r3.2 Minimize account data storage and do not retain SAD
Minimize stored account data by applying retention and purge policies, and ensure that sensitive authentication data (SAD) is not retained after authorization.
AWS services
Amazon Macie 
Amazon S3 
Amazon DynamoDB 
AWS Config Requirement 3
Protect Stored Account Data
PCI sub-requirements covered
- 3.2 Storage of account data is kept to a minimum
- 3.3 Sensitive authentication data (SAD) is not stored after authorization
How to implement on AWS
Define retention policies with S3 Lifecycle and DynamoDB TTL to purge account data when it is no longer needed. Avoid storing SAD (full track, CVV, PIN). Discover inadvertent storage of account data with Amazon Macie. Document the business justification, retention period, and secure deletion process.
Practical implementation
How this control is implemented in each reference architecture:
Apply S3 Lifecycle rules and DynamoDB TTL on the data tier to purge account data past its retention window, and run Amazon Macie in the account to confirm no SAD or stray PAN is stored.
Single-account, 3-tier →Run Macie from the delegated administrator in the security tooling account to scan S3 across all CDE accounts, and centralize retention/discovery findings in Security Hub; retention policies are deployed as code to each CDE account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine data retention and disposal policies and interview personnel to verify processes limit account data storage and retention to business/legal/regulatory needs (3.2.1.a); examine records to confirm stored amount and retention do not exceed the policy (3.2.1.b).
- Observe the mechanisms used to render account data unrecoverable (3.2.1.c).
- If SAD is received, examine policies, procedures, and configurations to verify SAD is not stored after authorization and is rendered unrecoverable (3.3.1.a, 3.3.1.b).
Evidence in AWS
- S3 Lifecycle / DynamoDB TTL policies configured for purging.
- Amazon Macie findings confirming absence of SAD and controlled PAN location.
- Documented account data retention and disposal policy.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 3.2 — Account data is retained only where necessary and for the least amount of time needed, and is securely deleted or rendered unrecoverable when no longer needed.
Learning resources
- What is Amazon Macie? (doc)
References
- AWS Security Maturity Model: Sensitive data discovery