PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 7 / c7.3
Efficient Identity and Access ManagementSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c7.3 Automated access review and refinement

Continuously optimize permissions by removing unused privileges and periodically validating that access remains aligned with business need.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: Yes

Requirement 7

Restrict Access to System Components and Cardholder Data by Business Need to Know

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

7.2 Access to system components and data is appropriately defined and assigned
  • 7.2.1 Access control model defined for need-to-know/least-privilege Covered
  • 7.2.2 Access assigned based on job classification and least privilege Covered
  • 7.2.3 Required privileges approved by authorized personnel Your responsibility
  • 7.2.4 User accounts and access reviewed at least every 6 months Your responsibility
  • 7.2.5 Application/system accounts and access managed by least privilege Covered
  • 7.2.5.1 Access by app/system accounts reviewed periodically Your responsibility
  • 7.2.6 Query access to stored CHD restricted via roles/applications Covered

How to implement on AWS

Use IAM Access Analyzer to generate policies based on CloudTrail activity and detect unused permissions. Run periodic access reviews. Refine permission sets based on last-accessed information recommendations.

Practical implementation

How this control is implemented in each reference architecture:

Reach the optimized state: right-size permissions from real activity and remove unused access on a recurring cadence.

  1. Use IAM Access Analyzer policy generation from CloudTrail activity to right-size over-broad policies to what is actually used.
    Account-wide detection IAM CloudTrail
  2. Enable unused-access analysis (unused roles, permissions, credentials) and act on the findings.
    Account-wide detection IAM
  3. Run periodic access reviews and record the outcome as PCI 7.2.4 evidence.
    Access review process IAM

How to validate: Access Analyzer last-accessed/unused-access reports show shrinking privilege over time, and periodic-review records exist with adjustments made.

Avoid: Granting access and never revisiting it. Privileges accumulate; review on a cadence and remove what is unused.

Single-account, 3-tier →

Run access reviews and unused-access analysis org-wide and tighten the shared permission-set baseline consistently.

  1. Enable IAM Access Analyzer unused-access analysis org-wide from the delegated administrator to surface stale access across all accounts.
    Security tooling account → PCI OU IAM AWS Organizations
  2. Refine the shared IAM Identity Center permission sets based on the findings so the least-privilege baseline tightens everywhere at once.
    Identity / security account IAM Identity Center
  3. Keep the periodic-review evidence (including third-party/vendor accounts) centrally.
    Log archive account Amazon S3

How to validate: Org-wide unused-access findings trend down, and permission-set changes are recorded with each periodic review across all CDE accounts.

Avoid: Reviewing each account in isolation. Analyze unused access org-wide and refine the shared permission sets so improvements apply everywhere.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examine

Testing procedures

  • Examine policies to verify a process is defined to review all user accounts and related access privileges, including third-party/vendor accounts (7.2.4.a).
  • Interview personnel and examine documented results of periodic access reviews to verify assigned privileges remain appropriate and limited to business need (7.2.4.b).

Evidence in AWS

  • Access Analyzer last-accessed reports and recommendations.
  • Records of periodic access reviews and adjustments made.
  • Policies generated from actual activity (CloudTrail).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 7.2 — Access requirements are established according to job functions following least-privilege and need-to-know principles.

AWS services

IAM Access Analyzer AWS IAM AWS CloudTrail

Learning resources

References

  • PCI DSS v4.0.1 Requirement 7.2.4