DocumentationExperience Cloud KCS

AEM as a Cloud Service pipeline stuck at ‘Updating Services’ due to duplicate ACL entries

Last update: September 3, 2026

This article explains how to resolve an issue where an Adobe Experience Manager (AEM) Cloud Manager pipeline deployment becomes stuck at the ‘Updating Services’ step, typically due to duplicate Access Control List (ACL) entries in a RepoInit script.

Description description

Environment

  • Adobe Experience Manager (AEM) as a Cloud Service
  • Cloud Manager pipeline deployments

Issue/Symptoms

  • Pipeline deployment remains stuck at the ‘Updating Services’ step for more than 30 minutes.
  • Changes are not promoted to Production.
  • Stage Author pods are unhealthy or enter a crash-loop state.
  • Error logs display messages such as OakAccessControl0013: Duplicate ACE.

Cause

This issue is usually caused by duplicate Access Control Entries (ACEs) for the same principal and path defined in RepoInit scripts or content packages.

Resolution resolution

Follow these steps to resolve the issue:

  1. Review the RepoInit scripts included in the deployment, paying particular attention to sections that configure Access Control Lists (ACLs).
  2. Search for duplicate Access Control Entries (ACEs) for the same principal and path, such as multiple allow or deny entries for the same group on the same path.
  3. Remove or consolidate any duplicate ACEs found in the RepoInit script. Ensure that each ACE is unique for a given principal and path.
  4. Commit and push the corrected RepoInit script to the deployment branch in your source control system.
  5. Run the pipeline again in Cloud Manager.
  6. Monitor the health of the Stage Author pods through the AEM Cloud Manager interface or your monitoring tools. If the pods remain unhealthy or enter a CrashLoopBackOff state, review the logs for any remaining ACL or initialization errors.
  7. If you accidentally remove any required deny rules during ACL cleanup, add them back to maintain the intended security configuration.
  8. Verify that the pipeline completes the Stage deployment successfully and that no additional OakAccessControl0013 or related errors appear in the logs.
recommendation-more-help
experience-cloud-kcs-help-kbarticles