PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 6 / c6.3
Foundational Application SecuritySecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.3 Protect public-facing web applications with AWS WAF

Protect public-facing web applications against attacks through an automated technical solution that detects and blocks web attacks (WAF), or through application security reviews.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: High Applies to CDE: Yes

Requirement 6

Develop and Maintain Secure Systems and Software

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

6.4 Public-facing web applications are protected against attacks
  • 6.4.1 Public-facing web apps protected (review or automated solution) Covered
  • 6.4.2 Automated technical solution (WAF) deployed for public-facing web apps Covered
  • 6.4.3 Payment page scripts managed, authorized, with integrity assurance Roadmap

How to implement on AWS

Deploy AWS WAF on CloudFront/ALB/API Gateway with managed rules (Core rule set, SQLi, XSS). Enable WAF logging. Tune rules to reduce false positives. Combine with AWS Shield for DDoS mitigation. AWS WAF satisfies the automated technical solution option of 6.4.2.

Practical implementation

How this control is implemented in each reference architecture:

Put AWS WAF in front of every public web app in blocking mode with tuned managed rules, satisfying the automated technical solution of 6.4.2.

  1. Attach an AWS WAF web ACL to the ALB/CloudFront/API Gateway in front of the web tier, with the Core rule set plus SQLi and XSS managed rule groups.
    Public subnet / edge AWS WAF CloudFront Elastic Load Balancing
  2. Enable WAF logging to CloudWatch/S3 and tune rules (count then block) to remove false positives before enforcing.
    Account logging AWS WAF CloudWatch
  3. Add AWS Shield for DDoS mitigation on the public entry point.
    Public subnet / edge AWS Shield

How to validate: The web ACL is associated to the public app in block mode, WAF logs show attacks being blocked, and a test SQLi/XSS request is rejected.

Avoid: Leaving WAF permanently in count-only mode. Counting alone does not protect; tune, then switch to block for the CDE.

Single-account, 3-tier →

Manage one shared, tuned WAF policy with Firewall Manager so every public-facing CDE app inherits the same protection automatically.

  1. Author a shared WAF web ACL and rule set once and distribute/enforce it across the PCI OU with AWS Firewall Manager.
    Security tooling account → PCI OU Firewall Manager AWS WAF AWS Organizations
  2. Ensure Firewall Manager auto-associates the web ACL to new public-facing resources so coverage cannot be forgotten.
    PCI OU (all CDE accounts) Firewall Manager
  3. Centralize WAF logs to the log-archive account.
    Log archive account Amazon S3

How to validate: Firewall Manager reports the WAF policy compliant across the PCI OU, and a newly created public ALB is auto-associated with the web ACL.

Avoid: Attaching WAF per app by hand. New endpoints slip through; use Firewall Manager to enforce and auto-associate org-wide.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • For public-facing web applications, examine system configuration settings and audit logs and interview personnel to verify an automated technical solution that detects and prevents web-based attacks is in place per all elements of the requirement (6.4.2).

Evidence in AWS

  • AWS WAF web ACL associated with the public application with active managed rules.
  • AWS WAF logs in CloudWatch/S3 evidencing detection/blocking.
  • Rule configuration in blocking mode for the CDE.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 6.4 — Public-facing web applications are protected in real time against malicious attacks.

AWS services

AWS WAF Amazon CloudFront AWS Shield Elastic Load Balancing

Learning resources

References

  • AWS Security Maturity Model: WAF with managed rules
  • PCI DSS v4.0.1 Requirement 6.4.2