1

We have an eCommerce website hosted on a dedicated server. We get our PCI compliance report from Qualays and there is no problem with that.

However, now we want to test something new on Amazon's AWS environment. But the idea is that we will still use the same checkout setup done on our main site.

So my question is will it be a breach of PCI Compliance if we capture card details on Amazon's AWS environment and then pass it to other website through web-service call and then process it there. We will not save any card data on AWS platform at the moment.

The only reason for doing it like that is because we do not want to invest time in making a different checkout.

2

If you haven't already done so, read Amazon PCI FAQs and request their PCI Compliance Package.

That being said, all you're doing is adding another server to your PCI scope. As long as you add the AWS site to your Qualys scans and ensure that the handling of the data is in line with PCI requirements (e.g. encrypt across public networks), there's no reason you shouldn't be able to do what you want in a PCI-compliant manner.

| improve this answer | |
  • Thanks for that. Its a relief to know that it will not be a big problem. Now is there any specific type of encryption required over network? – nasaa Apr 3 '14 at 8:38
  • Well, you need to meet PCI DSS 4.1: "Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks." – gowenfawr Apr 3 '14 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.