I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, as well as payment gateway integration (we use PayPal Checkout). From here, I know that I can proceed with the simplest path for PCI DSS with SAQ A, but it requires me to use PCI DSS compliant service providers. I know that PayPal Checkout is PCI DSS compliant, but my eCommerce SaaS vendor is not. They however use AWS services to host their clients' websites and AWS is PCI DSS compliant.
So is it required to use a PCI DSS compliant eCommerce SaaS vendor? I have been doing lots of reading on this topic but I just can't get a clear answer on this. How does it affect my PCI DSS requirements if the eCommerce SaaS vendor I'm using is not PCI DSS compliant?