4

I'm new to the PCI world, but need to research ETL (extract-transform-load) solutions for my team to move data from one place to another. I looked in amazon's list of PCI DSS compliant resources, and I noticed Glue is not there. Does this mean Glue should not be used when there is a need for PCI DSS compliance? or does it not need to be because its not storing data, just transforming the data and loading data into an RDS data store?

UPDATE: Glue is now PCI-compliant.

Improve this question

2 Answers 2

Reset to default
5

As per the PCI tab in AWS Services in Scope by Compliance Program Glue is not PCI compliant.

I'm not an auditor but I assume processing credit card data on non-PCI-compliant service is not permitted, even if it's not stored there. I guess in cases like this better be safe than sorry and use only compliant services to cover your back side.

That's what I would do anyway ;)

Improve this answer
3
  • 1
    thanks. I saw and referenced that same list. I was hoping to see it there without a check mark. but it was completely absent making me question whether this was just an out-of-date list or if glue just isn't compliant. But I agree on erring on the side of caution. If I can't get a definitive answer, I won't use it.
    – JonTroncoso
    Nov 7, 2018 at 10:04
  • 1
    You are correct. I have confirmation from the paid AWS technical support: >>> Regarding the first question, as you have correctly pointed out from the docs Glue and Data pipeline service are not yet PCI compliant. I regret the inconvenience that this may cause and I am afraid that I cannot provide an ETA when these services will be PCI compliant.
    – JonTroncoso
    Nov 13, 2018 at 20:01
  • UPDATE: In case you missed Aleksi's answer, Glue is now PCI compliant and on the list I linked in the original question
    – JonTroncoso
    Mar 13 at 21:08
2

Just to update anyone else wandering in here: At least at the time of writing Glue is PCI compliant, as per AWS' own documentation. The page I linked lists all AWS services which are in PCI scope, and AWS Glue is among them.

Improve this answer
3
  • please share the relevant details as a citation and use the link as a reference, in the current point, it may answer the question but it is just an link only answer
    – djdomi
    Feb 27 at 19:25
  • Thanks for the suggestion. I commented a bit more on what's behind the link, but it is literally a list of PCI compliant AWS services maintained by AWS itself, and the only thing to cite about AWS Glue there is a checkmark.
    – Aleksi
    Feb 28 at 20:22
  • Glue is a fairly simple ETL product. Glue has detection tools for sensitive data. Which is fairly attractive on its own. aws.amazon.com/about-aws/whats-new/2023/11/…
    – Greg Askew
    Feb 28 at 22:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .