Resources
Curated links to official AWS guidance for designing and operating PCI DSS workloads on AWS.
See how every PCI DSS v4.0.1 sub-requirement maps to the AWS controls in this model.
AWS Security Reference Architecture
Holistic guidance for deploying the full set of AWS security services in a multi-account environment.
docs.aws.amazon.com ↗A PCI DSS-focused view of the AWS Security Reference Architecture, mapping AWS security services to PCI requirements.
docs.aws.amazon.com ↗PCI DSS on AWS
How AWS supports PCI DSS v4.0.x compliance, including the shared responsibility model and service considerations.
d1.awsstatic.com ↗Frequently asked questions about achieving and maintaining PCI DSS compliance on AWS.
aws.amazon.com ↗About PCI DSS references and attribution
PCI DSS® and PCI Security Standards Council® are registered trademarks of the PCI Security Standards Council, LLC ("PCI SSC"). The PCI Data Security Standard is the intellectual property of, and © PCI Security Standards Council, LLC.
This maturity model is an independent educational resource created by AWS to help you map AWS security controls to PCI DSS requirements. It is not affiliated with, endorsed by, or approved by the PCI SSC, and the PCI SSC was not involved in its creation.
Requirement and sub-requirement references are provided only to help you locate the corresponding control in the standard. This model summarizes and maps requirements to AWS guidance; it does not reproduce the standard and is not a substitute for it. Always refer to the official PCI DSS v4.0.1 in the PCI SSC Document Library as the authoritative source.
This resource is for educational purposes only. It is not a statement of compliance, an assessment, or a certification. Validation of PCI DSS compliance can only be performed by a Qualified Security Assessor (QSA) or through the applicable self-assessment process.
The security domains used to organize the AWS controls follow the AWS Cloud Adoption Framework (CAF) Security Perspective, published by AWS.