PCI DSS v4.0

ActiveCore framework

Best for: Any entity that stores, processes, or transmits payment card data from Visa, Mastercard, American Express, Discover, or JCB: merchants, payment processors, acquirers, issuers, and service providers. Transaction volume determines your validation path, a QSA-led Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ). Even a small e-commerce site that redirects to a hosted payment page must validate compliance.

Mandatory?	Mandatory for any entity processing card data
Who validates?	QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4)
Renewal	Annual
Scope	Cardholder data environment (CDE) and connected systems
Governing body	PCI Security Standards Council (PCI SSC), founded by American Express, Discover, JCB, Mastercard, and Visa., PCI DSS v4.0. Official source

Get started

Point the module source at the PCI DSS v4.0 endpoint and pin a version range you reviewed:

module "..." {
  source  = "pcidss.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

pcidss.compliance.tf lists every PCI DSS v4.0 module with its versions, inputs and outputs.

Enforce 105 PCI DSS v4.0 controls with one registry endpoint change.

Start free trial Get started

What compliance.tf covers and what you handle

Area	Compliance.tf automates	You handle
Encryption at Rest	Checks encryption configuration on API Gateway caches, Athena workgroups, and AWS Backup recovery points, and verifies that KMS-managed keys are applied where available.	Key management procedures must be documented per Requirement 3.6, including rotation schedules, split knowledge and dual control for custodians, and the cryptographic key inventory. None of this is enforceable through infrastructure code alone.
Encryption in Transit	Validates TLS enforcement on CloudFront distributions and API Gateway stages (SSL certificate attachment), and checks ACM certificate properties including RSA key length (2048-bit minimum) and expiration within 30 days.	TLS policy version selection (ensuring TLS 1.2 or higher), cipher suite configuration review, documenting authorized protocols per Requirement 4.2.1, and certificate lifecycle management processes beyond expiration monitoring.
Access Control	Verifies that API Gateway v2 routes have authorization types explicitly configured, confirms AWS Organizations governance at the account level, and checks IMDSv2 enforcement on Auto Scaling launch configurations to prevent credential exposure.	You own the RBAC design, user provisioning and deprovisioning workflows, access reviews at least once every six months (Req 7.2.4), and MFA implementation for all access into the CDE (Req 8.4.2).
Logging and Monitoring	Confirms logging is enabled on API Gateway stages and AppSync GraphQL APIs (field-level), checks X-Ray tracing on REST API stages, and validates CloudFormation stack notification configuration for change detection.	Log aggregation, correlation, and 12-month retention (Req 10.5.1). Daily log review processes, SIEM integration, alerting rules for security events per Requirement 10.4.1, and defining which events trigger incident response.
Data Protection and Backup	Validates that backup plans enforce a minimum 35-day retention period, that recovery points are encrypted, and that manual deletion of recovery points is disabled.	Backup restoration testing, documented data retention and disposal policies per Requirement 3.2.1, and secure media destruction processes for Requirement 9.4.
Network Security	Checks that API Gateway stages are associated with WAF web ACLs, providing layer 7 filtering on public-facing endpoints.	WAF rules need human tuning. Penetration testing to validate segmentation at least once every 12 months (Req 11.4.5; every six months for service providers, Req 11.4.6), firewall rule reviews every six months (Req 1.2.7), and documentation of all inbound and outbound traffic flows are outside what any scanning tool can assess.

Controls by category

105 of 170 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 65 are Mapped only: PCI DSS v4.0 lists them, no compliance.tf module checks them.

Requirement 10: Log and Monitor All Access

Assessors want logs that capture user identification, event type, timestamp, and success or failure for all access to system components and CHD per Requirement 10.2.2. Disabled logging on API Gateway stages is one of the most common PCI findings in AWS environments. X-Ray tracing and CloudFormation stack notifications both contribute to Requirement 10.4.1's expectation of timely detection for security-relevant changes.

Control	Status
API Gateway REST API stages should have AWS X-Ray tracing enabled	Mapped
API Gateway stages should have logging enabled	Mapped
AppSync GraphQL APIs should have field-level logging enabled	Enforced
CloudFormation stacks should have notifications enabled	Mapped

Requirement 12: Maintain Security Policies and Data Retention

Manual deletion being enabled on backup recovery points is a red flag. It signals weak protection against insider threats and ransomware, and directly conflicts with the data retention and disposal policies of Requirement 3.2.1. Assessors also cross-check retention periods against documented organizational policy and the disposal requirements under Requirement 3.2.1.

Control	Status
Backup plan rules should retain recovery points for at least 35 days	Mapped

Requirement 3: Protect Stored Account Data

Requirement 3.6 is what assessors focus on: are encryption keys managed separately from the data they protect? They will check every data store, cache, and backup connected to the CDE for strong cryptography. Unencrypted backup recovery points and API Gateway caches holding response data are among the most reliably flagged findings.

Control	Status
Athena workgroups should be encrypted at rest	Mapped
API Gateway stages should have cache encryption at rest enabled	Mapped

Requirement 4: Protect Data in Transit with Strong Cryptography

All CHD transmissions over open, public networks must use TLS 1.2 or higher per Requirement 4.2.1. Assessors check certificate validity, RSA key strength (2048-bit minimum), and HTTPS enforcement on all public-facing endpoints. Expired ACM certificates and CloudFront distributions with HTTP fallback are the gaps that surface most reliably.

Control	Status
API Gateway REST API stages should have a client certificate configured	Mapped
CloudFront distributions should require encryption in transit	Enforced
ACM RSA certificates should use a key length of at least 2,048 bits	Enforced

Requirement 7-8: Access Control and Authentication

The first question is whether authorization types on API routes are explicitly configured rather than left open by default. Assessors also want evidence that access is restricted by business need to know (Req 7.2) and that every user has a unique ID (Req 8.2.1). A registered security contact demonstrates incident response readiness tied to Requirement 12.10.1.

Control	Status
API Gateway routes should require an authorization type	Enforced

Additional controls (159)

AWS CloudTrail (4)

Control	Status
CloudTrail trails should have at least one enabled trail present in a region	Mapped
CloudTrail trails should be integrated with CloudWatch logs	Mapped
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped
CloudTrail trails should have log file validation enabled	Mapped

AWS CodeBuild (4)

Control	Status
CodeBuild projects should have artifact encryption enabled	Mapped
CodeBuild projects should not have privileged mode enabled	Mapped
CodeBuild projects should have logging enabled	Mapped
CodeBuild projects should have S3 logs encrypted	Mapped

AWS Database Migration Service (3)

Control	Status
DMS endpoints for Redis OSS should have TLS enabled	Mapped
DMS endpoints should use SSL	Enforced
DMS replication instances should not be publicly accessible	Enforced

AWS IAM (9)

Control	Status
IAM password policies should have minimum length set to 14 or greater	Mapped
IAM password policies should require at least one lowercase letter	Mapped
IAM password policies should require at least one number	Mapped
IAM password policies should require at least one symbol	Mapped
IAM password policies should require at least one uppercase letter	Mapped
IAM password policies should prevent password reuse	Mapped
IAM password policies should have strong configurations with minimum length of 8 or greater	Mapped
IAM password policies should have strong configurations	Mapped
IAM password policies should expire passwords within 90 days or less	Mapped

AWS KMS (1)

Control	Status
KMS CMK rotation should be enabled	Enforced

AWS Lambda (2)

Control	Status
Lambda functions should be in a VPC	Enforced
Lambda functions should use latest runtimes	Enforced

AWS Secrets Manager (1)

Control	Status
Secrets Manager secrets should be encrypted using CMK	Enforced

AWS Step Functions (1)

Control	Status
Step Functions state machines should have logging enabled	Enforced

AWS WAF (1)

Control	Status
WAFv2 rules should have CloudWatch metrics enabled	Enforced

Amazon CloudFront (4)

Control	Status
CloudFront distributions access logs should be enabled	Enforced
CloudFront distributions should use SNI to serve HTTPS requests	Enforced
CloudFront distributions should use custom SSL/TLS certificates	Enforced
CloudFront distributions should have AWS WAF enabled	Enforced

Amazon CloudWatch (2)

Control	Status
CloudWatch alarms should have an action configured	Enforced
CloudWatch log groups should have retention period of at least 365 days	Enforced

Amazon CloudWatch Logs (1)

Control	Status
Log groups should have encryption at rest enabled	Enforced

Amazon DocumentDB (3)

Control	Status
DocumentDB clusters should have an adequate backup retention period	Mapped
DocumentDB clusters should have encryption at rest enabled	Mapped
DocumentDB instance logging should be enabled	Mapped

Amazon DynamoDB (3)

Control	Status
DynamoDB tables should have AWS KMS encryption enabled	Enforced
DynamoDB tables should have encryption enabled	Enforced
DynamoDB tables should have point-in-time recovery enabled	Enforced

Amazon DynamoDB Accelerator (2)

Control	Status
DynamoDB Accelerator (DAX) clusters should be encrypted at rest	Mapped
DynamoDB Accelerator clusters should be encrypted in transit	Mapped

Amazon EBS (2)

Control	Status
Attached EBS volumes should have encryption enabled	Enforced
EBS snapshots should be encrypted	Mapped

Amazon EC2 (9)

Control	Status
EC2 Client VPN endpoints should have client connection logging enabled	Mapped
EC2 instances should have detailed monitoring enabled	Enforced
EC2 instances should have IAM profile attached	Enforced
EC2 instances should be in a VPC	Mapped
EC2 instances should not use key pairs in running state	Enforced
EC2 instances should not have a public IP address	Enforced
EC2 instances should use IMDSv2	Enforced
EC2 launch templates should not assign public IPs to network interfaces	Enforced
EC2 transit gateways should have auto accept shared attachments disabled	Mapped

Amazon ECR (1)

Control	Status
ECR repositories should have image scan on push enabled	Enforced

Amazon ECS (3)

Control	Status
ECS clusters should have container insights enabled	Enforced
ECS fargate services should run on the latest fargate platform version	Enforced
ECS task definitions should not share the host's process namespace	Enforced

Amazon EFS (4)

Control	Status
EFS access points should enforce a root directory	Enforced
EFS access points should enforce a user identity	Mapped
EFS file systems should have encryption at rest enabled	Enforced
EFS file systems should be encrypted with CMK	Enforced

Amazon EKS (4)

Control	Status
EKS clusters should have control plane audit logging enabled	Enforced
EKS clusters endpoint public access should be restricted	Enforced
EKS clusters endpoint should restrict public access	Enforced
EKS clusters should be configured to have kubernetes secrets encrypted using KMS	Mapped

Amazon EMR (1)

Control	Status
EMR cluster Kerberos should be enabled	Mapped

Amazon ElastiCache (5)

Control	Status
ElastiCache clusters should not use the default subnet group	Mapped
ElastiCache Redis clusters should have automatic backups enabled with a retention period of 15 days or greater	Enforced
ElastiCache for Redis replication groups should be encrypted at rest	Enforced
ElastiCache for Redis replication groups should be encrypted with CMK	Enforced
ElastiCache for Redis replication groups should be encrypted in transit	Enforced

Amazon Kinesis (2)

Control	Status
Kinesis streams should be encrypted with CMK	Mapped
Kinesis streams should have server side encryption enabled	Mapped

Amazon MQ (1)

Control	Status
MQ brokers should have audit log streaming to CloudWatch enabled	Mapped

Amazon MSK (1)

Control	Status
MSK clusters should require TLS for client-broker connections	Enforced

Amazon Neptune (4)

Control	Status
Neptune DB clusters should publish audit logs to CloudWatch Logs	Mapped
Neptune DB clusters should have automated backups enabled	Mapped
Neptune DB clusters should be encrypted at rest	Mapped
Neptune DB clusters should have IAM database authentication enabled	Mapped

Amazon OpenSearch Service (7)

Control	Status
OpenSearch domains should have audit logging enabled	Enforced
OpenSearch domains should have encryption at rest enabled	Enforced
OpenSearch domains should have fine-grained access control enabled	Enforced
OpenSearch domains should use HTTPS	Enforced
OpenSearch domains should be in a VPC	Mapped
OpenSearch domains should have logging to CloudWatch Logs enabled	Enforced
OpenSearch domains node-to-node encryption should be enabled	Enforced

Amazon RDS (18)

Control	Status
Aurora MySQL DB clusters should have audit logging enabled	Enforced
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs	Enforced
RDS DB clusters should have automatic minor version upgrade enabled	Enforced
RDS DB clusters should be encrypted with CMK	Enforced
RDS DB clusters should be encrypted at rest	Enforced
RDS DB clusters should have IAM authentication configured	Enforced
RDS DB instance automatic minor version upgrade should be enabled	Enforced
RDS DB instance backup should be enabled	Mapped
RDS DB instances backup retention period should be greater than or equal to 7	Enforced
RDS DB instances should be integrated with CloudWatch logs	Enforced
RDS DB instance encryption at rest should be enabled	Enforced
RDS DB instances should have iam authentication enabled	Enforced
RDS DB instances should have logging enabled	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should not use public subnet	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS DB instances should prohibit public access	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced

Amazon Redshift (10)

Control	Status
Redshift clusters should have audit logging enabled	Enforced
Redshift clusters should have automatic snapshots enabled	Enforced
Redshift clusters should have automatic upgrades to major versions enabled	Enforced
Redshift cluster encryption in transit should be enabled	Enforced
Redshift clusters should have audit logging and encryption enabled	Enforced
Redshift clusters should have enhanced VPC routing enabled	Enforced
Redshift clusters should have KMS encryption enabled	Enforced
Redshift clusters should have required maintenance settings	Enforced
Redshift clusters should have Multi-AZ deployments enabled	Enforced
Redshift clusters should prohibit public access	Enforced

Amazon S3 (21)

Control	Status
S3 access points should have block public access settings enabled	Mapped
S3 buckets should not use ACLs for user access control	Enforced
S3 buckets should have cross-region replication enabled	Enforced
S3 buckets should have default encryption enabled	Enforced
S3 buckets should have default encryption enabled using KMS	Enforced
S3 buckets should have event notifications enabled	Enforced
S3 buckets should have lifecycle policies configured	Enforced
S3 buckets should have logging enabled	Enforced
S3 buckets should have MFA delete enabled	Mapped
S3 buckets should not be accessible to all authenticated users	Enforced
S3 buckets should have object lock enabled	Enforced
S3 buckets should have object logging enabled	Mapped
S3 buckets should have policies that prohibit public access	Enforced
S3 buckets should restrict cross-account permissions	Mapped
S3 buckets should prohibit public read access	Enforced
S3 buckets should prohibit public write access	Enforced
S3 buckets with versioning enabled should have lifecycle policies configured	Enforced
S3 buckets should have versioning enabled	Enforced
S3 Multi-Region Access Points should have block public access settings enabled	Mapped
S3 public access should be blocked at account level	Enforced
S3 public access should be blocked at bucket level	Enforced

Amazon SNS (1)

Control	Status
SNS topics should be encrypted at rest	Enforced

Amazon SageMaker (5)

Control	Status
SageMaker endpoint configuration encryption should be enabled	Mapped
SageMaker notebook instances should not have direct internet access	Mapped
SageMaker notebook instance encryption should be enabled	Mapped
SageMaker notebook instances should be in a VPC	Mapped
SageMaker notebook instances root access should be disabled	Mapped

Amazon VPC (4)

Control	Status
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Enforced
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)	Mapped
VPC security groups should not allow ingress from ::/0 to remote server administration ports	Mapped

Elastic Load Balancing (4)

Control	Status
ELB application and classic load balancer logging should be enabled	Enforced
ELB application and network load balancer listeners should use ACM certificates	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode	Enforced

Other (11)

Control	Status
Elasticsearch domains should have audit logging enabled	Mapped
ES domain encryption at rest should be enabled	Mapped
ES domains should be in a VPC	Mapped
Elasticsearch domain should send logs to CloudWatch	Mapped
Elasticsearch domain node-to-node encryption should be enabled	Mapped
FSx for OpenZFS file systems should be configured to copy tags to backups and volumes	Enforced
FSx for Lustre file systems should be configured to copy tags to backups	Enforced
API Gateway V2 stages should have access logging configured	Enforced
Network Firewall policies should have default stateless action set to drop or forward for fragmented packets	Enforced
Network Firewall policies should have default stateless action set to drop or forward for full packets	Enforced
Redshift Serverless workgroups should have enhanced VPC routing enabled	Mapped

Framework	Control overlap	Note
NIST Cybersecurity Framework v1.1	High 69%
NIST Cybersecurity Framework v2.0	High 64%
ISO/IEC 27001:2022	Medium 58%

Frequently asked questions

Does PCI DSS v4.0 apply to my organization if we use a third-party payment processor?

Yes. Using a third-party processor reduces your scope but does not eliminate your compliance obligation. If your systems touch cardholder data at any point, including web pages that host payment fields or redirect to a processor, you are in scope. Most small merchants using hosted payment pages can complete SAQ A, which has the fewest requirements. Your acquiring bank determines your merchant level and the applicable SAQ type.

What changed between PCI DSS v3.2.1 and v4.0 that I need to know?

The largest changes are: expanded MFA requirements covering all access into the CDE, not just remote access (Req 8.4.2); a new requirement for automated log review mechanisms (Req 10.4.1.1); targeted risk analysis replacing the blanket 'periodic' language across several requirements (Req 12.3.1); client-side script integrity monitoring for payment pages (Req 6.4.3); and the customized approach as an alternative validation method. Requirements that were labeled future-dated until March 31, 2025 are now mandatory.

How long does a PCI DSS v4.0 assessment typically take?

It depends on your level and readiness. A Level 1 merchant or service provider undergoing a full QSA-led ROC assessment typically runs 3 to 6 months from gap analysis through final report submission. SAQ completion for smaller merchants can take 2 to 6 weeks. The formal assessment is annual, but quarterly ASV scans and ongoing monitoring run year-round.

What does the 'customized approach' in PCI DSS v4.0 mean for my AWS environment?

The customized approach (described in PCI DSS v4.0 Appendices D and E; Requirement 12.3.2 requires a targeted risk analysis for each requirement met this way) lets you meet a requirement's stated objective using a control different from the defined approach. You must document a controls matrix, perform a targeted risk analysis, and have the QSA validate that your custom control meets the objective. For AWS environments, one approach to meeting this would be combining native services (GuardDuty, Security Hub, Config Rules) to satisfy a requirement's intent where the specific prescribed method differs. Be aware that the customized approach requires more documentation and QSA scrutiny, not less.

Which parts of PCI DSS v4.0 can compliance.tf automate, and what requires manual evidence?

The controls mapped here cover technical configuration: encryption settings, logging enablement, access authorization, certificate validity, and backup policies. That said, PCI DSS v4.0 has 12 principal requirements (v4.0 added 64 new requirements), many of which require procedural evidence (written policies, training records, physical security controls, penetration test reports, incident response plans). Requirements 9 and 12 depend mostly on physical and administrative evidence, and Requirements 5 and 11 on operational evidence such as anti-malware, vulnerability scan and penetration test results, which Terraform configuration does not produce.

Enforce 105 PCI DSS v4.0 controls with one module source change.