r7.2 Centralize access with IAM Identity Center and role-based permissions
Manage access through a centralized access control system that covers all system components, with default-deny unless explicitly authorized.
AWS services
AWS IAM Identity Center 
AWS Organizations 
AWS IAM Requirement 7
Restrict Access to System Components and Cardholder Data by Business Need to Know
PCI sub-requirements covered
- 7.2 Access to system components and data is appropriately defined and assigned
- 7.3 Access is managed via an access control system(s)
How to implement on AWS
Adopt AWS IAM Identity Center with permission sets by job function, federated with the corporate IdP. Enforce a default-deny model reinforced with SCPs in AWS Organizations. Define data perimeters to limit access to CDE resources.
Practical implementation
How this control is implemented in each reference architecture:
Adopt IAM Identity Center with permission sets by job function, federated with your IdP, and apply data perimeters to restrict access to the CDE resources in the account.
Single-account, 3-tier →This is where multi-account shines: IAM Identity Center assigns permission sets across all accounts from one place, SCPs on the PCI OU enforce default-deny guardrails, and data perimeters keep CDE data reachable only from trusted identities/networks.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine vendor documentation and system settings to verify the access control system manages access for each component based on need to know and covers all system components (7.3.1).
- Verify the access control system enforces permissions by job classification and function (7.3.2).
- Verify the access control system is set to 'deny all' by default (7.3.3).
Evidence in AWS
- IAM Identity Center permission sets mapped to job functions.
- Organizations SCPs that enforce default-deny.
- Data perimeter configuration restricting access to the CDE.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 7.2 — Access requirements are established according to job functions following least-privilege and need-to-know principles.
- 7.3 — Access rights and privileges are managed via an access control system(s) that restricts access based on need to know and is set to deny by default.
Learning resources
References
- AWS Security Maturity Model: Federated identity
- PCI DSS v4.0.1 Requirement 7.3