Achieving PCI DSS Compliance Through AWS Cloud-Native Security

Overview

ImagineX partnered with a leading payment technology company to navigate the complexities of achieving and maintaining PCI DSS compliance in AWS. Leveraging expertise in cloud-native security and threat mitigation, ImagineX automated vulnerability management, secured remote engineer access, and hardened infrastructure through Infrastructure as Code.

Problem

• No structured framework for achieving PCI DSS compliance across AWS infrastructure

• EC2 instances lacked automated vulnerability management, creating critical and unpatched security exposure

• Remote engineer access was unsecured, and Security Groups were overly permissive

• Infrastructure changes were manual and inconsistent, lacking the auditability required for compliance

Solution

ImagineX implemented Qualys and AWS Systems Manager to automate vulnerability scanning and patch management across EC2 instances. Remote access was secured via AWS Client VPN integrated with Okta, centralized through a Transit Gateway. Security Groups were hardened to enforce least-privilege access, with compliance monitoring via Security Hub and Splunk, and all infrastructure managed through Terraform.

Outcome

• Successfully supported stakeholders in passing the PCI DSS audit across control areas 1.1, 1.2, 1.3, 6.1, 6.2, and 11.2

• Remediated 190 critical and 320 high vulnerabilities across all affected EC2 instances, including multiple zero-day vulnerabilities

• Enabled secure, authenticated remote access for 100+ engineers across 30 networks using Okta MFA and network-based authorization

Services Delivered

• Enterprise Cloud-Native Engineering

• Cloud Security

• PCI Compliance

Engagement Team

• Engagement Lead

• Cloud Security Architect

• DevSecOps Engineer

• Delivery Manager

Technologies Used

• Atlassian Jira

• Qualys

• AWS

• Slack

• Splunk

• HCP Terraform

• Okta