Hi @raininglemons ,
Routing egress traffic from AEM as a Cloud Service (AEMaaCS) pipelines through the same advanced network configuration used by AEM instances is not directly supported out of the box. AEMaaCS pipelines are designed to run in a CI/CD environment, which may not support the same network configurations as the managed AEM instances.
However, you have a few alternative approaches to manage and secure egress traffic from your AEMaaCS pipelines:
1. Whitelist Known IPs Used by Pipelines
Adobe does not typically provide a fixed list of IP addresses for their cloud services due to the dynamic nature of cloud environments. However, you can:
- Monitor and log the IP addresses used by the pipelines.
- Use these logs to create a list of IP addresses that you can whitelist in your firewall or access control lists.
2. Set Up a Proxy and Configure Pipelines to Use It
This approach involves setting up your own proxy server and configuring your AEMaaCS pipelines to route their traffic through this proxy. Here’s a high-level overview of how to achieve this:
Step-by-Step Setup:
Set Up a Proxy Server:
- Deploy a proxy server (e.g., Squid, HAProxy) within your network or a secure cloud environment.
- Configure the proxy server to handle and log egress traffic.
Configure Proxy Server:
- Ensure that the proxy server can handle the traffic load and has appropriate security configurations.
- Set up access controls and logging for auditing purposes.
Update Pipeline Configuration:
- Configure the AEMaaCS pipelines to use the proxy server. This is typically done by setting environment variables for HTTP/HTTPS proxies.
- Depending on the CI/CD tool used by AEMaaCS, you might set environment variables like HTTP_PROXY and HTTPS_PROXY.
Example Configuration for Proxy in AEMaaCS Pipelines:
pipeline:
environmentVariables:
HTTP_PROXY: http://your-proxy-server:port
HTTPS_PROXY: http://your-proxy-server:port
3. Use Adobe’s Advanced Networking (if Available)
If your organization has advanced networking configurations set up with Adobe, you might be able to leverage these for your pipelines as well. This would typically involve:
- Coordinating with Adobe support or your Adobe account manager to understand if this can be extended to include pipeline traffic.
- Ensuring that the configurations align with your security requirements.
Conclusion
While AEMaaCS pipelines do not natively support routing egress traffic through the same advanced network configuration as AEM instances, you can achieve controlled and secure egress traffic through:
- Whitelisting known IP addresses used by the pipelines.
- Setting up and configuring a proxy server for the pipelines to use.
- Exploring advanced networking options with Adobe if applicable.
Setting up a proxy server and configuring your pipelines to use it is often the most flexible and secure approach, allowing you to control and monitor all egress traffic effectively.
