I am using EC2 instances to power our web service that needs to be PCI SAQ-C compliant. I am trying to figure out what point 1.3 of the self assessment really means:
1.3 Does the firewall configuration prohibit direct public access between the Internet and any system component in the cardholder data environment, as follows:
1.3.3 Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment?
1.3.5 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized?
1.3.6 Is stateful inspection, also known as dynamic packet filtering, implemented (that is, only established connections are allowed into the network)?
Since I am on EC2 a DMZ is not really an option because all instances have a public IP. I have been searching for several days on the web trying to figure out what this means and what I need to do to comply, but I cannot find anything. This is probably in large part because I have a programming background not security, or system administration. So I am guessing I am looking in the wrong place. But, I am not sure what the right place is. So, if you can recommend a resource that would explain this in more depth, or software that will fulfill this requirement, I would appreciate it.