AWS Achieves PCI DSS 2.0 Validated Service Provider Status

Note that though it is now possible to be PCIDSS certified on AWS it doesn't mean that every AWS app is certified. You need to get your own software audited regularly.

I didn't expect this to happen nearly this soon. What it means to me is that I can replace a locked cabinet @ colo with EC2, and not have PCI throw a rod if backups are stored on S3 (assuming suitable key management).

What it doesn't help is the dual control and change control issues. I'd love to know how small startups deal with the dual control issue. Ultimately there's going to be a sysadmin somewhere who can read memory, and once that happens, it's single control. Though, not having access to the physical hardware on EC2 makes it a bit more secure from the sysadmin.

You seem to assert that almost every startup that accepts credit cards is not PCI compliant, and further, operates on an environment which at times in the past has been known to be moderately insecure (e.g. hypervisor attacks). That's a pretty bold claim. Do you have any evidence to back it up? (e.g. name companies which are knowingly operating without PCI compliance when they're required to have it)