A PCI DSS-Aligned Cloud Workstations Foundation

An enterprise preparing for PCI DSS Level 1 needed developers to work inside controlled Google Cloud environments so cardholder-adjacent data would not be stored on local endpoints. We designed the technical foundation to support QSA review without claiming a certification outcome.

Architecture diagram showing developers accessing private Google Cloud Workstations built from hardened Ubuntu images, with Shielded VMs, customer-managed encryption keys, Shared VPC, Terraform modules, and services mapped for QSA review.

AWS Advanced Tier Partner★ 4.9/5 on Clutch (9 reviews)Replies within 1 business day

Private workstationsShielded VMs and CMEKTerraform control modules

The Challenge

The organization needed consistent developer workspaces inside a controlled cloud boundary rather than relying on varied local environments for work near cardholder data.

The design also had to document how workstation, network, encryption, logging, and access controls mapped to PCI DSS responsibilities before QSA pre-assessment and review.

What We Built

Hardened Ubuntu Workstation Images

We built custom Ubuntu 24.04 workstation images on Google's base image, removed unnecessary packages, added auditd, AIDE, and ClamAV, disabled USB storage, and moved repeatable setup into the image build.

Private and Protected Workstations

We designed Cloud Workstations without public IP addresses and added Shielded VMs with Secure Boot, virtual TPM, and integrity monitoring. Cloud KMS customer-managed encryption keys and idle timeouts added further data and session controls.

Shared VPC Network Design

We recommended and documented a Shared VPC model for the multi-team environment, including its boundaries and tradeoffs compared with isolated VPCs and peering.

Terraform Modules and Control Documentation

We delivered Terraform modules alongside console-path documentation and mapped relevant controls to Google Cloud services such as Cloud Audit Logs, Security Command Center, VPC Service Controls, DLP, and MFA enforcement.

QSA Review Preparation

We documented an implementation sequence through QSA pre-assessment and review, anchored the design to Google's PCI responsibility matrix, and made clear which responsibilities remained with the organization.

The Result

The organization received a PCI DSS-aligned workstation design built around private Google Cloud environments and hardened, repeatable Ubuntu images.
Shielded VM controls, customer-managed encryption keys, idle timeouts, and private networking were incorporated into the workstation foundation.
Terraform modules, console implementation paths, and control mapping documentation gave the team artifacts designed to support QSA review. Formal compliance and audit conclusions remain the responsibility of the organization and its assessor.

Technology

Google CloudCloud WorkstationsUbuntu 24.04Artifact RegistryShared VPCShielded VMsCloud KMSTerraformCloud Audit LogsSecurity Command Center

Planning a similar platform?

Share the constraint behind your cloud, delivery, Kubernetes, or compliance project. We will confirm fit and identify three useful priorities for the first conversation.

Book an AWS review

Explore More Services

AWS Cloud Infrastructure Cloud Architecture Advisory DevOps and CI/CD Kubernetes and Amazon EKS Security and Compliance AWS Cloud Migration Book an AWS review