DocumentationExperience Cloud KCS

Grant DAM write permissions to service accounts in AEMaaCS

Last update: August 28, 2026

This article explains how to grant a service account write access to Digital Asset Management (DAM) in Adobe Experience Manager as a Cloud Service. It also describes how to configure OAuth server-to-server authentication so external scheduled scripts can securely upload or modify assets through the AEM REST API.

Description description

Environment

Adobe Experience Manager as a Cloud Service, all versions

Issue/Symptoms

  • A service account requires write access to Digital Asset Management (DAM).
  • Scheduled scripts running outside AEM need access to AEM Assets through the REST API.
  • The scripts require authentication to upload or modify assets.
  • The service account lacks the required permissions or server-to-server authentication configuration.

Resolution resolution

Follow the steps below to resolve the issue.

  1. Confirm that you have administrative access to the Adobe Developer Console for your organization.
  2. Confirm you have access to the AEMaaCS environment where the integration is required.
  3. Enable OAuth server-to-server authentication for your AEM environment by following the official documentation.
  4. In the Adobe Developer Console, register a new integration for AEM and generate the necessary credentials (client ID, client secret, and private key) for OAuth S2S authentication.
  5. In the AEM Admin Console, assign the service account to a product profile that includes DAM write permissions such as dam-users or a custom profile with write access to /content/dam.
  6. Confirm that the service account is mapped to the correct roles and permissions.
  7. Update your external script to authenticate using the OAuth S2S credentials. Refer to the official guide for implementation details.
  8. Run the scheduled script and verify that it successfully performs write operations, such as uploading assets, to the DAM through the AEM REST API.
  9. Check the script output and AEM logs for permission errors to confirm successful integration.
recommendation-more-help
experience-cloud-kcs-help-kbarticles