Configure IP allow lists for external SaaS integration in AEM as a Cloud Service
Adobe Experience Manager (AEM) as a Cloud Service integrations with external SaaS tools can require network access to AEM Assets Author from specific external IP addresses. The connection is unavailable unless you add these IP addresses to an IP allow list in Cloud Manager, which prevents the external tool from querying asset metadata through the AEM Assets HTTP API. Authentication and authorization are also required for secure API access. To resolve the issue, configure and attach an IP allow list to the Author service and ensure that the integration uses a technical identity with the appropriate permissions.
Description description
Environment
Adobe Experience Manager as a Cloud Service (AEMaaCS), all versions
Issue/Symptoms
- Integration with an external SaaS tool requires network access to the AEM Assets Author service.
- The external tool must be able to query asset metadata through the AEM Assets HTTP API.
Root cause
Network-level access from specific external IP addresses is required for the integration. You must add these IP addresses to an IP allow list in Cloud Manager. Authentication and authorization are also required for secure API access.
Resolution resolution
Follow the steps below to resolve the issue:
- Identify the target AEM Assets Author environment that you want to integrate with. The Author service URL typically follows this format:
https://author--.adobeaemcloud.com. - Sign in to Cloud Manager with the appropriate permissions.
- Go to the target development environment.
- Create or update an IP allow list with the required external CIDR IP addresses provided by the SaaS tool. For detailed instructions, refer to the public documentation about adding and managing IP allow lists in Cloud Manager.
- Attach the IP allow list to the Author service for the relevant environment.
- Confirm the API endpoint for asset metadata queries. The base URL is the Author service URL, and asset metadata is accessible through the AEM Assets HTTP API.
- Ensure that the integration uses a technical identity with the appropriate permissions to access DAM resources. If required, configure an Adobe Developer Console project and product profile for server-to-server authentication.
- Verify that the external SaaS tool can connect successfully to the AEM Assets Author API from the allow-listed IP addresses.