Secure Software Development Lifecycle (SDLC) and CI/CD
The Software Development Lifecycle (SDLC) is a foundational control area aimed at ensuring that security is embedded into every phase of software development that processes, stores, or transmits cardholder data. PCI DSS requires organizations to define, implement, and maintain a structured development process that integrates security requirements from design through deployment and maintenance. This includes secure coding standards, threat modeling, code review practices, vulnerability management, and security testing such as static and dynamic analysis. The goal is to prevent common software vulnerabilities (e.g., injection flaws, insecure authentication, and misconfigurations) before applications are released into production environments.
In a cloud environment, the Software Development Lifecycle (SDLC) under PCI Security Standards Council means applying the same security-by-design principles but extending them across both application code and cloud infrastructure configuration. Instead of only securing traditional software artifacts, SDLC in cloud also includes securing Infrastructure as Code (IaC), CI/CD pipelines, container images, APIs, and cloud service configurations that interact with cardholder data environments (CDE).
SDLC and CI/CD within the AWS SRA
The AWS SRA provides foundational guidance for SDLC and CI/CD that directly supports key elements of PCI DSS:
Amazon Inspector in Security Tooling account is included as a vulnerability management service that continuously scans your AWS workloads for vulnerabilities and directly supports the PCI DSS requirement to identify and address security vulnerabilities in bespoke and custom software (Requirement 6.3.1). Inspector automatically rescans workloads when new packages are installed, patches are applied, or new CVEs are published, ensuring that known vulnerabilities are identified promptly. Inspector generates risk scores correlated with network accessibility and exploitability data, enabling prioritized remediation aligned with the risk-ranking requirement (Requirement 6.3.1). Amazon Inspector Code Security extends this capability into the development phase by performing SAST and SCA on source code repositories integrated with GitHub, providing two-way integration that suggests fixes as pull request comments. This supports the requirement to identify and address vulnerabilities during the software development process (Requirement 6.2.4).
AWS Identity and Access Management Access Analyzer in security tooling account is references as a security tool to efficiently set fine-grained permissions, verify intended permissions, and refine permissions by removing unused access, while also enabling automated IAM policy checks earlier in the development and deployment (CI/CD) process to adhere to corporate security standards, supporting the requirement that bespoke and custom software is developed securely with appropriate access controls (Requirement 6.2.4). The AWS SRA deploys IAM Access Analyzer at both the organization level (Security Tooling account) and account level (all member accounts), providing comprehensive policy validation coverage. Organizations can integrate IAM Access Analyzer custom policy checks with AWS CloudFormation to automate policy reviews within CI/CD pipelines.
SDLC and CI/CD beyond the AWS SRA
Some incremental enhancements may be needed to extend the AWS SRA for alignment with additional PCI DSS requirement elements:
Deploy Amazon Inspector Code Security for SAST/SCA in CI/CD pipelines: Configure Amazon Inspector CI/CD integration plugins for Jenkins, TeamCity, or equivalent build tools to assess container images and application code for software vulnerabilities during the build phase (Requirement 6.2.4). Inspector's CI/CD plugin can block builds or image pushes when critical vulnerabilities are detected, enforcing security gates before code reaches production. This does not require activating the full Amazon Inspector service and operates on AWS, on-premises, or hybrid environments. Configure scan triggers to execute on code changes, at scheduled intervals, and on demand. Integrate Inspector Code Security with GitHub repositories to enable SAST, SCA, and IaC scanning with automated pull request comments for identified vulnerabilities (Requirement 6.2.4). This addresses the requirement that bespoke and custom software is developed securely by identifying vulnerabilities before deployment.
Deploy AWS DevOps Agent for PCI-DSS Aligned SDLC and CI/CD Security Automation: An AWS DevOps Agent can play a key role in supporting a PCI DSS-aligned Secure Software Development Lifecycle (SSDLC) and CI/CD security reference architecture by acting as an automated enforcement and advisory layer across development pipelines. Within the context of PCI Security Standards Council requirements, the agent can continuously evaluate infrastructure-as-code templates, application code, and deployment configurations against predefined security baselines such as secure IAM policies, encryption standards, logging requirements, and network segmentation rules. It can integrate directly into CI/CD workflows to block or flag non-compliant builds before deployment, ensuring that security controls are enforced "shift-left" during development rather than validated after release. Additionally, the agent can correlate pipeline events with runtime security signals from tools like AWS Security Hub and AWS-native security services, enabling post-deployment verification that critical controls remain operational after each change. This approach supports continuous compliance, reduces manual audit overhead, and helps maintain a resilient, PCI DSS-compliant software delivery lifecycle in cloud-native environments.
Deploy AWS WAF with managed rule groups for OWASP Top 10 protection: Aligned with AWS SRA recommendation, to meet PCI DSS 6.4.1 requirement, configure AWS WAF web ACLs with AWS Managed Rules for common vulnerabilities including SQL injection, cross-site scripting (XSS), local file inclusion, and remote code execution to protect public-facing web applications that are part of the CDE. Enable the AWS WAF Bot Control managed rule group to detect and manage automated threats. Configure AWS Firewall Manager in the Security Tooling account to enforce consistent WAF policies across all Application accounts containing public-facing payment applications. Enable comprehensive WAF logging to Amazon S3 in the Log Archive account and configure Amazon CloudWatch metrics and alarms for anomalous traffic patterns. For organizations using the customized approach, deploy AWS WAF with custom rules that implement automated technical solutions to continuously detect and prevent web-based attacks specific to the application's attack surface (Requirement 6.4.2).
Implement script integrity management for payment page security: Configure Amazon CloudFront response headers policies to implement Content-Security-Policy (CSP) headers that restrict script execution sources on payment pages (Requirement 6.4.3). Deploy AWS WAF custom rules to monitor and block unauthorized script injection attempts on pages that render or process payment information. Use Amazon CloudWatch and Amazon EventBridge to alert on CSP violation reports, enabling detection of unauthorized script modifications. Note: AWS services support the technical enforcement mechanisms, but the customer retains responsibility for maintaining the script inventory, documenting justifications, and implementing the authorization process for script changes.
Deploy Amazon Inspector for vulnerability scanning of bespoke software: Enable Amazon Inspector network reachability assessments to identify unintended network paths to EC2 instances hosting bespoke applications within the CDE (Requirement 6.3.2). Configure Inspector to scan Lambda functions and layers for vulnerabilities in serverless application components. Enable CIS Benchmark assessments for operating system-level security validation on instances running custom applications. Integrate Inspector findings with AWS Systems Manager Automation for automated remediation of identified vulnerabilities, creating a continuous feedback loop between vulnerability detection and resolution.
