r2.3 Encrypt and harden non-console administrative access
Ensure all non-console administrative access is encrypted with strong cryptography, avoiding insecure protocols and administrative access.
AWS services
AWS Systems Manager 
AWS KMS 
Amazon VPC Requirement 2
Apply Secure Configurations to All System Components
PCI sub-requirements covered
- 2.2 System components are configured and managed securely
How to implement on AWS
Eliminate administrative access over cleartext protocols. Use AWS Systems Manager Session Manager for administrative access with no open ports and no direct SSH/RDP, with encrypted and audited sessions. When SSH is required, enforce strong keys and algorithms.
Practical implementation
How this control is implemented in each reference architecture:
Replace SSH/RDP with Session Manager so administrative access is encrypted, logged, and needs no open inbound ports.
- Reach the app- and data-tier instances only through Systems Manager Session Manager, with the session encrypted using a KMS key.App tier (CDE) / Data tier (CDE) Systems Manager AWS KMS
- Log every session to CloudWatch Logs or S3 so administrative access is auditable.Account logging
CloudWatch 
Amazon S3 - Confirm the CDE security groups keep no inbound SSH (22) or RDP (3389) rules at all.App tier (CDE) / Data tier (CDE) Amazon VPC
How to validate: Session Manager is configured with KMS encryption and logging, session logs are present, and no security group allows inbound 22/3389.
Avoid: Keeping a 'break-glass' SSH bastion with an open port. Use Session Manager break-glass roles instead so no cleartext admin port is ever exposed.
Standardize encrypted, logged Session Manager access across the org and make cleartext admin protocols impossible by policy.
- Define a common Session Manager configuration (KMS key, logging destination) and distribute it to all CDE accounts.Security tooling account → PCI OU Systems Manager AWS KMS
- Deliver session logs centrally to the log-archive account for tamper-resistant retention.Log archive account Amazon S3
- Attach an SCP to the PCI OU that denies opening cleartext administrative protocols (e.g. authorizing inbound 22/3389) in any CDE account.PCI OU (guardrail)
AWS Organizations
How to validate: Session logs from every CDE account arrive in the log-archive account, and an SCP test blocks authorizing inbound SSH in a CDE account.
Avoid: Configuring Session Manager per account with inconsistent keys and log destinations. Standardize centrally so encryption and audit are uniform and provable.
PCI validation
Testing procedures
- Examine system configuration standards to verify they require encrypting all non-console administrative access using strong cryptography (2.2.7.a).
- Observe an administrator logging on and examine configurations to verify non-console administrative access is encrypted (2.2.7.b).
- Examine settings for system components and authentication services to verify insecure remote login services are not available for non-console administrative access (2.2.7.c).
Evidence in AWS
- SSM Session Manager configuration with KMS encryption and session logging.
- Session logs in CloudWatch/S3 evidencing audited administrative access.
- Absence of security group rules allowing cleartext administrative protocols.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 2.2 — All system components are configured securely and consistently and in accordance with industry-accepted hardening standards or vendor recommendations.
Learning resources
References
- AWS Security Maturity Model: Restrict administrative access