r3.3 Mask PAN when displayed
Mask PAN when displayed, showing at most the first six and last four digits, so that only personnel with a legitimate business need can see more.
AWS services
AWS Lambda 
Amazon API Gateway 
AWS IAM Requirement 3
Protect Stored Account Data
PCI sub-requirements covered
- 3.4 Access to displays of full PAN and the ability to copy PAN is restricted
How to implement on AWS
Implement masking at the application and API layer. Use tokenization where possible so that downstream applications never handle the full PAN. Record and control, via IAM/application, who has a need to view the full PAN.
Practical implementation
How this control is implemented in each reference architecture:
Implement PAN masking in the application tier and expose only masked PAN through the API; use IAM roles to gate the few operators who may view full PAN, and prefer tokenization so downstream services never handle full PAN.
Single-account, 3-tier →Apply the same masking/tokenization pattern in each CDE workload account; where a tokenization service is shared, host it in a dedicated account and grant cross-account access narrowly via IAM roles and data perimeters.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine documented policies to verify the roles that need to see more than the BIN and last four digits are listed with a legitimate business need (3.4.1.a).
- Examine system configurations to verify full PAN is only displayed for roles with a documented business need and masked for all others (3.4.1.b).
- Examine actual displays of PAN (screen, receipts) to verify PAN is masked and only authorized roles see more than BIN/last four (3.4.1.c).
Evidence in AWS
- Application screenshots/configuration showing masked PAN.
- IAM policies/application roles that limit access to the full PAN view.
- Definition of the masking logic in Lambda/API Gateway.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 3.4 — PAN cannot be viewed by anyone without a legitimate business need to see the full PAN, and cannot be copied or relocated by unauthorized personnel using remote-access technologies.
Learning resources
References
- PCI DSS v4.0.1 Requirement 3.4