Does using AWS dedicated-hosts or dedicated instance will be compliant with PCI DSS requirement?
Please refer to the comparison section:
https://aws.amazon.com/ec2/dedicated-hosts/
Thanks.
-
1Which PCI DSS requirement? What will the dedicated host be used for?– R15Sep 27, 2017 at 5:38
-
application that will process the payment.– PetrSep 27, 2017 at 5:42
-
2You would need to ask your QSA to get a definitive answer. There may be scenarios that are perfectly acceptable to them if you meet all of their protection requirements; or they may simply say "no way" regardless. In any case, you should strongly consider outsourcing your payment to a third party instead of building your own; this would absolve you from the liability for a breach.– John DetersSep 27, 2017 at 5:55
-
I am working on a payment gateway .. So I just wanted to check.– PetrSep 27, 2017 at 6:31
Add a comment
|
2 Answers
Yes you can use a dedicated ec2 host, but you don’t need to, you can just use the standard ec2 service as part of your architecture. There’s a list of all the services that AWS provides PCI compliance for, helping you reduce your burden, here.
I would look at using a fully managed service like Lambda if you’re building something new, it’ll save you some effort. Also you can check out a suggested architecture here.
If you go into the AWS console then to Artifact manager, you can download the PCI document describing what AWS takes care of for you.
If you’re creating a payment gateway then you have a very steep PCI learning curve ahead of you I’m afraid. It’s worth speaking with a QSA, it’ll save you a lot of time.
Based on your link a dedicated server may be enough to assure PCI compliance but it is far from certain.
Wherever card data flows is within scope. If it flows through a server in a datacentre the entire data centre is in scope.
Control of physical access to the data centre forms part of the compliance as does ensuring appropriate access to the actual machine and what data might be dumped in a log and who can read it.
AWS may be able to guarantee that no one outside your org can access it but they may not. I worked for a PA-DSS certified company with a 3rd Party data centre but the actual VM host was ours and the data centre was audited. PCI-DSS is maybe a little easier than PA-DSS as you can often attest that you are compliant rather than be audited but you are still relying on AWS for part of your compliance. That should be backed up contractually really.
