PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Question

Our architecture is based on the best practices for PCI-DSS on AWS

Amazon WAF -> API Gateway -> AWS Lambda

The lambda's are running within a VPC and the SG / Firewall and segmentation have been checked and approved.

We are also centralising our logging to Graylog to monitor for specific rules.

The item that the PCI-DSS QSA is not happy with during the gap analysis is the lack of Intrusion Detection and Intrusion Prevention systems and policies for the in-scope items.

We have Guard Duty running to detect anomalies and we have argued the Amazon WAF acts as an IPS but as we don't actually control any servers that people would login to or access, except the exposed endpoints on API Gateway with the WAF in front I was wondering how other companies solve this requirement for the Intrusion Detection aspect?

Do we need to send the WAF logs to an external system for monitoring? Would that count as IDS/IPS?

Answer 1

Rationalising Amazon WAF as an implementation of an IPS would be difficult as it is like rationalising a bicycle is a aeroplane because sometimes they both have tires on tar roads.. Analogies aside allow me to share my personal experiences as an information security consultant for the APAC regions AWS APN partner of the year specifically leading a few PCI DSS engagements myself:

Guard Duty is precisely the IDS the ROC describes, and to further convince a QSA you might decide to demonstrate the workflow you have applied around how you use Guard Duty because (again with an analogy) saying you use Guard Duty and not how you use it is the same as having a firewall device in the data centre not powered on and saying you 'have a firewall device', Guard Duty alone doesn't act much like what an IDS should unless you apply your process (technical or practical) to use Guard Duty as an IDS.

How should you use Guard Duty as an IDS?

1. an IDS relies on it's sources of IOC (indicators of compromise) and the AWS Resource offers you an ability to add threat intelligence feeds in several standard formats. You can demonstrate to the QSA how you configured your own feeds with Guard Duty's cloudforamtion, terraform, ansible playbooks, CDK, or your ClickOps playbook with screenshots (whatever you use to do deployments of AWS Resource configurations)
2. An IDS 'D' detects; Show the QSA examples of past alerts that arrived, how you triaged the alert for true positive (the alert indicates a threat that is proven to be real) and how you determined the threat, scored the risk, decided an outcome
3. show how you used the IDS alert and remediated the threat, then tested and monitored the remediation you applied for proof it was an effective remediation for the detected threat (maybe you can just use the payload that triggered the alert to see if it triggers the alert again)

For an IPS you might need to find an alternative solution as AWS has no IPS offerings on their platform, though an AWS Proserve consultant will argue the AWS Network Firewall is an IPS because they have a feature they named "Managed IPS Rules" but naming a feature does not make the service as a whole somehow meet all the characteristics of an IPS.

If you must use AWS resources to achieve what an IPS achieves (and have the QSA include these as compensating controls in their CCW accompanying the ROC) you can try to show them how you use; AWS Shield Advanced, WAF, AWS Network Firewall, Systems Manager Documents to describe host based configurations that provide IPS capabilities (e.g. fail2ban on Linux for SSH/FTP/etc. IPS)

Just remember that in PCI DSS 3.2.1 the QSA has complete discretion over what is compliant and what is not. You do not need to do anything described in the requirements and you can still be compliant according to the QSA. I have seen first hand the entire requirement 3 not be met (no encryption was ever used at all) and because the other data protections in place satisfied the QSA the entire requirement 3 was disregarded and the company was PCI DSS compliant. This is all due to the CCW, a QSA may evaluate anything you implement as being as good or better as the requirement, so strictly speaking you do not need an IPS or IDS at all, all you need to do is show you considered the intent of an IPS/IDS and addressed them in your architecture.