Skip to content

Commit 7bdced9

Browse files
v-regandownerv-regandowner
authored
Merge pull request #216282 from msmbaldwin/phsm-ga
Payment HSM GA: 10/31
2 parents 6ef6109 + 293b273 commit 7bdced9

23 files changed

+2526
-45
lines changed

‎articles/payment-hsm/access-payshield-manager.md

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
---
2+
title: Access the payShield manager for your Azure Payment HSM
3+
description: Access the payShield manager for your Azure Payment HSM
4+
services: payment-hsm
5+
ms.service: payment-hsm
6+
author: msmbaldwin
7+
ms.author: mbaldwin
8+
ms.topic: quickstart
9+
ms.devlang: azurecli
10+
ms.date: 09/12/2022
11+
---
12+
13+
# Tutorial: Access the payShield manager for your payment HSM
14+
15+
After you have [Created an Azure Payment HSM](create-payment-hsm.md), you can create a virtual machine on the same virtual network and use it to access the Thales payShield manager.
16+
17+
In this tutorial, you learn how to:
18+
19+
> [!div class="checklist"]
20+
> * Create a subnet for your virtual machine
21+
> * Create a virtual machine
22+
> * Test Connectivity to your VM, and from the VM to your payment HSM
23+
> * Log into the VM to access the payShield manager
24+
25+
To complete this tutorial, you will need:
26+
27+
- The name of your payment HSM's virtual network. This tutorial assumes the name used in the previous tutorial: "myVNet".
28+
- The address space of your virtual network. This tutorial assumes the address space used in the previous tutorial: "10.0.0.0/16".
29+
30+
## Create a VM subnet
31+
32+
# [Azure CLI](#tab/azure-cli)
33+
34+
Create a subnet for your virtual machine, on the same virtual network as your payment HSM, using the Azure CLI [az network vnet subnet create](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create) command. You must provide a value to the--address-prefixes argument that falls within the VNet's address space, but differs from the payment HSM subnet addresses.
35+
36+
```azurecli-interactive
37+
az network vnet subnet create -g "myResourceGroup" --vnet-name "myVNet" -n "myVMSubnet" --address-prefixes "10.0.1.0/24"
38+
```
39+
40+
The Azure CLI [az network vnet show](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create) command will list two subnets associated with your VNet: the subnet with your payment HSM ("mySubnet"), and the newly created "myVMSubnet" subnet.
41+
42+
```azurecli-interactive
43+
az network vnet show -n "myVNet" -g "myResourceGroup"
44+
```
45+
46+
# [Azure PowerShell](#tab/azure-powershell)
47+
48+
First, save the details of your VNet to a variable using the Azure PowerShell [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) cmdlet:
49+
50+
```azurepowershell-interactive
51+
$vnet = Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
52+
```
53+
54+
Next, configure a subnet for your virtual machine, on the same virtual network as your payment HSM, using the Azure PowerShell [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig) command. You must provide a value to the `--address-prefixes` argument that falls within the VNet's address space, but differs from the payment HSM subnet addresses.
55+
56+
```azurepowershell-interactive
57+
$vmSubnet = New-AzVirtualNetworkSubnetConfig -Name "myVMSubnet" -AddressPrefix "10.0.1.0/24"
58+
```
59+
60+
Lastly, add the subnet configuration to your VNet variable, and then pass the variable to the Azure PowerShell [Set-AzVirtualNetwork](/powershell/module/az.network/set-azvirtualnetwork) cmdlet:
61+
62+
```azurepowershell-interactive
63+
$vnet.Subnets.Add($vmSubnet)
64+
65+
Set-AzVirtualNetwork -VirtualNetwork $vnet
66+
```
67+
68+
The Azure PowerShell [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) cmdlet will now list two subnets associated with your VNet: the subnet with your payment HSM ("mySubnet"), and the newly created "myVMSubnet" subnet.
69+
70+
```azurepowershell-interactive
71+
Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
72+
```
73+
74+
# [Portal](#tab/azure-portal)
75+
76+
---
77+
78+
## Create a VM
79+
80+
# [Azure CLI](#tab/azure-cli)
81+
82+
Create a VM on your new subnet, using the Azure CLI [az vm create](/cli/azure/vm#az-vm-create) command. (In this example we will create a Linux VM, but you could also create a Windows VM by augmenting the instructions found at [Create a Windows virtual machine with the Azure CLI](../virtual-machines/windows/quick-create-cli.md) with the details below.)
83+
84+
```azurecli-interactive
85+
az vm create \
86+
--resource-group "myResourceGroup" \
87+
--name "myVM" \
88+
--image "UbuntuLTS" \
89+
--vnet-name "myVNet" \
90+
--subnet "myVMSubnet" \
91+
--admin-username "azureuser" \
92+
--generate-ssh-keys
93+
```
94+
95+
Make a note of where the public SSH key is saved, and the value for "publicIpAddress".
96+
97+
# [Azure PowerShell](#tab/azure-powershell)
98+
99+
To create a VM on your new subnet, first set your credentials with the [Get-Credential](/powershell/module/microsoft.powershell.security/get-credential) cmdlet. Provide a username of "azureuser" and a password of your choice, saving the object as $cred.
100+
101+
```azurepowershell-interactive
102+
$cred = Get-Credential
103+
```
104+
105+
Now create your VM using the Azure PowerShell [New-AzVm](/powershell/module/az.compute/new-azvm) command. (In this example we will create a Linux VM, but you could also create a Windows VM by augmenting the instructions found at [Create a Windows virtual machine with the Azure PowerShell](../virtual-machines/windows/quick-create-powershell.md) with the details below.)
106+
107+
```azurepowershell-interactive
108+
New-AzVm `
109+
-ResourceGroupName "myResourceGroup" `
110+
-Name "myVM" `
111+
-Location "eastus" `
112+
-Image "UbuntuLTS" `
113+
-PublicIpAddressName "myPubIP" `
114+
-VirtualNetworkName "myVNet" `
115+
-SubnetName "myVMSubnet" `
116+
-OpenPorts 22 `
117+
-Credential $cred `
118+
-GenerateSshKey `
119+
-SshKeyName "myVM_key"
120+
```
121+
122+
Make a note of where the private SSH key is saved, and the value for "FullyQualifiedDomainName".
123+
124+
# [Portal](#tab/azure-portal)
125+
126+
To create a VM on your new subnet:
127+
128+
1. select "Virtual machines" from the "Create a Resource" screen of the Azure portal:
129+
:::image type="content" source="./media/portal-create-vm-1.png" alt-text="Screenshot of the portal resource picker.":::
130+
1. On the "Basics" tab of the creation screen, select the resource group that contains your payment HSM ("myResourceGroup"):
131+
:::image type="content" source="./media/portal-create-vm-2.png" alt-text="Screenshot of the portal main VM creation screen.":::
132+
1. On the "Networking" tab of the creation screen, select the VNet that contains your payment HSM ("myVNet"), and the subnet you created above ("myVMSubnet"):
133+
:::image type="content" source="./media/portal-create-vm-3.png" alt-text="Screenshot of the portal networking VM creation screen.":::
134+
1. At the bottom of the networking tab, select "Review and create".
135+
1. Review the details of your VM, and select "Create".
136+
1. Select "Download private key and create resource", and save your VM's private key to a location where you can access it later.
137+
138+
---
139+
140+
## Test connectivity
141+
142+
To access connectivity to your virtual machine, and from your VM to the management NIC IP (10.0.0.4) and host NIC IP, SSH into your VM. Connect to either the public IP address (for example, [email protected]) or the fully qualified domain name (for example, [email protected])
143+
144+
> [!NOTE]
145+
> If created your VM using Azure PowerShell, the Azure portal, or if you did not ask Azure CLI to auto-generate ssh keys when you created the VM, you will need to supply the private key to the ssh command using the "-i" flag (for example, `ssh -i "path/to/sshkey" azureuser@<publicIpAddress-or-FullyQualifiedDomainName>`). Note that the private key **must** be protected ("chmod 400 myVM_key.pem").
146+
147+
```bash
148+
ssh azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
149+
```
150+
151+
If ssh hangs or refuses the connection, review your NSG rules to ensure that you are able to connect to your VM.
152+
153+
If the connection is successful, you should be able to ping both the management NIC IP (10.0.0.4) and the host NIC IP (10.0.0.5) from your VM:
154+
155+
```bash
156+
azureuser@myVM:~$ ping 10.0.0.4
157+
PING 10.0.0.4 (10.0.0.4) 56(84) bytes of data.
158+
64 bytes from 10.0.0.4: icmp_seq=1 ttl=63 time=1.34 ms
159+
64 bytes from 10.0.0.4: icmp_seq=2 ttl=63 time=1.53 ms
160+
64 bytes from 10.0.0.4: icmp_seq=3 ttl=63 time=1.40 ms
161+
64 bytes from 10.0.0.4: icmp_seq=4 ttl=63 time=1.26 ms
162+
^C
163+
--- 10.0.0.4 ping statistics ---
164+
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
165+
rtt min/avg/max/mdev = 1.263/1.382/1.531/0.098 ms
166+
167+
azureuser@myVM:~$ ping 10.0.0.5
168+
PING 10.0.0.5 (10.0.0.5) 56(84) bytes of data.
169+
64 bytes from 10.0.0.5: icmp_seq=1 ttl=63 time=1.33 ms
170+
64 bytes from 10.0.0.5: icmp_seq=2 ttl=63 time=1.25 ms
171+
64 bytes from 10.0.0.5: icmp_seq=3 ttl=63 time=1.15 ms
172+
64 bytes from 10.0.0.5: icmp_seq=4 ttl=63 time=1.37 ms
173+
```
174+
175+
## Access the payShield manager
176+
177+
To access the payShield manager associated with your payment HSM, SSH into your VM using the -L (local) option. If you needed to use the -i option in the [test connectivity](#test-connectivity), you will need it again here.
178+
179+
The -L option will bind your localhost to the HSM resource. Pass to the -L flag the string "44300:`<MGMT-IP-of-payment-HSM>`:443", where `<MGMT-IP-of-HSM-resource>` represents the Management IP of your payment HSM.
180+
181+
```bash
182+
ssh -L 44300:<MGMT-IP-of-payment-HSM>:443 azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
183+
```
184+
185+
For example, if you used "10.0.0.0" as the address prefix for your Payment HSM subnet, the Management IP will be "10.0.0.5" and your command would be:
186+
187+
```bash
188+
ssh -L 44300:10.0.0.5:443 azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
189+
```
190+
191+
Now go to a browser on your local machine and open <https://localhost:44300> to access the payShield manager. Here you can commission the device, install or generate LMKs, test the API, and so on. Follow payShield documentation, and contact Thales support if any issues related to payShield commission, setup, and API testing.
192+
193+
## Next steps
194+
195+
Advance to the next article to learn how to remove a commissioned payment HSM through the payShield manager.
196+
> [!div class="nextstepaction"]
197+
> [Remove a commissioned payment HSM](remove-payment-hsm.md)
198+
199+
More resources:
200+
- Read an [Overview of Payment HSM](overview.md)
201+
- Find out how to [get started with Azure Payment HSM](getting-started.md)
202+
- [Create a payment HSM](create-payment-hsm.md)

‎articles/payment-hsm/certification-compliance.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,11 @@ ms.author: mbaldwin
1414

1515
# Certification and compliance
1616

17-
The Azure Payment HSM service is PCI DSS and PCI 3DS compliant.
17+
The Azure Payment HSM service is PCI PIN, PCI DSS, and PCI 3DS compliant.
1818

19-
- [Azure - PCI DSS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=b9cc20e0-38db-4953-aa58-9fb5cce26cc2&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI DSS certification reports and shared responsibility matrices. The PCI DSS AOC includes the full list of PCI DSS certified Azure offerings and regions. Customers can leverage Azure’s PCI DSS AOC during their PCI DSS assessment.
20-
- [Azure - PCI 3DS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=45ade37c-753c-4392-8321-adc49ecad12c&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI 3DS certification report, shared responsibility matrix, and whitepaper. The PCI 3DS AOC includes the full list of PCI 3DS certified Azure offerings and regions. Customers can leverage Azure’s PCI 3DS AOC during their PCI 3DS assessment.
21-
22-
Azure Payment HSMs can be deployed as part of a validated PCI P2PE and PCI PIN component or solution. Microsoft can provide evidence of proof for customer to meet their P2PE and PIN certification requirements.
19+
- [Azure - PCI PIN - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=52eb9daa-f254-4914-aec6-46d40287a106) – Microsoft Azure PCI PIN Attestation of Compliance (AOC) report for Azure Payment HSM.
20+
- [Azure - PCI DSS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=b9cc20e0-38db-4953-aa58-9fb5cce26cc2&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI DSS certification reports and shared responsibility matrices. The PCI DSS AOC includes the full list of PCI DSS certified Azure offerings and regions. Customers can use Azure's PCI DSS AOC during their PCI DSS assessment.
21+
- [Azure - PCI 3DS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=45ade37c-753c-4392-8321-adc49ecad12c&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI 3DS certification report, shared responsibility matrix, and whitepaper. The PCI 3DS AOC includes the full list of PCI 3DS certified Azure offerings and regions. Customers can use Azure’s PCI 3DS AOC during their PCI 3DS assessment.
2322

2423
Thales payShield 10K HSMs are certified to FIPS 140-2 Level 3 and PCI HSM v3.
2524

‎articles/payment-hsm/change-performance-level.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: How to change the performance level of an Azure Payment HSM
3+
description: How to change the performance level of an Azure Payment HSM
4+
services: payment-hsm
5+
author: msmbaldwin
6+
ms.service: payment-hsm
7+
ms.topic: overview
8+
ms.date: 09/12/2022
9+
ms.author: mbaldwin
10+
11+
---
12+
# How to change the performance level of a payment HSM
13+
14+
Azure Payment HSM supports several SKUs; for a list, see [Azure Payment HSM overview: supported SKUs](overview.md#supported-skus). The performance license level of your payment HSM is initially determined by the SKU you specify during the creation process.
15+
16+
You can change performance level of an existing payment HSM by changing its SKU. There will be no interruption in your production payment HSMs while performance level is being updated.
17+
18+
The SKU of a payment HSM can be updated through ARMClient and PowerShell.
19+
20+
## Updating the SKU via ARMClient
21+
22+
You can update the SKU of your payment HSM using the [Azure Resource Manager client tool](https://github.com/projectkudu/ARMClient), which is a simple command line tool that calls the Azure Resource Manager API. Installation instructions are at <https://github.com/projectkudu/ARMClient>.
23+
24+
Once installed, you can use the following command:
25+
26+
```bash
27+
armclient PATCH <resource-id>?api-version=2021-11-30 "{ 'sku': { 'name': '<sku>' } }"
28+
```
29+
30+
For example:
31+
32+
```bash
33+
armclient PATCH /subscriptions/6cc6a46d-fc29-46c4-bd82-6afaf0e61b92/resourceGroups/myResourceGroup/providers/Microsoft.HardwareSecurityModules/dedicatedHSMs/myPaymentHSM?api-version=2021-11-30 "{ 'sku': { 'name': 'payShield10K_LMK1_CPS60' } }"
34+
```
35+
36+
## Updating the SKU directly via PowerShell
37+
38+
You can update the SKU of your payment HSM using the Azure PowerShell [Invoke-RestMethod](/powershell/module/microsoft.powershell.utility/invoke-restmethod) cmdlet:
39+
40+
```azurepowershell-interactive
41+
$sku="<sku>"
42+
$resourceId="<resource-id>"
43+
Invoke-RestMethod -Headers @{Authorization = "Bearer $((Get-AzAccessToken).Token)"} -Method PATCH -Uri "https://management.azure.com$($resourceId)?api-version=2021-11-30" -ContentType application/json -Body "{ 'sku': { 'name': '$sku' } }"
44+
```
45+
46+
For example:
47+
48+
```azurepowershell-interactive
49+
$sku="payShield10K_LMK1_CPS60"
50+
$resourceId="/subscriptions/6cc6a46d-fc29-46c4-bd82-6afaf0e61b92/resourceGroups/myResourceGroup/providers/Microsoft.HardwareSecurityModules/dedicatedHSMs/myPaymentHSM"
51+
Invoke-RestMethod -Headers @{Authorization = "Bearer $((Get-AzAccessToken).Token)"} -Method PATCH -Uri "https://management.azure.com$($resourceId)?api-version=2021-11-30" -ContentType application/json -Body "{ 'sku': { 'name': '$sku' } }"
52+
```
53+
54+
## Next steps
55+
56+
- Read an [Overview of Payment HSM](overview.md)
57+
- Find out how to [get started with Azure Payment HSM](getting-started.md)
58+
- See the [Azure Payment HSM frequently asked questions](faq.yml)

0 commit comments

Comments
 (0)