r2.1 Remove default credentials and configurations
Change or remove all vendor-default passwords, accounts, and settings on system components before placing them into production. This is a direct quick win against well-known attack vectors.
AWS services
EC2 Image Builder 
AWS Secrets Manager 
AWS Systems Manager 
AWS Config Requirement 2
Apply Secure Configurations to All System Components
PCI sub-requirements covered
- 2.2 System components are configured and managed securely
How to implement on AWS
Use hardened base images (golden AMIs) built with EC2 Image Builder that contain no default credentials. Disable unused default accounts. Manage any required secrets in AWS Secrets Manager instead of embedded default values. Prohibit the use of default passwords through configuration controls.
Practical implementation
How this control is implemented in each reference architecture:
Build the app and data tier AMIs with EC2 Image Builder hardened pipelines that contain no vendor-default accounts or passwords; store any bootstrap secrets in Secrets Manager. Disable unused default OS accounts before the instance joins the CDE subnets.
Single-account, 3-tier →Centralize a golden-AMI pipeline in the shared services account and share hardened images to the CDE accounts via AWS RAM, so every PCI OU account starts from the same no-default baseline. An SCP can prevent launching images outside the approved, shared catalog.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine system configuration standards to verify they include managing vendor-default accounts, and examine vendor documentation and observe an admin logging on with vendor-default accounts (2.2.2.a, 2.2.2.b).
- Examine configuration files and interview personnel to verify that all unused vendor-default accounts are removed or disabled (2.2.2.c).
Evidence in AWS
- EC2 Image Builder recipes and hardening components with no default credentials.
- System account inventory showing default accounts disabled or removed.
- Documented configuration standards applied to the base AMIs.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 2.2 — All system components are configured securely and consistently and in accordance with industry-accepted hardening standards or vendor recommendations.
Learning resources
References
- AWS Security Maturity Model: Standard hardened images