r7.3 Automated access review and refinement
Continuously optimize permissions by removing unused privileges and periodically validating that access remains aligned with business need.
AWS services
IAM Access Analyzer AWS IAM 
AWS CloudTrail Requirement 7
Restrict Access to System Components and Cardholder Data by Business Need to Know
PCI sub-requirements covered
- 7.2 Access to system components and data is appropriately defined and assigned
How to implement on AWS
Use IAM Access Analyzer to generate policies based on CloudTrail activity and detect unused permissions. Run periodic access reviews. Refine permission sets based on last-accessed information recommendations.
Practical implementation
How this control is implemented in each reference architecture:
Use IAM Access Analyzer policy generation from CloudTrail activity to right-size permissions, and run periodic access reviews within the account.
Single-account, 3-tier →Run access reviews and unused-access analysis org-wide from the delegated administrator, and refine permission sets in IAM Identity Center so the least-privilege baseline is tightened consistently across all CDE accounts.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine policies to verify a process is defined to review all user accounts and related access privileges, including third-party/vendor accounts (7.2.4.a).
- Interview personnel and examine documented results of periodic access reviews to verify assigned privileges remain appropriate and limited to business need (7.2.4.b).
Evidence in AWS
- Access Analyzer last-accessed reports and recommendations.
- Records of periodic access reviews and adjustments made.
- Policies generated from actual activity (CloudTrail).
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 7.2 — Access requirements are established according to job functions following least-privilege and need-to-know principles.
Learning resources
References
- PCI DSS v4.0.1 Requirement 7.2.4