microsoft/AzureHSMEssentials

microsoft/AzureHSMEssentials

Description: End-to-end toolkit for Azure HSM scenarios — deployment templates, migration scripts, and validation tests for Key Vault, Managed HSM, Cloud HSM, Dedicated HSM, and Payment HSM.

Language: PowerShell

License: MIT

Stars: 1

Forks: 0

Open issues: 0

Created: 2026-05-07T18:34:31Z

Pushed: 2026-05-13T04:32:18Z

Default branch: main

Fork: no

Archived: no

README:

▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
_ _ ___ __ __
| || |/ __|| \/ |
| __ |\__ \| |\/| | SCENARIO
|_||_||___/|_| |_| BUILDER

▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
# SHALL WE DEPLOY A HSM?

HSM Scenario Builder

One-command deployment of fully configured Azure HSM platforms for evaluation, proof-of-concept, and production reference architectures.

---

Overview

Setting up Azure HSM environments manually is time-consuming and error-prone -- VNets, private endpoints, DNS zones, subnets, firewalls, diagnostic logging, admin VMs, and more. HSM Scenario Builder automates all of that into a single deploy command.

Give it to PMs, engineers, or field teams so they can spin up a fully-configured HSM platform in minutes, run their tests or partner demos, and tear it down cleanly when done.

Supported Platforms

| Platform | Description | Key Features | | ----------------------------- | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Azure Cloud HSM | FIPS 140-3 Level 3 HSM Cluster (Standard_B1) | Private endpoint, DNS zone, VNet, diagnostic logging, optional admin VM | | Azure Dedicated HSM | Thales SafeNet Luna A790 (bare-metal) | VNet injection, ExpressRoute gateway, delegated hsmSubnet, optional admin VM | | Azure Key Vault | Premium SKU with HSM-backed keys | Private endpoint, DNS zone, VNet, Entra ID RBAC, diagnostic logging, optional admin VM | | Azure Managed HSM | FIPS 140-3 Level 3, Entra ID RBAC-only HSM Pool (Standard_B1) | Private endpoint, DNS zone, VNet, security domain activation, diagnostic logging, optional admin VM | | Azure Payment HSM | Thales payShield 10K for payment processing (bare-metal) | VNet injection, separate data/management subnets, optional admin VM |

What Gets Deployed

Each platform deployment creates isolated resource groups with production-grade networking and security:

• Networking -- VNet, subnets, private endpoint (or VNet injection), private DNS zone, DNS-VNet link
• HSM resource -- The HSM platform itself, fully configured
• Diagnostic logging -- Storage Account + Log Analytics Workspace with audit log routing (where supported)
• Admin VM *(optional)* -- Ubuntu 24.04 LTS jumpbox connected to the HSM VNet for administration
• P2S VPN Gateway *(optional)* -- Point-to-Site VPN for remote/WFH access into the HSM VNet via OpenVPN
• Clean teardown -- Matching uninstall scripts delete all resource groups in the correct dependency order

---

Architecture

┌──────────────────────────────────────┐
│ HSM Scenario Builder │
│ │
│ deploy-hsm.ps1 / deploy-hsm.sh │
│ uninstall-hsm.ps1 / uninstall-hsm.sh│
└──────────────┬───────────────────────┘
│
┌────────────────────┼────────────────────┐
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ ARM Template │ │ ARM Template │ │ ARM Template │
│ + Parameters │ │ + Parameters │ │ + Parameters │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Azure Cloud HSM │ │ Azure Key Vault │ │ Azure Managed │
│ Azure Dedicated │ │ │ │ HSM │
│ HSM │ │ │ │ Azure Payment │
│ │ │ │ │ HSM │
└─────────────────┘ └─────────────────┘ └─────────────────┘

Each deployment creates:
┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ *-HSB-CLIENT │ │ *-HSB-HSM-RG │ │ *-HSB-LOGS │ │ *-HSB-ADMIN │
│ -RG │ │ │ │ -RG │ │ VM-RG │
│ │ │ │ │ │ │ (optional) │
│ VNet, PE, │ │ HSM resource │ │ Storage, │ │ Ubuntu VM, │
│ DNS zone │ │ │ │ Log Analytics│ │ NIC, NSG,PIP │
└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘

Optional VPN Gateway (-EnableVpnGateway):
┌──────────────────────────────────────────────┐
│ VPN Gateway (VpnGw1) + GatewaySubnet │
│ OpenVPN P2S for remote/WFH access │
│ Deployed into the CLIENT-RG VNet │
└──────────────────────────────────────────────┘

---

Quick Start

Prerequisites

• Azure subscription with permissions to create resource groups and HSM resources
• PowerShell: Az PowerShell module (Install-Module -Name Az -Scope CurrentUser)
• Bash: Azure CLI (az) installed and authenticated

1. Clone

git clone https://github.com/YOUR_ORG/hsm-scenario-builder.git
cd hsm-scenario-builder

2. Deploy

PowerShell:

# Deploy Azure Cloud HSM
.\deployhsm\deploy-hsm.ps1 -Platform AzureCloudHSM -SubscriptionId ""

# Deploy Azure Key Vault
.\deployhsm\deploy-hsm.ps1 -Platform AzureKeyVault -SubscriptionId ""

# Deploy Azure Managed HSM
.\deployhsm\deploy-hsm.ps1 -Platform AzureManagedHSM -SubscriptionId ""

# Deploy Azure Dedicated HSM
.\deployhsm\deploy-hsm.ps1 -Platform AzureDedicatedHSM -SubscriptionId ""

# Deploy Azure Payment HSM
.\deployhsm\deploy-hsm.ps1 -Platform AzurePaymentHSM -SubscriptionId ""

Bash:

# Deploy Azure Cloud HSM
./deployhsm/deploy-hsm.sh --platform azurecloudhsm --subscription-id ""

# Deploy Azure Managed HSM with location override
./deployhsm/deploy-hsm.sh --platform azuremanagedhsm --subscription-id "" --location "East US"

With optional admin VM:

.\deployhsm\deploy-hsm.ps1 -Platform AzureCloudHSM -SubscriptionId "" `
-AdminPasswordOrKey (Read-Host -AsSecureString -Prompt "SSH key or password") `
-AdminUsername "myadmin" -AuthenticationType password

With optional P2S VPN Gateway (remote/WFH access):

.\deployhsm\deploy-hsm.ps1 -Platform AzureCloudHSM -SubscriptionId "" `
-AdminPasswordOrKey (Read-Host -AsSecureString -Prompt "Admin password") `
-AuthenticationType password `
-EnableVpnGateway

After the VPN Gateway deploys, run the cert setup to complete P2S configuration:

& ".\deployhsm\vpngateway\P2S VPN Gateway\setup-vpn-certs.ps1" `
-VpnGatewayName "chsm-vpn-gateway" `
-ResourceGroupName "CHSM-HSB-CLIENT-RG"

See [deployhsm/vpngateway/P2S VPN Gateway/README.md](deployhsm/vpngateway/P2S%20VPN%20Gateway/README.md) for full VPN…