Adobe Experience Manager Sites & More

prananshupa1 · 4/29/25

Hi All,

To automate CDN cache purge on publish, we implemented a EventHandler which listens to replication request and initiate HTTP Purge request from Author to Publish to clear out CDN cache for published page. However, this Purge request is failing and we are getting 403 response -

Complete Error Response =

<!DOCTYPE html>
<html>
<head>
<title>403 Not allowed.</title>
</head>
<body>
<h1>Error 403 Not allowed.</h1>
<p>Not allowed.</p>
<p>Trace-id: 25477b2d-8605-4fdc-b2e4-a7890b18b998</p>
</body>
</html>

The same EventHandler works in local AEM instance and gives 200 response for Purge request. Implementation is similar like how it is given in this blog - https://experience-aem.blogspot.com/2023/01/aem-cloud-service-invalidate-dispatcher-purge-fastly-cdn....

JDK Version - 8

AEM cloud

We are passing correct Purge key

Note: Currently, Cloud Program network infrastructure is set to dedicated egress IP.

Any inputs or steps to resolve this issue will be appreciated. Thank you

SantoshSai · 4/29/25

Hi @prananshupa1,

I think, it's working in your local AEM, because, your machine sends the HTTP request directly to the dispatcher/CDN and is not behind Adobe's egress-controlled IP ranges.

In Cloud, Adobe's infrastructure enforces strict egress controls, and CDN vendors like Fastly or Akamai may block requests if:

The source IP is not explicitly allowed
Required headers (like Fastly-Key, or Host) are missing
The CDN is configured to only allow purges from specific endpoints (eg. via Adobe I/O or Fastly/Akamai API)

Can you confirm if the dedicated egress IP assigned to your program is allowed to perform purge requests. Also, you may need to whitelist the IP on the Fastly side.

Also, worth checking, if your request includes all required headers (for Fastly):

- Fastly-Key: YOUR_FASTLY_API_KEY
- Host: your.site.domain

Hope that helps!

Santosh Sai

View solution in original post

SantoshSai · 4/29/25

Hi @prananshupa1,

I think, it's working in your local AEM, because, your machine sends the HTTP request directly to the dispatcher/CDN and is not behind Adobe's egress-controlled IP ranges.

In Cloud, Adobe's infrastructure enforces strict egress controls, and CDN vendors like Fastly or Akamai may block requests if:

The source IP is not explicitly allowed
Required headers (like Fastly-Key, or Host) are missing
The CDN is configured to only allow purges from specific endpoints (eg. via Adobe I/O or Fastly/Akamai API)

Can you confirm if the dedicated egress IP assigned to your program is allowed to perform purge requests. Also, you may need to whitelist the IP on the Fastly side.

Also, worth checking, if your request includes all required headers (for Fastly):

- Fastly-Key: YOUR_FASTLY_API_KEY
- Host: your.site.domain

Hope that helps!

Santosh Sai

AmitVishwakarma · 4/30/25

Hi @prananshupa1 ,

Root Cause:
In AEM as a Cloud Service, Adobe uses dedicated egress IPs with strict outbound rules. Direct HTTP PURGE requests to CDNs like Fastly or Akamai will be blocked unless:
   - The egress IP is whitelisted in the CDN configuration:
   - The request includes all required headers (e.g., Fastly-Key, Host)
   - The CDN is configured to accept purges only via their official APIs (not from random IPs)
Solution
Step 1: Avoid Raw PURGE Requests – Use Fastly or Akamai API Instead
Direct PURGE requests from AEM Cloud will almost always fail. Instead, use the CDN's API for cache invalidation.

Fastly API Endpoint: POST https://api.fastly.com/service/<SERVICE_ID>/purge/<ENCODED_URL>

Required Headers:

Fastly-Key: YOUR_FASTLY_API_KEY
Accept: application/json

Step 2: Sample Java Code (Using Fastly API)

URL url = new URL("https://api.fastly.com/service/<SERVICE_ID>/purge/<ENCODED_URL>");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setRequestProperty("Fastly-Key", "<your_api_key>");
conn.setRequestProperty("Accept", "application/json");
conn.setDoOutput(true);

int responseCode = conn.getResponseCode();
if (responseCode == 200) {
    // Successfully purged
} else {
    // Handle error
}

Step 3: Whitelist Adobe's Egress IPs

If your AEM Cloud program uses dedicated egress IPs, make sure those IPs are whitelisted in your CDN (e.g., in Fastly's dashboard under Access Control > IP Whitelisting). If not done, the API call may still be blocked.

Step 4: (Optional but Recommended) Use Adobe I/O Runtime or Adobe App Builder

For even more control and scalability, consider triggering Fastly/Akamai cache invalidation via Adobe I/O Runtime using secure, serverless functions.

Regards,
Amit

Adobe Experience Manager Sites & More

Automted CDN Cache Purge request failing

Santosh Sai

Santosh Sai

Learn

Documentation

Events

Community

Support

Resources

Adobe account

Adobe