# Access Control and Identity Management
Access control and identity management form the cornerstone of protecting cardholder data environments from unauthorized access and insider threats, especially in the cloud where it can act as the primary security perimeter, replacing traditional network firewalls by defining who can access specific data, applications, and resources. PCI DSS Requirement 7 mandates restricting access to system components and cardholder data by business need to know, while Requirement 8 requires organizations to identify users and authenticate access to system components. In cloud environments, identity and access management services provide opportunities to implement least-privilege access controls, strong authentication mechanisms, and automated access reviews with greater consistency, auditability, and scalability.
## Access Control and Identity Management within the AWS SRA
AWS SRA provides foundational guidance for access control and identity management that directly supports key elements of PCI DSS:
Use AWS Identity and Access Management (IAM) to implement least-privilege access controls by creating fine-grained permissions that restrict access to AWS resources based on job functions. IAM supports [role-based access control](https://docs.aws.amazon.com/prescriptive-guidance/latest/saas-multitenant-api-access-authorization/access-control-types.html#rbac) (RBAC) and [attribute-based access contro](https://docs.aws.amazon.com/prescriptive-guidance/latest/saas-multitenant-api-access-authorization/access-control-types.html#abac)l (ABAC) patterns, allowing you to grant access based on user attributes such as department, job role, and team name. IAM policies include a default "deny all" as part of the policy evaluation logic, addressing Requirement 7.3.3 for deny-by-default access controls. You are responsible for defining IAM policies that follow the principle of least privilege (Requirement 7.2.2 and 7.2.5) and configuring IAM password policies to enforce minimum password length of 12 characters, password complexity, expiration of 90 days or less, and prevention of password reuse (Requirement 8.3 and 8.6.3). You can generate credential reports for users in their accounts to review who has been granted access to the environment and identify inactive accounts (Requirement 8.2.6). AWS manages the security of IAM as a service, while you are responsible for managing their IAM users, roles, policies, and credentials.
Enable AWS IAM Identity Center to centralize workforce identity management with single sign-on access across multiple AWS accounts within AWS Organizations. Identity Center integrates with external identity providers through SAML 2.0 or can use its own identity store, supporting Requirements 8.2 and 8.3 for centralized user authentication and management. Identity Center uses permission sets to define collections of policies that determine user access levels, supporting consistent application of least-privilege access controls across accounts (Requirement 7.2.2). Identity Center supports multi-factor authentication (MFA) enforcement, addressing Requirements 8.4 and 8.5. AWS manages the security of the MFA features as part of the Shared Responsibility Model and meets Requirement 8.5.1. You are responsible for configuring permission sets, enabling MFA requirements, and managing user lifecycle processes.
[Implement automated access reviews](https://aws.amazon.com/blogs/security/iam-access-analyzer-simplifies-inspection-of-unused-access-in-your-organization/) by configuring [AWS IAM Access Analyzer](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/security-tooling.html#tool-iam-analyzer) to generate least-privilege policy recommendations based on actual access activity. AWS IAM Access Analyzer continuously analyzes resource-based policies to identify resources that are shared with external entities or have overly permissive access. Access Analyzer helps you achieve least privilege by generating policy recommendations based on actual access activity logged in AWS CloudTrail, supporting Requirement 7.2.4 for access reviews and Requirement 7.2.2 and 7.2.5 for least-privilege access. Access Analyzer can identify unused access permissions, enabling you to refine policies and remove unnecessary permissions over time. AWS manages the Access Analyzer service, while you are responsible for reviewing findings and refining policies. Integrate with AWS Security Hub to aggregate access review findings across accounts. Generate access review reports documenting all users, their assigned roles, access levels, and last access dates, storing reports in Amazon S3 for audit purposes. This automation supports Requirement 7.2.4 for reviewing user access at least once every six months.
Leverage AWS Organizations with service control policies (SCPs) to establish organization-wide permission guardrails that apply to all IAM users and roles within member accounts. SCPs act as permission boundaries that define the maximum available permissions, supporting centralized enforcement of access control requirements across the multi-account environment (Requirement 7.3.3). SCPs can prevent accounts from disabling security services, restrict access to specific AWS Regions, or enforce MFA requirements for sensitive operations. AWS manages the Organizations service infrastructure, while you are responsible for defining and maintaining SCPs that align with their access control requirements.
Enable AWS Secrets Manager to securely store and manage database credentials, API keys, and other secrets with automatic rotation capabilities. Secrets Manager encrypts secrets at rest using AWS KMS and in transit using TLS, addressing Requirement 8.3.2 for secure credential storage and transmission. Secrets Manager integrates with AWS CloudTrail to log all API calls, providing an audit trail of credential access and rotation activities (Requirement 7.2.6). Secrets Manager supports automatic credential rotation for Amazon RDS, Amazon Redshift, and Amazon DocumentDB, reducing the risk of credential compromise. You can use Secrets Manager to ensure that application accounts for database applications cannot be used by individual users or other non-application processes, supporting Requirement 7.2.6 for database access controls. AWS manages the encryption and infrastructure security of Secrets Manager, while you are responsible for defining rotation schedules, access policies, and integration with their applications.
Integrate AWS CloudTrail with Amazon CloudWatch Logs to provide audit trails for all access management activities across AWS accounts. CloudTrail records API calls including IAM user and role activities, authentication events, and access to AWS resources, supporting Requirements 7.2.4 and 8.2 for accountability and access review. CloudTrail logs can be centralized in the Log Archive account as prescribed by the AWS SRA, enabling organization-wide visibility into access patterns. You can use CloudWatch Logs Insights or Amazon Athena to query CloudTrail logs for access investigations and compliance reporting. AWS manages the CloudTrail service infrastructure, while you are responsible for enabling CloudTrail in all accounts, configuring log retention, and analyzing logs for security events.
Add Config Rules in AWS Config to continuously monitor IAM configurations and detect drifts/changes from approved baselines and setup. Config Rules can validate that IAM password policies meet PCI DSS requirements (Requirement 8.3), that MFA is enabled for privileged users (Requirements 8.4 and 8.5), and that IAM policies follow least-privilege principles (Requirement 7.2.5). AWS Config can aggregate compliance data across accounts in AWS Organizations, providing centralized visibility into access control configurations. AWS manages the Config service, while you are responsible for defining Config Rules and remediating non-compliant configurations.
Deploy automated least-privilege validation by configuring AWS Config conformance packs with custom rules that validate IAM policies against least-privilege principles. Deploy Config Rules that detect overly permissive policies (such as policies with wildcard actions or resources), identify IAM users with direct policy attachments instead of group memberships, and flag policies that grant administrative access. Integrate findings with AWS Security Hub to correlate least-privilege violations with other security findings. Configure Amazon EventBridge rules to trigger AWS Lambda functions that generate remediation recommendations and notify security teams of policy violations. This automation supports Requirement 7.2.2 and 7.2.5 for implementing least-privilege access controls.
Implement database access control automation by deploying AWS Secrets Manager to store all database credentials with automatic rotation enabled. Configure Amazon RDS and Amazon Redshift to use IAM database authentication, enabling users and applications to authenticate using temporary credentials instead of database passwords. Use VPC security groups and network ACLs to restrict database access to only authorized application servers and administrative workstations. Deploy AWS Config to validate that databases are not publicly accessible, and that security groups follow least-privilege principles. Configure AWS CloudTrail to log all database authentication attempts and credential retrievals from Secrets Manager. This automation supports Requirement 7.2.6 for restricting database access to application accounts that cannot be used by individual users.
Configure session management controls by deploying AWS Systems Manager Session Manager to provide secure administrative access to Amazon EC2 instances without requiring SSH keys or open inbound ports. Configure Session Manager to enforce idle session timeouts, log all session activity to Amazon CloudWatch Logs and Amazon S3, and restrict session access based on IAM policies. For IAM Identity Center users, configure permission sets with maximum session durations to restrict the length of time users can be signed in to AWS accounts, supporting Requirement 8.2.7 for third-party access restrictions and Requirement 8.2.8 for idle session timeouts. You must also enforce 15-minute idle session timeouts at user workstations through their external identity provider or AWS Managed Microsoft Active Directory group policies.
## Access Control and Identity Management beyond the AWS SRA
Some incremental enhancements may be needed to extend the AWS SRA for alignment with additional PCI DSS requirement elements:
Reduce reliance on long-lived credentials by using IAM roles with [AWS Security Token Service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) (STS) to grant temporary, limited-privilege credentials. STS issues temporary security credentials that automatically expire, reducing the risk of credential compromise and supporting least-privilege access patterns (Requirements 7.2.2, 7.2.5, and 8.2). Programmatic access, including API calls to AWS services, should be performed with IAM roles using temporary credentials issued by STS rather than IAM user access keys. This approach eliminates the need for embedded credentials in application code and supports automated credential rotation. AWS manages the security of STS, while you are responsible for defining IAM role trust policies and permission policies.
AWS recommends not to use IAM users, however in case if you have to user IAM users for any reason you should implement password policy enforcement by configuring IAM password policies across all AWS accounts to enforce minimum password length of 12 characters, require uppercase and lowercase letters, numbers, and symbols, set password expiration to 90 days or less, and prevent reuse of the last four or more passwords (Requirement 8.3). For organizations using IAM Identity Center with an external identity provider, configure password policies in the identity provider to meet PCI DSS requirements. Deploy AWS Config to continuously validate that IAM password policies meet requirements and alert on non-compliant configurations. For IAM users determined to be in-scope for PCI DSS assessment, implement account lockout mechanisms through identity federation with an external identity provider or AWS Managed Microsoft Active Directory, as IAM does not natively support account lockouts (Requirement 8.3.4).
Deploy MFA enforcement automation by configuring IAM policies to enforce MFA requirements for AWS Management Console, AWS CLI, and API access (Requirements 8.4 and 8.5). Deploy AWS Config to detect IAM users without MFA enabled and automatically publish findings to AWS Security Hub. Configure Amazon EventBridge rules to trigger AWS Lambda functions that notify security teams when privileged users access the console without MFA. For IAM Identity Center, enable MFA enforcement in permission sets to require MFA for all user access. Deploy AWS Lambda functions to analyze AWS CloudTrail logs and detect authentication attempts without MFA, generating alerts through Amazon SNS for security team investigation. This automation supports Requirements 8.4 and 8.5 for multi-factor authentication.
Implement shared credential management by deploying AWS Secrets Manager to securely store any credentials that must be shared on an exception basis with documented business justification. Configure Secrets Manager to log all secret access activities to AWS CloudTrail, providing an audit trail of who accessed shared credentials and when. Implement approval workflows using AWS Lambda and Amazon SNS to require management approval before granting access to shared credentials. Store business justifications and approval records in Amazon S3 for audit purposes. This automation supports Requirement 8.2.2 for managing group, shared, or generic accounts with documented business justification and approval.