r10.2 Centralize and protect logs against tampering
Protect audit logs against unauthorized modification or deletion and retain them per the required period (at least 12 months, with 3 months immediately available).
AWS services
AWS CloudTrail 
Amazon S3 
AWS KMS 
Amazon CloudWatch Logs Requirement 10
Log and Monitor All Access to System Components and Cardholder Data
PCI sub-requirements covered
- 10.3 Audit logs are protected from destruction and unauthorized modifications
- 10.5 Audit log history is retained and available for analysis
How to implement on AWS
Enable CloudTrail log file validation. Apply S3 Object Lock (WORM) and restrictive policies on the log bucket, with limited access in a dedicated account. Encrypt logs with KMS. Define S3 Lifecycle for retention >= 12 months (Glacier for archival, with 3 months immediately available).
Practical implementation
How this control is implemented in each reference architecture:
Enable CloudTrail log file validation, apply S3 Object Lock (WORM) and a restrictive bucket policy, encrypt with KMS, and set Lifecycle for >=12 months retention in the account.
Single-account, 3-tier →Centralize all audit logs in the dedicated log-archive account with Object Lock, KMS, and access restricted even from the rest of the org, giving tamper-resistant, consolidated retention across every CDE account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine configurations and privileges to verify read access to audit logs is limited to those with a job-related need and that logs are protected from modification (10.3.1, 10.3.2).
- Examine backup configurations to verify logs are promptly backed up to a secure central server difficult to modify, with file integrity/change detection in use (10.3.3, 10.3.4).
- Examine retention configurations to verify audit log history is retained at least 12 months with the most recent 3 months immediately available (10.5.1.b, 10.5.1.c).
Evidence in AWS
- CloudTrail log file validation enabled.
- S3 Object Lock (WORM) and log bucket policy with restricted access.
- S3 Lifecycle rules evidencing retention >= 12 months and KMS encryption.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 10.3 — Stored activity records cannot be accessed by unauthorized personnel and are protected from destruction and unauthorized modification.
- 10.5 — Historical records of activity are available immediately to support incident response and are retained for at least 12 months.
Learning resources
References
- AWS Security Maturity Model: Centralized logging
- PCI DSS v4.0.1 Requirements 10.3, 10.5