You inspired me to directly confront Amazon on where they stand with PCI compliance which led to Amazon confirming that you cannot in fact be PCI Level 1 compliant using AWS services:

http://developer.amazonwebservices.com/connect/thread.jspa?threadID=34960

Some highlights:

“It is possible for you to build a PCI level 2 compliant app in our AWS cloud using EC2 and S3, but you cannot achieve level 1 compliance.”

“we recommend that you do not store sensitive credit card payment information in our EC2/S3 system because it is not inherently PCI level 1 compliant”

2nd response:

“We do not and will not provide a written agreement attesting compliance and assuming responsibility for cardholder data.”

“we recommend customers not to store sensitive credit card payment information on EC2/S3 systems as they are not inherently PCI level 1 compliant”

http://developer.amazonwebservices.com/connect/entry!default.jspa?categoryID=152&externalID=1697

We are not aware of the of any timelines or of the certification completion date.

Requirement 12.8.2 Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess.

Testing Procedure12.8.2 Verify that the written agreement includes an acknowledgement by the service providers of their responsibility for securing cardholder data.

Reference: https://www.pcisecuritystandards.org/security_standards/download.html?id=pci_dss_v1-2.pdf page 56

A service provider is defined as
“Service Provider Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities. Entities such as telecommunications companies that only provide communication links without access to the application layer of the communication link are excluded.”

Reference: https://www.pcisecuritystandards.org/pdfs/pci_dss_glossary.pdf page 12

I am not a lawyer but Amazon does not provide any written guarantee to the above affect.

See another blog discussion
http://www.mckeay.net/2008/11/02/pci-compliance-in-the-cloud-get-it-in-writing/

I don’t think any other general Cloud company provides the above guarantee. So the solution to look for SaaS PCC DSS client service rather than running your own service in the cloud infrastructure.

I am looking at how to get a company PCI DSS compliant.

This seems like a big headache for companies who want to offer card payment options to customers – I am a cloud advocate so I was wondering if there are any ‘all in one’ cloud services a company could subscribe to to manage card payments so that no cardholder data is required to be stored at the company and the cloud provider can meet the PCI CSS requirements?

I envision embedding a card payment service in to whatever webapp triggers the need to collect some card holder data.

Apologies if I am a little ignorant – I am new to the PCI DSS reqs and the technology to meet them

thanks
Demi