r1.2 Limit network access to and from the CDE
Explicitly restrict inbound and outbound traffic of the cardholder data environment to the minimum required for business functions, applying a default-deny principle.
AWS services
Amazon VPC Network ACLs Security Groups Requirement 1
Install and Maintain Network Security Controls
PCI sub-requirements covered
- 1.3 Network access to and from the CDE is restricted
- 1.4 Network connections between trusted and untrusted networks are controlled
How to implement on AWS
Design dedicated subnets for the CDE with restrictive Network ACLs in addition to security groups. Document and justify every allowed rule. Use security groups with cross-group references instead of broad IP ranges. Restrict CDE outbound traffic to approved destinations.
Practical implementation
How this control is implemented in each reference architecture:
Give the data tier its own private subnets and a network ACL that only allows the database port from the app subnets and denies everything else. Keep an authorized-flow matrix that matches your security group and NACL rules, and restrict the data tier's outbound traffic to the specific endpoints it needs (e.g. Secrets Manager, KMS) via VPC endpoints.
Single-account, 3-tier →The CDE workload accounts under the PCI OU receive inbound only from the central network account's ingress path; east-west and egress traffic is forced through the inspection VPC. Default-deny is reinforced by SCPs, and VPC endpoints (kept in the shared network account) keep CDE traffic to AWS services off the public internet.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine NSC configuration standards and settings to verify that inbound traffic to the CDE is restricted to only what is necessary, with all other traffic specifically denied (1.3.1.a, 1.3.1.b).
- Examine NSC configurations to verify that outbound traffic from the CDE is restricted to only what is necessary (1.3.2.a, 1.3.2.b).
- Examine configuration standards and network diagrams to verify that NSCs are in place between trusted and untrusted networks (1.4.1.a, 1.4.1.b).
Evidence in AWS
- Network diagram and authorized-flow matrix that matches the implemented security group and NACL rules.
- Export of the CDE subnet Network ACLs showing default-deny rules.
- Business-justification records for each allowed rule.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 1.3 — Unauthorized traffic cannot enter the CDE.
- 1.4 — Unauthorized traffic cannot traverse network boundaries between trusted and untrusted networks.
Learning resources
References
- AWS Security Maturity Model: Limit Network Access