Requirement 8.1.1 of PCI DSS states:
Assign all users a unique ID before allowing them to access system components or cardholder data.
Using Amazon IAM I can set up individual accounts for users so they do not need to log into the Amazon AWS console as the root account.
However, I don't believe IAM can be used to manage Linux and Windows credentials on the instances within our AWS account.
Does having root and administrator accounts running on our instances mean that we cannot meet this requirement using IAM? If need be we could put a policy in place stating that users do not log onto live instances and that the root and administrator accounts on these boxes are only used in order to alter the images (AMIs) that the instances are created from.
However, since the AMIs share the credentials with any instances created from them we cannot keep these private.
Installing an Active Directory server seems overkill in this situation and possibly unreliable due to the transitory nature of EC2 instances.