aws-payment-cryptography-guide

Files (22)

• SKILL.md
• SKILL_ja.md
• acquirer.md · references/
• acquirer_ja.md · references/
• decision-tree.md · references/
• decision-tree_ja.md · references/
• external-resources.md · references/
• external-resources_ja.md · references/
• faq.md · references/
• faq_ja.md · references/
• issuer.md · references/
• issuer_ja.md · references/
• key-management.md · references/
• key-management_ja.md · references/
• migration-guide.md · references/
• migration-guide_ja.md · references/
• network-processor.md · references/
• network-processor_ja.md · references/
• pci-compliance.md · references/
• pci-compliance_ja.md · references/
• psp.md · references/
• psp_ja.md · references/

SKILL.md (first lines)

# AWS Payment Cryptography Guide — Agent Skill

## Purpose

This skill equips customers with comprehensive guidance for adopting, designing, and migrating to **AWS Payment Cryptography (APC)**.
It covers the full spectrum of payment processing roles—card issuers, merchant acquirers, payment service providers (PSPs), and network processors—providing architecture patterns, migration strategies, and operational best practices.

---

## Workflow

Follow these steps when handling a user query, and apply the
[Safety Guardrails](#safety-guardrails) at every step:

### Step 1 — Identify Business Type

Determine the user's business role from context:

| Business Type | Indicators |
|---|---|
| **Issuer** | Card issuance, PIN generation, ARQC validation, Select PIN, card personalization |
| **Acquirer** | Merchant acquiring, POS terminal management, PIN translation, P2PE |
| **PSP** | Payment gateway, multi-acquirer routing, tokenization, payment facilitation |
| **Network Processor** | Switch operations, network-level PIN translation, stand-in processing |
| **Unknown** | Insufficient context to classify — proceed to Step 4 |

### Step 2 — Load Role-Specific Reference

Once the business type is identified, load the corresponding reference file:

| Business Type | Reference File |
|---|---|
| Issuer | `references/issuer.md` |
| Acquirer | `references/acquirer.md` |
| PSP | `references/psp.md` |
| Network Processor | `references/network-processor.md` |

Use this file as the primary context for answering the user's question.

### Step 3 — Load Cross-Cutting Topics (as needed)

If the query involves topics that span multiple business types, additionally
load the relevant shared reference:

| Topic | Reference File |
|---|---|
| Key management, TR-31, TR-34, ECDH key exchange | `references/key-management.md` |
| PCI DSS / PCI PIN / PCI P2PE compliance | `references/pci-compliance.md` |
| Migration from on-premises HSMs to APC | `references/migration-guide.md` |
| External resources (documentation, blogs, samples) | `references/external-resources.md` |

### Step 4 — Initial Exploration / Overview

If the user's business type is unknown or the question is exploratory:

1. Load `references/faq.md` — covers common questions and an overview
2. Load `references/decision-tree.md` — provides a structured decision framework
   for selecting APC capabilities based on use case

Guide the user through clarifying questions to identify their business type
and specific needs.

### Step 5 — Compliance Disclaimer

**Always** include the following disclaimer when providing guidance related to
PCI compliance, security controls, or certification scope:

> ⚠️ **Disclaimer**: The guidance provided here is for informational and
> architectural planning purposes only. PCI DSS, PCI PIN, and PCI P2PE
> compliance requirements must be validated by the appropriate PCI SSC-qualified
> assessor: a Qualified Security Assessor (QSA) for PCI DSS, a Qualified PIN
> Assessor (QPA) for PCI PIN, or a P2PE Assessor for PCI P2PE.
> AWS Payment Cryptography is a PCI-certified service, but your overall
> compliance posture depends on your specific implementation.

---

## Safety Guardrails

Apply these rules in every interaction, regardless of business type:

1. **Never request or accept sensitive payment data** — Do not ask for, and do
   not accept, real PANs, PINs or PIN blocks, cleartext key material or key
   components, key blocks (e.g. TR-31/TR-34 payloads), or production key check
   values (KCVs). If the user pastes such data, stop working with it, advise
   the user not to share it, and recommend treating it as potentially exposed
   (e.g. rotating the affected keys according to their own key management
   procedures). Do not repeat the pasted values back.
2. **Use test values in examples** — Use test PANs, placeholder key ARNs (e.g.
   `arn:aws:payment-cryptography:us-east-2:111122223333:key/EXAMPLEKEYID0001`),
   and dummy values in all examples.
3. **CLI/SDK examples are for the user to review and run** — The agent must
   not execute AWS CLI or SDK commands against the user's AWS accounts on its
   own. Recommend that the user runs examples in non-production accounts first,
   using least-privilege or read-only credentials.
4. **Confirm destructive operations** — For destructive or disruptive
   operations such as `delete-key`, key usage changes (`stop-key-usage` /
   `start-key-usage`), alias changes (`update-alias` / `delete-alias`), or key
   imports that replace keys currently in use, explain the impact and obtain
   explicit user confirmation before proceeding.
5. **Key deletion is irreversible** — After the `delete-key` waiting period
   ends, the key is permanently deleted and data protected by it may become
   unrecoverable. Recommend `stop-key-usage` before scheduling deletion; see
   the `delete-key` caution in `references/external-resources.md`.

---

## File References

### references/

| File | Description |
|---|---|
| `issuer.md` | Card issuer patterns — PIN generation, ARQC/ARPC, card personalization |
| `acquirer.md` | Merchant acquirer patterns — PIN translation, P2PE, terminal integration |
| `psp.md` | PSP/gateway patterns — multi-acquirer routing, tokenization |
| `network-processor.md` | Network processor patterns — switch integration, stand-in processing |
| `key-management.md` | Key lifecycle management — TR-31, TR-34, ECDH, key hierarchy design |
| `pci-compliance.md` | PCI compliance mapping — DSS, PIN, P2PE scope reduction with APC |

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp