1

Does using AWS dedicated-hosts or dedicated instance will be compliant with PCI DSS requirement?
Please refer to the comparison section: https://aws.amazon.com/ec2/dedicated-hosts/

Thanks.

closed as too broad by Mike Ounsworth, iainpb, Steve, ISMSDEV, Xiong Chiamiov Nov 30 '17 at 0:19

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Which PCI DSS requirement? What will the dedicated host be used for? – R15 Sep 27 '17 at 5:38
  • application that will process the payment. – Petr Sep 27 '17 at 5:42
  • 2
    You would need to ask your QSA to get a definitive answer. There may be scenarios that are perfectly acceptable to them if you meet all of their protection requirements; or they may simply say "no way" regardless. In any case, you should strongly consider outsourcing your payment to a third party instead of building your own; this would absolve you from the liability for a breach. – John Deters Sep 27 '17 at 5:55
  • I am working on a payment gateway .. So I just wanted to check. – Petr Sep 27 '17 at 6:31
3

Yes you can use a dedicated ec2 host, but you don’t need to, you can just use the standard ec2 service as part of your architecture. There’s a list of all the services that AWS provides PCI compliance for, helping you reduce your burden, here.

I would look at using a fully managed service like Lambda if you’re building something new, it’ll save you some effort. Also you can check out a suggested architecture here.

If you go into the AWS console then to Artifact manager, you can download the PCI document describing what AWS takes care of for you.

If you’re creating a payment gateway then you have a very steep PCI learning curve ahead of you I’m afraid. It’s worth speaking with a QSA, it’ll save you a lot of time.

0

Based on your link a dedicated server may be enough to assure PCI compliance but it is far from certain.

Wherever card data flows is within scope. If it flows through a server in a datacentre the entire data centre is in scope.

Control of physical access to the data centre forms part of the compliance as does ensuring appropriate access to the actual machine and what data might be dumped in a log and who can read it.

AWS may be able to guarantee that no one outside your org can access it but they may not. I worked for a PA-DSS certified company with a 3rd Party data centre but the actual VM host was ours and the data centre was audited. PCI-DSS is maybe a little easier than PA-DSS as you can often attest that you are compliant rather than be audited but you are still relying on AWS for part of your compliance. That should be backed up contractually really.

Not the answer you're looking for? Browse other questions tagged or ask your own question.