DMZ is properly configured between CDE and internet

PCI-DSS 4.0 Req 1.3 requires that direct connections between the internet and CDE components are prohibited; Req 1.5 requires that risks from devices connecting to both untrusted networks and the CDE are addressed. Without a DMZ or filtering layer, internet traffic reaches CDE resources in one hop — a malformed webhook payload or HTTP flood hits the database network directly. CWE-668 (Exposure of Resource to Wrong Sphere) captures exactly this architecture gap. NIST SC-7 requires boundary protection at network perimeters. A WAF or reverse proxy in the DMZ also enforces rate limiting, which blocks credential-stuffing and payment enumeration attacks before they reach business logic.

Place a WAF or reverse proxy (AWS WAF + ALB, Cloudflare, nginx) between the internet and your payment webhook receivers. Configure rate limiting at the DMZ layer, not in application code alone, so volumetric attacks are blocked before they consume compute resources.

resource "aws_wafv2_web_acl" "dmz" {
  name  = "payment-dmz-waf"
  scope = "REGIONAL"
  default_action { allow {} }
  rule {
    name     = "RateLimit"
    priority = 1
    action   { block {} }
    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimit"
      sampled_requests_enabled   = true
    }
  }
}

Document the DMZ boundary in docs/cde-architecture.md with a network diagram showing traffic flows from the internet through the DMZ to the application tier.