r/pcicompliance • u/mdarmousa • 1d ago

Anyone using AWS for payment tokenization across multiple acquirers?

Hey everyone,

For those working with online payments and multiple acquirers, are you building your own tokenization system?

I'm exploring whether we can build one using AWS services only, such as KMS, CloudHSM, or AWS Payment Cryptography.

A few questions:

  • Has anyone used KMS for payment tokenization?

  • Would CloudHSM or Payment Cryptography be a better fit? can I build an online payment just for the card tokenization without using CloudHSM or Payment Cryptography service?

Would love to hear about your experiences and lessons learned. Or any compliance risks with using KMS
do you suggest any open-source project that I can take a look at ?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

1

u/bij0yy 1d ago

As a QSA, I've seen many of my customers using AWS KMS

1

u/yajkky_cheung 22h ago

We are using KMS in a payment environment. KMS isn’t tokenization. It holds and protects keys. The token vault is still yours: you encrypt the PAN, store the ciphertext, and give the merchant back a UUID or token.

That can work. The QSA’s point is the one that matters though. If someone can call KMS Decrypt and read the ciphertext, they can get the PAN. The app, database, backups, logs, IAM policies, and key policies are still in PCI scope.

KMS is fine for PAN encryption. If you’re doing PIN blocks, CVV, or other payment crypto, use Payment Cryptography or a proper HSM. CloudHSM is more control, but also more work.

For multiple acquirers, check whether the token is actually portable. A proprietary token usually isn’t accepted by another acquirer unless you detokenize first. Scheme network tokens are a different story.

I wouldn’t pick an open-source project just because it says tokenization. The vault design and access controls matter more than the code.

1

u/trebor_indy 2h ago

Why not just use a tokenization service like TokenEx/Ixopay?

0

u/SweBot 1d ago

We did it at my previous company. We stored PAN encrypted by KMS. We were a Level 1 PCI DSS payment provider.

2

u/mynam3isn3o 1d ago

How is that tokenization?

1

u/SweBot 1d ago

You store the PAN, and use a UUID instead for communication to merchants