PCI Requirement 7.1 focuses on a basic security principle: limit access based on business need to know. The PCI DSS defines “business need to know” as when access rights are granted to only the least amount of data and privileges needed to perform a job. AWS often refers to this as the “least privilege” principle. So, to protect cardholder data in your AWS environment, you are going to limit access to only those individuals whose job requires such access.

IAM Access Analyzer can be a useful tool for achieving compliance with PCI Requirement 7.1. Instead of wondering who has access to which resources, IAM Access Analyzer helps you identify the unintended access to your data and uses automated reasoning to determine other potential security risks.

To learn more about permissions management and least privilege, visit the AWS Well-Architected Framework. 

Requirement 7.1 in the PCI Data Security Standard has to do with establishing access rights to system resources that are based on a need to access those resources. This is based on the duties, roles, and responsibilities within your organization. Do the access levels align with the roles that have been established? When we work with our clients on this, we look at your policies and procedures, your job descriptions, what are the different groups that have been established within your organization? Are they administrators? Do they need privilege access or are they other types of workers who really only need specific access to certain resources? The way we prove this is by looking within your IAM roles. We’ll look for what users and groups you’ve established in there and what permissions you have assigned to those people. Do they align with what the roles are in the organization? 

One of the things that is very helpful in complying with 7.1 is the use of IAM Access Analyzer. It is a resource that AWS now provides that allows you to perform some automated analysis of the accounts that you’ve established to determine if they are appropriate for the roles that have been established. When we go in and see that the root account, for example, is being utilized, that’s something that should not be used except in the case of an extreme circumstance. So, evaluating those different roles - have they been used, who are they being used by, and is it appropriate for the role that the person is filling? These are all questions we will ask in order to help you comply with PCI Requirement 7.1.