN, and only the documented roles can retrieve full PAN (verified by an IAM policy review and an access test).

Avoid: Masking only in the UI while the API still returns full PAN. Mask at the data/API layer so a direct API call cannot expose full PAN.

Single-account, 3-tier →

Apply the same masking/tokenization pattern in every CDE account, and where tokenization is shared, isolate it in its own account with narrow cross-account access.

  1. Apply the masking-at-the-API and role-gating pattern consistently in each CDE workload account.
    Each CDE workload account AWS Lambda API Gateway IAM
  2. Where a tokenization service is shared, host it in a dedicated account and grant cross-account access narrowly via IAM roles.
    Dedicated tokenization account IAM
  3. Enforce a data perimeter (SCP / resource policies) so full PAN cannot be copied to accounts outside the approved boundary.
    PCI OU (guardrail) AWS Organizations

How to validate: Each CDE account displays masked PAN, and the data-perimeter policy blocks a test copy of full-PAN data to an out-of-scope account.

Avoid: Duplicating a full-PAN store into each account for convenience. Centralize tokenization and share tokens, not PAN, across accounts.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine documented policies to verify the roles that need to see more than the BIN and last four digits are listed with a legitimate business need (3.4.1.a).
  • Examine system configurations to verify full PAN is only displayed for roles with a documented business need and masked for all others (3.4.1.b).
  • Examine actual displays of PAN (screen, receipts) to verify PAN is masked and only authorized roles see more than BIN/last four (3.4.1.c).

Evidence in AWS

  • Application screenshots/configuration showing masked PAN.
  • IAM policies/application roles that limit access to the full PAN view.
  • Definition of the masking logic in Lambda/API Gateway.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 3.4 — PAN cannot be viewed by anyone without a legitimate business need to see the full PAN, and cannot be copied or relocated by unauthorized personnel using remote-access technologies.

AWS services

AWS Lambda Amazon API Gateway AWS IAM

Learning resources

References

  • PCI DSS v4.0.1 Requirement 3.4