PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 4 / c4.1
Quick Wins Data ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.1 Enforce strong TLS on public endpoints (ALB, CloudFront, API Gateway)

Ensure all PAN transmitted over open, public networks is protected with strong cryptography by enforcing TLS 1.2+ and modern security policies at public entry points.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

Requirement 4

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

4.2 PAN is protected with strong cryptography during transmission
  • 4.2.1 Strong cryptography and security protocols protect PAN in transit Covered
  • 4.2.1.1 Inventory of trusted keys and certificates maintained Covered
  • 4.2.1.2 Wireless networks transmitting PAN use strong cryptography Covered
  • 4.2.2 PAN secured with strong cryptography when sent via end-user messaging Roadmap

How to implement on AWS

Provision certificates with AWS Certificate Manager (ACM). Configure TLS 1.2/1.3 security policies on ALB, CloudFront, and API Gateway. Redirect HTTP to HTTPS. Disable weak protocols and ciphers. Detect non-compliant listeners with AWS Config and Security Hub (ELB.*, CloudFront.* controls).

Practical implementation

How this control is implemented in each reference architecture:

Terminate strong TLS (1.2+) at every public entry point with ACM certificates, force HTTPS, and detect any weak or plaintext listener.

  1. Provision certificates with ACM (DNS-validated) for the public endpoints so renewal is automatic.
    Public subnet Certificate Manager
  2. Set a TLS 1.2+ security policy on the ALB (and CloudFront/API Gateway if used) and configure an HTTP-to-HTTPS redirect listener.
    Public subnet Elastic Load Balancing CloudFront API Gateway
  3. Detect non-compliant or plaintext listeners with the AWS Config managed rules and Security Hub controls (ELB.1, CloudFront.3).
    Account-wide detection AWS Config Security Hub

How to validate: A TLS scan of the endpoint negotiates only TLS 1.2/1.3, HTTP requests 301-redirect to HTTPS, and Security Hub controls ELB.1/CloudFront.3 pass.

Avoid: Leaving a legacy TLS 1.0/1.1 policy 'for old clients'. Weak protocols break the strong-cryptography requirement; use a modern policy and, if needed, a documented compensating path.

Single-account, 3-tier →

Standardize one TLS policy and ACM issuance pattern across every CDE account, and enforce HTTPS-only by policy.

  1. Define a single approved TLS security policy and ACM issuance pattern, and deploy it as code to every CDE account so endpoints are consistent.
    Each CDE workload account Certificate Manager CloudFormation
  2. Front public entry points with a shared CloudFront/edge in the network account where it centralizes the TLS boundary.
    Network/inspection account CloudFront
  3. Enforce HTTPS-only listeners with a Config conformance pack on the PCI OU and aggregate results in the delegated-admin Security Hub.
    Security tooling account → PCI OU AWS Config Security Hub AWS Organizations

How to validate: The conformance pack shows the HTTPS/TLS rules COMPLIANT across all PCI OU accounts, and every public listener negotiates TLS 1.2+.

Avoid: Each team choosing its own TLS policy. Divergent policies create weak spots; distribute one approved policy and verify it org-wide.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine system configurations to verify strong cryptography and security protocols are implemented per the requirement (4.2.1.b).
  • Examine cardholder data transmissions to verify all PAN is encrypted with strong cryptography over open, public networks (4.2.1.c).
  • Examine system configurations to verify that keys/certificates that cannot be verified as trusted are rejected (4.2.1.d).

Evidence in AWS

  • TLS security policies configured on ALB/CloudFront/API Gateway (TLS 1.2+).
  • Valid certificates managed in ACM.
  • Resolved Security Hub findings on TLS/HTTPS (e.g. ELB.1, CloudFront.3).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 4.2 — Cleartext PAN cannot be read or intercepted from any transmissions over open, public networks.

AWS services

AWS Certificate Manager Elastic Load Balancing Amazon CloudFront Amazon API Gateway AWS Config

Learning resources

References

  • AWS Security Maturity Model: Encryption in transit