DocumentationExperience Cloud KCS

AEM as a Cloud Service: Resolve Bulk Import job failures from S3 due to IP allowlist restrictions

Last update: July 30, 2026

This article explains how to resolve failures in Adobe Experience Manager (AEM) as a Cloud Service Bulk Import jobs when importing assets from an Amazon S3 bucket, caused by missing or incomplete IP allowlist entries.

Description description

When running the Bulk Import job in AEM as a Cloud Service to import assets from an S3 bucket, the job fails when the required IP addresses aren’t allowlisted on the S3 bucket. This issue is reproducible and the job status displays as failed in the Bulk Import UI. The failure occurs because network connectivity between AEM and the S3 bucket is blocked due to restrictive allowlist settings. Reviewing the Bulk Import Job Details in the AEM UI help confirm the failure and its timing.

Environment

Adobe Experience Manager as a Cloud Service (all versions)

Symptoms

  • Bulk Import job fails when importing assets from S3.
  • Job status shows as failed in the Bulk Import UI.

Cause

The Bulk Import job fails because the required egress IP address for your AEM environment and the Microsoft Azure Storage region IP ranges used for binary file transfers aren’t allowlisted on the S3 bucket, blocking the necessary network connectivity.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Identify your environment’s dedicated egress IP address:

    • In AEM as a Cloud Service, the dedicated egress IP address is used for manifest and listing requests to S3. Contact your Adobe representative or consult your environment documentation to obtain this IP address.

  2. Identify the required Microsoft Azure Storage region IP ranges:

    • Binary file transfers are performed from the Azure region where your AEM environment is hosted. These IP ranges are published and updated regularly by Microsoft. Refer to the official Microsoft Azure IP Ranges and Service Tags – Public Cloud documentation and look for the relevant Storage. entries (For example: Storage.EastUS2) in the JSON file.

  3. Update your S3 bucket policy to allowlist:

    • Your environment’s dedicated egress IP address.

    • The current Microsoft Azure Storage region IP ranges identified in step 2.

  4. Maintain your allowlist:

    • Microsoft updates the Storage region IP ranges regularly. Review and update your S3 bucket policy as needed to ensure continued access.

    • If maintaining an IP allowlist isn’t feasible, consider restricting bucket access using a bucket policy or VPC endpoint instead of source-IP allowlisting.

  5. Test the Bulk Import job:

    • After updating the allowlist, rerun the Bulk Import job from the AEM UI to verify successful asset import.

  6. To review job status and details:

    • In the AEM UI, navigate to the Bulk Import job list and select the relevant job to view its details and status.
recommendation-more-help
experience-cloud-kcs-help-kbarticles