Web Hosting Talk : Web Hosting Main Forums : Cloud Hosting : PCI-DSS and FreeBSD on EC2

[Crashus]

Hello,

Maybe some of you guys know if Amazon providing Report of Compliance to their clients? I need to know is it possible to host pci-dss application on their cloud. Also I need to sign a contract with them in order to use them as pci-dss certified DC. Anyone did this before?

Also, just qurious - have anyone (except me and few other folks) user FreeBSD at EC2? It is already production-ready, still been created from windows instance so billed as windows one as well unfortunately. I tried to ask both questions to Amazon directly but no answer unfortunately.

[quantumphysics]

https://aws.amazon.com/security/pci-...mpliance-faqs/

Possible and fairly painless.

[Crashus]

Except what I asked was Report of Compliance

Maybe someone now Amazon employee contact so I can directly mail him?

[FastServ]

Amazon submits their reports directly to PCI not to you. When you fill out your PCI compliance questionnaire you will list AWS as your host. Unless amazon is actually processing payments for you (in a manner like Paypal where you redirect your users to their system for payment) you're still on your own to become PCI compliant yourself. You cannot rely on your host's compliance if you are processing/storing payments on your own unmanaged server instance.

[Crashus]

Randy,

Whenever I'm applying for PCI compliance I must ensure my QSA that I have my datacenter pci compliant (as DC, not as merchant) as well. For this purpose I need contract with them, and complete report

[quantumphysics]

What QSA? When I had to deal with PCI on AWS it was basically "we use aws ec2/s3 they're validated" "okay." without further issues.

Amazon can give you a signed email or something (PGP?) if you need it, whine at their support or on the AWS forums.

[Crashus]

Originally Posted by quantumphysics

What QSA? When I had to deal with PCI on AWS it was basically "we use aws ec2/s3 they're validated" "okay." without further issues.

Amazon can give you a signed email or something (PGP?) if you need it, whine at their support or on the AWS forums.

Have you received payment processor certificate?
Like this:
http://www.visaeurope.com/en/busines...providers.aspx

[Akisoft]

Not sure why you need a certificate from them, we listed them as an infrastructure provider and everything was fine.

[Crashus]

Can you guys PM me your certified processor sites and companies which were certifying you?
Thanks