PCI DSS Security Maturity Model·AWS v1.0.0
Home / Matrix / Requirement 6 / r6.3
Foundational Application Security 🤝 Shared

r6.3 Protect public-facing web applications with AWS WAF

Protect public-facing web applications against attacks through an automated technical solution that detects and blocks web attacks (WAF), or through application security reviews.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: High Applies to CDE: Yes

AWS services

AWS WAF Amazon CloudFront AWS Shield Elastic Load Balancing

Requirement 6

Develop and Maintain Secure Systems and Software

PCI sub-requirements covered

  • 6.4 Public-facing web applications are protected against attacks

How to implement on AWS

Deploy AWS WAF on CloudFront/ALB/API Gateway with managed rules (Core rule set, SQLi, XSS). Enable WAF logging. Tune rules to reduce false positives. Combine with AWS Shield for DDoS mitigation. AWS WAF satisfies the automated technical solution option of 6.4.2.

Practical implementation

How this control is implemented in each reference architecture:

Attach AWS WAF (managed rule groups: core, SQLi, XSS) to the ALB/CloudFront in front of the web tier, enable WAF logging, and run it in blocking mode for the CDE.

Single-account, 3-tier →

Manage a shared AWS WAF web ACL and rule set with AWS Firewall Manager across the PCI OU, so every public-facing CDE app inherits the same tuned, logged protection automatically.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • For public-facing web applications, examine system configuration settings and audit logs and interview personnel to verify an automated technical solution that detects and prevents web-based attacks is in place per all elements of the requirement (6.4.2).

Evidence in AWS

  • AWS WAF web ACL associated with the public application with active managed rules.
  • AWS WAF logs in CloudWatch/S3 evidencing detection/blocking.
  • Rule configuration in blocking mode for the CDE.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 6.4 — Public-facing web applications are protected in real time against malicious attacks.

Learning resources

References

  • AWS Security Maturity Model: WAF with managed rules
  • PCI DSS v4.0.1 Requirement 6.4.2