PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 3 / c3.6
Foundational Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.6 Manage the cryptographic key lifecycle with AWS KMS

Generate, rotate, and retire the keys that protect stored account data using AWS KMS so key management meets PCI DSS key-lifecycle requirements.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: High Applies to CDE: Yes

Requirement 3

Protect Stored Account Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

3.6 Cryptographic keys used to protect stored account data are secured
  • 3.6.1 Procedures to protect cryptographic keys against disclosure/misuse Covered
3.7 Key-management processes and procedures for cryptographic keys are defined and implemented
  • 3.7.1 Key-management: generation of strong keys Covered
  • 3.7.2 Key-management: secure distribution of keys Covered
  • 3.7.3 Key-management: secure storage of keys Covered
  • 3.7.4 Key-management: key changes at cryptoperiod end Covered
  • 3.7.5 Key-management: retirement/replacement/destruction of keys Covered
  • 3.7.6 Manual cleartext key operations use split knowledge/dual control Your responsibility
  • 3.7.7 Prevention of unauthorized substitution of keys Covered
  • 3.7.8 Key custodians formally acknowledge responsibilities Your responsibility
  • 3.7.9 SP shares keys with customers with documented guidance (SP only) Your responsibility

How to implement on AWS

Use AWS KMS customer managed keys (CMKs) to protect stored account data. Enable automatic annual rotation and perform on-demand rotation when required. Restrict key administration and usage with key policies and grants (split from data roles). Schedule key deletion with a waiting period for retirement/replacement. Use CloudHSM where FIPS 140-2 Level 3 custody is required.

Practical implementation

How this control is implemented in each reference architecture:

Use KMS CMKs with rotation and least-privilege key policies for all stored account data.

  1. Create customer managed KMS keys for account-data stores and enable automatic key rotation.
    Data tier (CDE) AWS KMS
  2. Restrict key administration and usage via key policies/grants, separating key admins from data users.
    Data tier (CDE) AWS KMS IAM
  3. Retire or replace keys via scheduled deletion with a waiting period; document cryptoperiods.
    Data tier (CDE) AWS KMS

How to validate: KMS keys protecting account data have rotation enabled, scoped key policies, and a defined retirement process.

Avoid: Using a single long-lived key forever with no rotation or separation of duties.

Single-account, 3-tier →

Centralize key governance and enforce rotation across the org.

  1. Provision CMKs per workload/account with automatic rotation; share via key policies where cross-account access is needed.
    Data accounts (CDE) AWS KMS AWS Organizations
  2. Enforce rotation and key-policy baselines with Config rules / conformance packs.
    All accounts AWS Config
  3. Use CloudHSM for keys that require FIPS 140-2 Level 3 custody.
    Dedicated crypto account CloudHSM

How to validate: Config reports rotation enabled and key policies compliant across accounts; retirement is handled via scheduled deletion.

Avoid: Ad-hoc per-account key management with no org-wide rotation enforcement.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine KMS key configurations and policies to verify key generation, rotation at cryptoperiod end, and secure retirement/replacement.

Evidence in AWS

  • KMS key rotation status
  • KMS key policies and grants
  • Config rule compliance for key rotation
  • Scheduled key-deletion records

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 3.7 — Cryptographic keys used to protect stored account data are generated, rotated, and retired securely throughout their lifecycle.

AWS services

AWS KMS AWS CloudHSM AWS Config

Learning resources

References

  • https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
  • https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html