A computer-implemented method, comprising: under the control of one or more computer systems configured with executable instructions, receiving, from a customer of a computing resource provider, a request to add a hardware security module to a customer network that is hosted by the computing resource provider and remotely managed by the customer; as a result of receiving the request, selecting a hardware security module from a plurality of available hardware security modules of the computing resource provider; creating, in the customer network, a network interface to another network in communication with the selected hardware security module allocated to the customer; configuring the network interface and other network such that requests through the customer network addressed to the network interface are provided to the selected hardware security module; using a first administrative account of the hardware security module to create a second administrative account with device administration rights; and providing a credential for the second administrative account to enable the customer to change the credential, thereby revoking access to the second account from the computing resource provider. under the control of one or more computer systems configured with executable instructions, receiving, from a customer of a computing resource provider, a request to add a hardware security module to a customer network that is hosted by the computing resource provider and remotely managed by the customer; as a result of receiving the request, selecting a hardware security module from a plurality of available hardware security modules of the computing resource provider; creating, in the customer network, a network interface to another network in communication with the selected hardware security module allocated to the customer; configuring the network interface and other network such that requests through the customer network addressed to the network interface are provided to the selected hardware security module; using a first administrative account of the hardware security module to create a second administrative account with device administration rights; and providing a credential for the second administrative account to enable the customer to change the credential, thereby revoking access to the second account from the computing resource provider. receiving, from a customer of a computing resource provider, a request to add a hardware security module to a customer network that is hosted by the computing resource provider and remotely managed by the customer; as a result of receiving the request, selecting a hardware security module from a plurality of available hardware security modules of the computing resource provider; creating, in the customer network, a network interface to another network in communication with the selected hardware security module allocated to the customer; configuring the network interface and other network such that requests through the customer network addressed to the network interface are provided to the selected hardware security module; using a first administrative account of the hardware security module to create a second administrative account with device administration rights; and providing a credential for the second administrative account to enable the customer to change the credential, thereby revoking access to the second account from the computing resource provider.