Dedicated egress IP address

First, determine the region in which the Advanced Networking is needed, by using the Cloud Manager API listRegions operation. The region name is required to make subsequent Cloud Manager API calls. Typically, the region the Production environment resides in is used.

Find your AEM as a Cloud Service environment’s region in Cloud Manager under the environment’s details. The region name displayed in Cloud Manager can be mapped to the region code used in the Cloud Manager API.

listRegions HTTP request

$ curl -X GET https://cloudmanager.adobe.io/api/program/{programId}/regions \
    -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \
    -H 'x-api-key: <CLIENT_ID>' \
    -H 'Authorization: Bearer <ACCESS_TOKEN>' \
    -H 'Content-Type: application/json'

Enable dedicated egress IP address for a Cloud Manager Program using the Cloud Manager API createNetworkInfrastructure operation. Use the appropriate region code obtained from the Cloud Manager API listRegions operation.

createNetworkInfrastructure HTTP request

$ curl -X POST https://cloudmanager.adobe.io/api/program/{programId}/networkInfrastructures \
    -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \
    -H 'x-api-key: <CLIENT_ID>' \
    -H 'Authorization: Bearer <ACCESS_TOKEN>' \
    -H 'Content-Type: application/json' \
    -d '{ "kind": "dedicatedEgressIp", "region": "va7" }'

Wait 15 minutes for the Cloud Manager Program to provision the network infrastructure.

Check that the program has finished dedicated egress IP address configuration using the Cloud Manager API getNetworkInfrastructure operation, using the id returned from the createNetworkInfrastructure HTTP request in the previous step.

getNetworkInfrastructure HTTP request

$ curl -X GET https://cloudmanager.adobe.io/api/program/{programId}/networkInfrastructure/{networkInfrastructureId} \
    -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \
    -H 'x-api-key: <CLIENT_ID>' \
    -H 'Authorization: Bearer <ACCESS_TOKEN>' \
    -H 'Content-Type: application/json'

Verify that the HTTP response contains a status of ready. If not yet ready, recheck the status every few minutes.

Configure the dedicated egress IP address configuration on each AEM as a Cloud Service environment using the Cloud Manager API enableEnvironmentAdvancedNetworkingConfiguration operation.

enableEnvironmentAdvancedNetworkingConfiguration HTTP request

$ curl -X PUT https://cloudmanager.adobe.io/api/program/{programId}/environment/{environmentId}/advancedNetworking \
    -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \
    -H 'x-api-key: <CLIENT_ID>' \
    -H 'Authorization: Bearer <ACCESS_TOKEN>' \
    -H 'Content-Type: application/json' \
    -d @./dedicated-egress-ip-address.json

Define the JSON parameters in a dedicated-egress-ip-address.json and provided to curl via ... -d @./dedicated-egress-ip-address.json.

Download the example dedicated-egress-ip-address.json. This file only an example. Configure your file as required based on the optional/required fields documented at enableEnvironmentAdvancedNetworkingConfiguration.

{
    "nonProxyHosts": [
        "example.net",
        "*.example.org",
    ],
    "portForwards": [
        {
            "name": "mysql.example.com",
            "portDest": 3306,
            "portOrig": 30001
        },
        {
            "name": "smtp.sendgrid.net",
            "portDest": 465,
            "portOrig": 30002
        }
    ]
}

Dedicated egress IP address configuration’s HTTP signature only differs from flexible egress port in that it also supports the optional nonProxyHosts configuration.

nonProxyHosts declares a set of hosts for which port 80 or 443 should be routed through the default shared IP address ranges rather than the dedicated egress IP. nonProxyHosts may be useful as traffic egressing through shared IPs may be further optimized automatically by Adobe.

For each portForwards mapping, the advanced networking defines the following forwarding rule:

For each environment, validate the egress rules are in effect using the Cloud Manager API getEnvironmentAdvancedNetworkingConfiguration operation.

getEnvironmentAdvancedNetworkingConfiguration HTTP request

$ curl -X GET https://cloudmanager.adobe.io/api/program/{programId}/environment/{environmentId}/advancedNetworking \
    -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \
    -H 'x-api-key: <CLIENT_ID>' \
    -H 'Authorization: <YOUR_TOKEN>' \
    -H 'Content-Type: application/json'

Dedicated egress IP address configurations can be updated using the Cloud Manager API enableEnvironmentAdvancedNetworkingConfiguration operation. Remember enableEnvironmentAdvancedNetworkingConfiguration is a PUT operation, so all rules must be provided with every invocation of this operation.

Obtain the dedicated egress IP address by using a DNS Resolver (such as DNSChecker.org) on the host: p{programId}.external.adobeaemcloud.com, or by running dig from the command line.

$ dig +short p{programId}.external.adobeaemcloud.com

The hostname cannot be pinged, as it is an egress and not and ingress.

Note the dedicated egress IP address is shared by all AEM as a Cloud Service environments in the program.

Now you can use the dedicated egress IP address in your custom AEM code and configuration. Often when using dedicated egress IP address, the external services AEM as a Cloud Service connects to are configured to only allow traffic from this dedicated IP address.

• Includes HTTP/HTTPS calls made to services running on ports other than the standard 80 or 443 ports.

• Includes any non-HTTP calls, such as connections with Mail servers, SQL databases, or services that run on other non-HTTP/HTTPS protocols.