How I Built a PCI-Ready Merchant Onboarding API on AWS for Under $5/Month

This post details building a serverless merchant onboarding API on AWS that meets PCI DSS compliance requirements for under $5/month. It covers architecture decisions including JWT validation at API Gateway, customer-managed KMS keys for DynamoDB and S3 encryption, and CloudTrail for audit logging. Key security choices are explained with their compliance rationale, such as enforcing authentication before Lambda invocation and using customer-managed keys to produce auditable key usage evidence.