PCI DSS Security Maturity Model·AWS v1.0.0
Home / Matrix / Requirement 4 / r4.1
Quick Wins Data Protection 👤 Customer

r4.1 Enforce strong TLS on public endpoints (ALB, CloudFront, API Gateway)

Ensure all PAN transmitted over open, public networks is protected with strong cryptography by enforcing TLS 1.2+ and modern security policies at public entry points.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

AWS services

AWS Certificate Manager Elastic Load Balancing Amazon CloudFront Amazon API Gateway AWS Config

Requirement 4

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

PCI sub-requirements covered

  • 4.2 PAN is protected with strong cryptography during transmission

How to implement on AWS

Provision certificates with AWS Certificate Manager (ACM). Configure TLS 1.2/1.3 security policies on ALB, CloudFront, and API Gateway. Redirect HTTP to HTTPS. Disable weak protocols and ciphers. Detect non-compliant listeners with AWS Config and Security Hub (ELB.*, CloudFront.* controls).

Practical implementation

How this control is implemented in each reference architecture:

Terminate TLS 1.2+ at the ALB (and CloudFront if used) in front of the web tier with ACM certificates; redirect HTTP to HTTPS and disable weak ciphers. AWS Config/Security Hub flag non-compliant listeners.

Single-account, 3-tier →

Standardize the TLS security policy and ACM issuance pattern across CDE accounts, and enforce HTTPS-only listeners with a Config conformance pack on the PCI OU; public entry points may be fronted by a shared CloudFront/edge in the network account.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine system configurations to verify strong cryptography and security protocols are implemented per the requirement (4.2.1.b).
  • Examine cardholder data transmissions to verify all PAN is encrypted with strong cryptography over open, public networks (4.2.1.c).
  • Examine system configurations to verify that keys/certificates that cannot be verified as trusted are rejected (4.2.1.d).

Evidence in AWS

  • TLS security policies configured on ALB/CloudFront/API Gateway (TLS 1.2+).
  • Valid certificates managed in ACM.
  • Resolved Security Hub findings on TLS/HTTPS (e.g. ELB.1, CloudFront.3).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 4.2 — Cleartext PAN cannot be read or intercepted from any transmissions over open, public networks.

Learning resources

References

  • AWS Security Maturity Model: Encryption in transit