A House of Cards (of Credit) in the Cloud
summary
A description of a PCI‑DSS level 1 payment platform deployed entirely on AWS public cloud using isolated AWS accounts with a central control plane and consolidated logging. It explains an automated CI/CD pipeline built with Jenkins and Ansible (dynamic inventory, account-tagged, planet‑named stacks and per‑stack tear‑down), immutable nightly images, automated testing, per‑account HSMs, and enforcement of system‑user‑only access so changes occur only via the pipeline.
AI-written summary · about
chapters (12)
- 0:00PCI DSS introduction
- 3:03PCI DSS principles
- 7:43Cloud provider choice
- 12:23Account organization
- 16:39Resource naming
- 19:52Immutable images
- 23:31Stack promotion
- 27:49HSM and config lifecycle
- 28:35Terraform vs Kubernetes
- 30:21The Box manual
- 31:04Config management
- 32:52Final thoughts
related talks
40mInfrastructure as Code in the Wild
34mPCI and Politics
05mAchieving PCI Compliance On a Single Foundation
49mPublic cloud in regulated industry, not just swipe of a cred
53mFuture Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security
12mCloud Security from Scratch
16mBuilding PCI-compliant real-time payment processing with AsapCard
45mSecurity Lessons Learned Moving a Bank 100% in the Cloud