This reference deployment guide provides instructions for deploying Payment Card Industry Data Security Standard (PCI DSS) and AWS Foundational Security Best Practices (AWS FSBP) on the AWS Cloud using AWS CloudFormation templates.

When migrating workloads to AWS, customers face numerous challenges to comply with established security and regulatory controls. Compliance is a multi-step process that checks security best practices and regulatory requirements, individual policy definitions, configuration and execution of complex remediation workflows, and exception procedures. Furthermore, remediation of security issues may require extensive hands-on experience with multiple AWS services and resources. Manual remediation is error prone and increases risk and operational costs.

This Quick Start uses AWS CloudFormation templates to deploy automated workflows to remediate deviations from PCI DSS 3.2.1 and AWS FSBP.

With this deployment, AWS Security Hub continuously evaluates your AWS resources against the PCI DSS and AWS FSBP controls. Security Hub processes and prioritizes security check findings using the AWS Security Finding Format (ASFF). Deviations from security controls invoke an automated process of remediation using AWS Systems Manager runbooks.

Each of the PCI DSS and AWS FSBP standards sets are deployed from separate templates. Links to deploy them are provided in the Deployment steps section, later in this guide. The following Coverage section lists the controls that are deployed with each set. For more information about the services and resources deployed by this Quick Start, see the Architecture section, later in this guide.

You are responsible for the cost of the AWS services and any third-party licenses used while running this Quick Start. There is no additional cost for using the Quick Start.

The AWS CloudFormation templates for Quick Starts include configuration parameters that you can customize. Some of the settings, such as the instance type, affect the cost of deployment. For cost estimates, see the pricing pages for each AWS service you use. Prices are subject to change.

No software licenses are necessary to use this Quick Start.

You are responsible for the cost of the AWS services used while running this Quick Start reference deployment. There is no additional cost for using the Quick Start.

Deploying this Quick Start builds the following environment in the AWS Cloud.

As shown in Figure 1, the Quick Start sets up the following:

Security Hub begins running security checks within two hours after you deploy PCI DSS and AWS Foundational Security Best Practices controls. After the initial check, subsequent checks occur on a periodic or change-triggered basis, depending on the control. For more information, see Schedule for running security checks. Follow the steps in this section to test the deployment.

The following steps test remediation of the PCI EC2.2 control. This control states that the VPC default security group should prohibit inbound and outbound traffic, and it is evaluated on a change-triggered basis. To test it, purposefully misconfigure security group settings in the Amazon EC2 console to allow inbound traffic. This should trigger a Security Hub finding which remediates the security issue by undoing the misconfiguration in the console.

AWS categorizes each Security Hub service action into one of five access levels: List, Read, Write, Permissions management, or Tagging. To allow a large group of users to access List and Read Security Hub actions, and only a small group to access Write action, use managed IAM policies. For more information, see Security best practices in IAM.

Security Hub ingests findings generated from integrated providers (both third-party services using AWS Security Finding Format (ASFF).

This Quick Start follows security best practices and guidelines as documented in Security in AWS Security Hub.

Q. I encountered a CREATE_FAILED error when I launched the Quick Start.

A. If CloudFormation fails to create the stack, we recommend that you relaunch the template with Rollback on failure set to Disabled. (This setting is under Advanced on the Options page of the AWS CloudFormation console.) With this setting, the stack’s state is retained and the instance remains running so you can troubleshoot the issue.

For more information, see Troubleshooting AWS CloudFormation.

Q. I encountered a size limitation error when I deployed the CloudFormation templates.

A. We recommend that you launch the Quick Start templates from the links in this guide or from another S3 bucket. If you deploy the templates from a local copy on your computer or from a location other than an S3 bucket, you might encounter template size limitations. For more information, see AWS CloudFormation quotas.

To post feedback, submit feature ideas, or report bugs, use the Issues section of the GitHub repository for this Quick Start. To submit code, see the Quick Start Contributor’s Guide.

See the AWS Quick Start home page.

Visit our GitHub repository to download the templates and scripts for this Quick Start, to post your comments, and to share your customizations with others.

This document is provided for informational purposes only. It represents AWS’s current product offerings and practices as of the date of issue of this document, which are subject to change without notice. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS’s products or services, each of which is provided “as is” without warranty of any kind, whether expressed or implied. This document does not create any warranties, representations, contractual commitments, conditions, or assurances from AWS, its affiliates, suppliers, or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.

The software included with this paper is licensed under the Apache License, version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at http://aws.amazon.com/apache2.0/ or in the accompanying "license" file. This code is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either expressed or implied. See the License for specific language governing permissions and limitations.