r3.1 Enable encryption at rest by default (EBS, S3, RDS)
Turn on default encryption at rest for the storage services that may hold account data, rendering PAN unreadable wherever it is stored. This is a high-impact quick win enabled at the account/Region level.
AWS services
AWS KMS 
Amazon EBS 
Amazon S3 
Amazon RDS 
AWS Config Requirement 3
Protect Stored Account Data
PCI sub-requirements covered
- 3.5 PAN is secured wherever it is stored
How to implement on AWS
Enable EBS default encryption at the Region level. Apply encryption on S3 buckets (SSE-KMS) and block unencrypted objects via policy. Enable encryption on RDS/Aurora at instance creation. Use AWS KMS with customer managed keys (CMKs) for the CDE. Detect unencrypted resources with AWS Config.
Practical implementation
How this control is implemented in each reference architecture:
Enable EBS default encryption for the Region and turn on SSE-KMS on the S3 buckets and RDS instances in the data tier, using a customer managed KMS key scoped to the CDE. AWS Config flags any unencrypted volume, bucket, or database.
Single-account, 3-tier →Set encryption-by-default guardrails across the PCI OU with SCPs (deny creating unencrypted EBS/RDS/S3) and a Config conformance pack, so every CDE account enforces encryption at rest consistently; KMS keys stay per-account for blast-radius isolation.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine documentation about the system used to render PAN unreadable (vendor, type, algorithms) to verify PAN is rendered unreadable by an approved method (3.5.1.a).
- Examine data repositories and audit logs, including payment application logs, to verify PAN is rendered unreadable wherever stored (3.5.1.b).
- If disk/partition-level encryption is used, verify logical access is managed independently of the OS authentication and that access is separated (3.5.1.2, 3.5.1.3).
Evidence in AWS
- EBS default-encryption configuration enabled in the Region.
- S3 bucket policies and active SSE-KMS encryption.
- AWS Config report of encrypted storage resources (encrypted-volumes, rds-storage-encrypted, s3-bucket-server-side-encryption-enabled).
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 3.5 — Cleartext PAN cannot be read from storage media.
Learning resources
- Amazon EBS encryption (doc)
References
- AWS Security Maturity Model: Encryption at rest