AWS Payment Cryptography Guide — Agent Skill
Purpose
This skill equips customers with comprehensive guidance for adopting, designing, and migrating to AWS Payment Cryptography (APC).
It covers the full spectrum of payment processing roles—card issuers, merchant acquirers, payment service providers (PSPs), and network processors—providing architecture patterns, migration strategies, and operational best practices.
Workflow
Follow these steps when handling a user query:
Step 1 — Identify Business Type
Determine the user's business role from context:
| Business Type |
Indicators |
| Issuer |
Card issuance, PIN generation, ARQC validation, Select PIN, card personalization |
| Acquirer |
Merchant acquiring, POS terminal management, PIN translation, P2PE |
| PSP |
Payment gateway, multi-acquirer routing, tokenization, payment facilitation |
| Network Processor |
Switch operations, network-level PIN translation, stand-in processing |
| Unknown |
Insufficient context to classify — proceed to Step 4 |
Step 2 — Load Role-Specific Reference
Once the business type is identified, load the corresponding reference file:
| Business Type |
Reference File |
| Issuer |
references/issuer.md |
| Acquirer |
references/acquirer.md |
| PSP |
references/psp.md |
| Network Processor |
references/network-processor.md |
Use this file as the primary context for answering the user's question.
Step 3 — Load Cross-Cutting Topics (as needed)
If the query involves topics that span multiple business types, additionally
load the relevant shared reference:
| Topic |
Reference File |
| Key management, TR-31, TR-34, ECDH key exchange |
references/key-management.md |
| PCI DSS / PCI PIN / PCI P2PE compliance |
references/pci-compliance.md |
| Migration from on-premises HSMs to APC |
references/migration-guide.md |
| External resources (documentation, blogs, samples) |
references/external-resources.md |
Step 4 — Initial Exploration / Overview
If the user's business type is unknown or the question is exploratory:
- Load
references/faq.md — covers common questions and概要
- Load
references/decision-tree.md — provides a structured decision framework
for selecting APC capabilities based on use case
Guide the user through clarifying questions to identify their business type
and specific needs.
Step 5 — Compliance Disclaimer
Always include the following disclaimer when providing guidance related to
PCI compliance, security controls, or certification scope:
⚠️ Disclaimer: The guidance provided here is for informational and
architectural planning purposes only. PCI DSS, PCI PIN, and PCI P2PE
compliance requirements must be validated with a Qualified Security Assessor
(QSA) or Payment Card Industry Forensic Investigator (PFI) as appropriate.
AWS Payment Cryptography is a PCI-certified service, but your overall
compliance posture depends on your specific implementation.
File References
references/
| File |
Description |
issuer.md |
Card issuer patterns — PIN generation, ARQC/ARPC, card personalization |
acquirer.md |
Merchant acquirer patterns — PIN translation, P2PE, terminal integration |
psp.md |
PSP/gateway patterns — multi-acquirer routing, tokenization |
network-processor.md |
Network processor patterns — switch integration, stand-in processing |
key-management.md |
Key lifecycle management — TR-31, TR-34, ECDH, key hierarchy design |
pci-compliance.md |
PCI compliance mapping — DSS, PIN, P2PE scope reduction with APC |
migration-guide.md |
Migration strategies — phased migration from on-premises HSMs |
external-resources.md |
Curated links — official docs, blog posts, sample code, pricing |
faq.md |
Frequently asked questions — overview, pricing model, regional availability |
decision-tree.md |
Decision framework for selecting APC capabilities by use case |
Response Guidelines
- Be specific to the user's role — Tailor recommendations to their
business type rather than providing generic guidance.
- Reference AWS documentation — Link to official AWS docs when available.
- Provide code examples — Include AWS CLI or SDK snippets where helpful.
- Highlight regional considerations — Note APC regional availability
when relevant to architecture decisions.
- Security-first — Always prioritize security best practices; never
suggest shortcuts that compromise key security or compliance posture.
- Migration pragmatism — Acknowledge that migration is incremental;
support hybrid architectures during transition periods.
Notes
- Language: This skill operates in English only. The agent loads the
English
.md reference files. The *_ja.md files are standalone Japanese
reference translations for human readers; they are not loaded or routed to
by this skill and are not guaranteed to track the English files.
- Verify volatile facts before quoting: pricing, throughput quotas, SLA
figures, certified Regions, and API/CLI details change over time. Do not
present hardcoded numbers from the reference files as current fact — confirm
against the latest AWS documentation, pricing page, Service Quotas, and AWS
Artifact before relying on them in a decision.
- This skill does not replace AWS documentation or AWS Support. For service
limits, SLA details, or account-specific issues, direct users to the
appropriate AWS channels.
- APC features and availability evolve; always verify current capabilities
against the latest AWS documentation.
1---2name: aws-payment-cryptography-guide3description: Covers AWS Payment Cryptography (APC) adoption, design, and migration support for issuers, acquirers, PSPs, and network processors. Provides architectural guidance on HSM migration, PIN verification, PIN translation, key management, card issuance, merchant acquiring, and payment gateway integration. Includes PCI compliance considerations, cryptographic protocol references (DUKPT, TR-31, TR-34, ECDH), and decision frameworks for selecting APC capabilities. Trigger keywords: "Payment Cryptography", "HSM migration", "PIN verification", "PIN translation", "DUKPT", "TR-31", "TR-34", "ARQC", "CVV", "P2PE", "Select PIN", "ECDH", "card issuance", "merchant acquiring", "payment gateway"4license: MIT No Attribution5---67# AWS Payment Cryptography Guide — Agent Skill89## Purpose1011This skill equips customers with comprehensive guidance for adopting, designing, and migrating to **AWS Payment Cryptography (APC)**.12It covers the full spectrum of payment processing roles—card issuers, merchant acquirers, payment service providers (PSPs), and network processors—providing architecture patterns, migration strategies, and operational best practices.1314---1516## Workflow1718Follow these steps when handling a user query:1920### Step 1 — Identify Business Type2122Determine the user's business role from context:2324| Business Type | Indicators |25|---|---|26| **Issuer** | Card issuance, PIN generation, ARQC validation, Select PIN, card personalization |27| **Acquirer** | Merchant acquiring, POS terminal management, PIN translation, P2PE |28| **PSP** | Payment gateway, multi-acquirer routing, tokenization, payment facilitation |29| **Network Processor** | Switch operations, network-level PIN translation, stand-in processing |30| **Unknown** | Insufficient context to classify — proceed to Step 4 |3132### Step 2 — Load Role-Specific Reference3334Once the business type is identified, load the corresponding reference file:3536| Business Type | Reference File |37|---|---|38| Issuer | `references/issuer.md` |39| Acquirer | `references/acquirer.md` |40| PSP | `references/psp.md` |41| Network Processor | `references/network-processor.md` |4243Use this file as the primary context for answering the user's question.4445### Step 3 — Load Cross-Cutting Topics (as needed)4647If the query involves topics that span multiple business types, additionally48load the relevant shared reference:4950| Topic | Reference File |51|---|---|52| Key management, TR-31, TR-34, ECDH key exchange | `references/key-management.md` |53| PCI DSS / PCI PIN / PCI P2PE compliance | `references/pci-compliance.md` |54| Migration from on-premises HSMs to APC | `references/migration-guide.md` |55| External resources (documentation, blogs, samples) | `references/external-resources.md` |5657### Step 4 — Initial Exploration / Overview5859If the user's business type is unknown or the question is exploratory:60611. Load `references/faq.md` — covers common questions and概要622. Load `references/decision-tree.md` — provides a structured decision framework63 for selecting APC capabilities based on use case6465Guide the user through clarifying questions to identify their business type66and specific needs.6768### Step 5 — Compliance Disclaimer6970**Always** include the following disclaimer when providing guidance related to71PCI compliance, security controls, or certification scope:7273> ⚠️ **Disclaimer**: The guidance provided here is for informational and74> architectural planning purposes only. PCI DSS, PCI PIN, and PCI P2PE75> compliance requirements must be validated with a Qualified Security Assessor76> (QSA) or Payment Card Industry Forensic Investigator (PFI) as appropriate.77> AWS Payment Cryptography is a PCI-certified service, but your overall78> compliance posture depends on your specific implementation.7980---8182## File References8384### references/8586| File | Description |87|---|---|88| `issuer.md` | Card issuer patterns — PIN generation, ARQC/ARPC, card personalization |89| `acquirer.md` | Merchant acquirer patterns — PIN translation, P2PE, terminal integration |90| `psp.md` | PSP/gateway patterns — multi-acquirer routing, tokenization |91| `network-processor.md` | Network processor patterns — switch integration, stand-in processing |92| `key-management.md` | Key lifecycle management — TR-31, TR-34, ECDH, key hierarchy design |93| `pci-compliance.md` | PCI compliance mapping — DSS, PIN, P2PE scope reduction with APC |94| `migration-guide.md` | Migration strategies — phased migration from on-premises HSMs |95| `external-resources.md` | Curated links — official docs, blog posts, sample code, pricing |96| `faq.md` | Frequently asked questions — overview, pricing model, regional availability |97| `decision-tree.md` | Decision framework for selecting APC capabilities by use case |9899---100101## Response Guidelines1021031. **Be specific to the user's role** — Tailor recommendations to their104 business type rather than providing generic guidance.1052. **Reference AWS documentation** — Link to official AWS docs when available.1063. **Provide code examples** — Include AWS CLI or SDK snippets where helpful.1074. **Highlight regional considerations** — Note APC regional availability108 when relevant to architecture decisions.1095. **Security-first** — Always prioritize security best practices; never110 suggest shortcuts that compromise key security or compliance posture.1116. **Migration pragmatism** — Acknowledge that migration is incremental;112 support hybrid architectures during transition periods.113114---115116## Notes117118- **Language**: This skill operates in **English only**. The agent loads the119 English `.md` reference files. The `*_ja.md` files are standalone Japanese120 reference translations for human readers; they are **not** loaded or routed to121 by this skill and are not guaranteed to track the English files.122- **Verify volatile facts before quoting**: pricing, throughput quotas, SLA123 figures, certified Regions, and API/CLI details change over time. Do not124 present hardcoded numbers from the reference files as current fact — confirm125 against the latest AWS documentation, pricing page, Service Quotas, and AWS126 Artifact before relying on them in a decision.127- This skill does not replace AWS documentation or AWS Support. For service128 limits, SLA details, or account-specific issues, direct users to the129 appropriate AWS channels.130- APC features and availability evolve; always verify current capabilities131 against the latest AWS documentation.
aws-samples