Does using AWS dedicated-hosts or dedicated instance will be compliant with PCI DSS requirement?
Please refer to the comparison section: https://aws.amazon.com/ec2/dedicated-hosts/
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes you can use a dedicated ec2 host, but you don’t need to, you can just use the standard ec2 service as part of your architecture. There’s a list of all the services that AWS provides PCI compliance for, helping you reduce your burden, here.
I would look at using a fully managed service like Lambda if you’re building something new, it’ll save you some effort. Also you can check out a suggested architecture here.
If you go into the AWS console then to Artifact manager, you can download the PCI document describing what AWS takes care of for you.
If you’re creating a payment gateway then you have a very steep PCI learning curve ahead of you I’m afraid. It’s worth speaking with a QSA, it’ll save you a lot of time.
Based on your link a dedicated server may be enough to assure PCI compliance but it is far from certain.
Wherever card data flows is within scope. If it flows through a server in a datacentre the entire data centre is in scope.
Control of physical access to the data centre forms part of the compliance as does ensuring appropriate access to the actual machine and what data might be dumped in a log and who can read it.
AWS may be able to guarantee that no one outside your org can access it but they may not. I worked for a PA-DSS certified company with a 3rd Party data centre but the actual VM host was ours and the data centre was audited. PCI-DSS is maybe a little easier than PA-DSS as you can often attest that you are compliant rather than be audited but you are still relying on AWS for part of your compliance. That should be backed up contractually really.