We (merchant) will be using a SaaS to sell learning modules and accept credit card payments through a redirect to a service provider that will process the credit card payments. The SaaS will be hosted by Amazon web services.
Should the SaaS provider needs to be PCI compliant (because since PCI v.3.1 those who redirects are in scope). Or should the Amazon who will be hosting the Saas should be the one subject to PCI compliance?