Yeah, we've seen that. That's what I was thinking of when I said Amazon said it was possible.
However, when it comes to actually doing that things seem a bit less clear. For instance, outbound filtering is a requirement, but Amazon just added that, so how did one satisfy that requirement before today?
would just running iptables on the instance suffice?
That could be what they had in mind. Our PCI guy tends to frown on that, though, because the purpose of restricting outbound access is so that if the machine does get compromised the bad guy can't ship off credit card information. If the outbound restriction is implemented on the machine, the bad guy might simply be able to turn them off.
It's possible that we've got an overly strict PCI guy.
Anyway, this particular issue appears dead now, as these new EC2 features add outbound filtering.
I don't think your PCI guy is overly strict. It's pretty clear that the intentions of the requirements are what you described. What might have worked, though, is to have virtual machines inside the EC2 instances in your VPC, and use this to filter traffic through a separate virtual machine.
Still, it's unnecessarily complicated and as you say, a resolved issue now. :) The new features announced fits PCI needs quite well. I haven't looked into the IDS issue you mentioned in your first post yet, but I hope it's possible to resolve somehow or get around with compensating controls.
(Disclaimer: I'm no PCI DSS expert, just an unlucky engineer trying to make a compliant system.)
A while back I recall Amazon saying that this was possible. We're looking into the possibility of moving to the cloud, and on first look our PCI guy saw some problems. We've just started experimenting so could easily have overlooked something, but these were the stumbling blocks we saw. It looks like these new features address 2 of these 3:
• PCI requires limitations be based on outbound traffic from the cardholder environment. Amazon only allowed inbound filtering. Now they have outbound filtering, so this may be no longer problematic.
• PCI requires internal machines to be placed on internal private networks using NAT. Amazon did not support NAT. Now they do, so this block may be gone.
• PCI requires that all traffic be monitored with an IDS in the cardholder data environment. It doesn't appear possible to do a central monitoring machine with IDS in EC2.