Quickstart: Create an Azure Payment HSM with the Azure CLI

  • Article

Azure Payment HSM is a "BareMetal" service delivered using Thales payShield 10K payment hardware security modules (HSM) to provide cryptographic key operations for real-time, critical payment transactions in the Azure cloud. Azure Payment HSM is designed specifically to help a service provider and an individual financial institution accelerate their payment system's digital transformation strategy and adopt the public cloud. For more information, see Azure Payment HSM: Overview.

This quickstart describes how to create, update, and delete an Azure Payment HSM by using the az dedicated-hsm Azure CLI command.

Prerequisites

Important

Azure Payment HSM is a specialized service. To qualify for onboarding and use of Azure Payment HSM, customers must have an assigned Microsoft Account Manager and have a Cloud Service Architect (CSA).

To inquire about the service, start the qualification process, and prepare the prerequisites before on-boarding, ask your Microsoft account manager and CSA to send a request via email.

  • You must register the "Microsoft.HardwareSecurityModules" and "Microsoft.Network" resource providers, as well as the Azure Payment HSM features. Steps for doing so are at Register the Azure Payment HSM resource provider and resource provider features.

    Warning

    You must apply the "FastPathEnabled" feature flag to every subscription ID, and add the "fastpathenabled" tag to every virtual network. For more information, see Fastpathenabled.

    To quickly ascertain if the resource providers and features are already registered, use the Azure CLI az provider show command. (The output of this command is more readable if you display it in table-format.)

    az provider show --namespace "Microsoft.HardwareSecurityModules" -o table

az provider show --namespace "Microsoft.Network" -o table

az feature registration show -n "FastPathEnabled"  --provider-namespace "Microsoft.Network" -o table

az feature registration show -n "AzureDedicatedHsm"  --provider-namespace "Microsoft.HardwareSecurityModules" -o table

    You can continue with this quick start if all four of these commands return "Registered".

  • You must have an Azure subscription. You can create a free account if you don't have one.

    If you have more than one Azure subscription, set the subscription to use for billing with the Azure CLI az account set command.

    az account set --subscription <subscription-id>

Create a resource group

A resource group is a logical container into which Azure resources are deployed and managed. Use the az group create command to create a resource group named myResourceGroup in the eastus location.

az group create --name "myResourceGroup" --location "EastUS"

Create a virtual network and subnet

Before creating a payment HSM, you must first create a virtual network and a subnet. To do so, use the Azure CLI az network vnet create command:

az network vnet create -g "myResourceGroup" -n "myVNet" --address-prefixes "10.0.0.0/16" --tags "fastpathenabled=True" --subnet-name "myPHSMSubnet" --subnet-prefix "10.0.0.0/24"

Afterward, use the Azure CLI az network vnet subnet update command to update the subnet and give it a delegation of "Microsoft.HardwareSecurityModules/dedicatedHSMs":

az network vnet subnet update -g "myResourceGroup" --vnet-name "myVNet" -n "myPHSMSubnet" --delegations "Microsoft.HardwareSecurityModules/dedicatedHSMs"

To verify that the virtual network and subnet were created correctly, use the Azure CLI az network vnet show command:

az network vnet show -n "myVNet" -g "myResourceGroup"

Make note of the value returned as id, as it is used in the next step. The id is in the format:

"id": "/subscriptions/<subscriptionID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/myPHSMSubnet",

Create a payment HSM

To create a payment HSM, use the az dedicated-hsm create command. The following example creates a payment HSM named myPaymentHSM in the eastus region, myResourceGroup resource group, and specified subscription, virtual network, and subnet:

az dedicated-hsm create \
   --resource-group "myResourceGroup" \
   --name "myPaymentHSM" \
   --location "EastUS" \
   --subnet id="<subnet-id>" \
   --stamp-id "stamp1" \
   --sku "payShield10K_LMK1_CPS60"

Get a payment HSM

To see your payment HSM and its properties, use the Azure CLI az dedicated-hsm show command.

az dedicated-hsm show --resource-group "myResourceGroup" --name "myPaymentHSM"

To list all of your payment HSMs, use the az dedicated-hsm list command. (The output of this command is more readable if you display it in table-format.)

az dedicated-hsm list --resource-group "myResourceGroup" -o table

Remove a payment HSM

To remove your payment HSM, use the az dedicated-hsm delete command. The following example deletes the myPaymentHSM payment HSM from the myResourceGroup resource group:

az dedicated-hsm delete --name "myPaymentHSM" -g "myResourceGroup"

Delete the resource group

Other quickstarts and tutorials in this collection build upon this quickstart. If you plan to continue on to work with subsequent quickstarts and tutorials, you may wish to leave these resources in place.

When no longer needed, you can use the Azure CLI az group delete command to remove the resource group and all related resources:

az group delete --name "myResourceGroup"

Next steps

In this quickstart, you created a payment HSM, viewed and updated its properties, and deleted it. To learn more about Payment HSM and how to integrate it with your applications, continue on to these articles.