DocumentationExperience Cloud KCS

Scoping CDN pipeline rule to a specific domain using cdn.yml

Last update: June 27, 2026

An unintended CDN rule can affect other domains in the same environment if it is not explicitly scoped. This article explains how to limit a CDN pipeline rule in Adobe Experience Manager (AEM) Cloud Service to a specific domain by adding a host condition in cdn.yml.

Description description

Environment

Adobe Experience Manager (AEM) Cloud Service

Issue/Symptoms

You want to block a legacy Dynamic Media delivery endpoint in a lower environment (DEV) using Cloud Manager’s CDN pipeline through the cdn.yml file. The following YAML configuration blocks requests matching the path /adobe/dynamicmedia/deliver/ and returns a 410 Gone response:

rules:
  - name: block-legacy-delivery-endpoint
    when:
      allOf:
        - reqProperty: path
          matches: /adobe/dynamicmedia/deliver(/.*)?$
    actions:
      - type: respond
        status: 410 reason: "Legacy Dynamic Media endpoint is deprecated"

You need to confirm whether this rule applies to all configured domains in the environment and how to restrict it so that it only affects the intended VCR domain.

  • Requests to the legacy Dynamic Media endpoint are blocked as expected.
  • Requests to OpenAPI Dynamic Media URLs are allowed through.
  • You need to ensure the rule applies only to a specific domain and not all domains in the environment.

Cause

By default, CDN rules in cdn.yml apply to all domains unless they are explicitly scoped. Adding a host condition ensures the rule affects only the intended domain.

Resolution resolution

To fix the issue:

  1. Review the current CDN rule configuration in cdn.yml.

    • The rule matches requests based on the path /adobe/dynamicmedia/deliver/.
    • By default, this rule applies to all domains configured in the environment unless it is further scoped.

  2. Scope the rule to a specific domain.

    • Add a domain condition to the when section of the rule.
    • Use the following example syntax:
    code language-none 
    - name: block-legacy-delivery-endpoint
                    when:
                    allOf:
                        - reqProperty: host
                        matches: your-vcr-domain\.example\.com$
                        - reqProperty: path
                        matches: /adobe/dynamicmedia/deliver(/.*)?$
                    actions:
                    - type: respond
                        status: 410
                        reason: "Legacy Dynamic Media endpoint is deprecated"
    • Replace your-vcr-domain.example.com with the actual domain name configured under domain settings.

  3. Deploy the updated cdn.ymlconfiguration through Cloud Manager.

    • Commit and push the changes to your repository.
    • Deploy through the Cloud Manager pipeline to apply the rule.

  4. Validate the rule in the target environment.

    • Test requests to the legacy endpoint on the scoped domain to confirm they are blocked.
    • Test requests to the same endpoint on other domains to ensure they are not affected.
    • Confirm that OpenAPI Dynamic Media URLs are unaffected.
recommendation-more-help
experience-cloud-kcs-help-kbarticles