Configuring Dedicated Egress IP for AEM Websites: A Step-by-Step Guide to Finding Your Public IP

 What is an Egress IP?

An egress IP is an IP address used for outbound traffic from a network or a specific set of devices within a network. Here are some key points about egress IPs:

- Consistent Source IP: Egress IPs ensure that traffic leaving a network appears to come from a consistent IP address, which is useful for maintaining security policies and access controls.
- Network Address Translation (NAT): They are often used in Network Address Translation (NAT) to map internal IP addresses to a single external IP address.
- Use in Cloud and Container Environments: In cloud and container environments, egress IPs can be assigned to specific namespaces or pods to control and monitor outbound traffic.

Use of Egress IP in AEM?

Typically, we require Adobe's public IP when an AEM service needs to interact with a third-party service, such as a client's internal service. In such cases, we create a public IP for the AEM service, which the client then whitelists, allowing us to directly call their service.

How to Configure Egress in AEM? Here is the detailed article which talks about the configuration.

How to retrieve the public IP after configuring Egress in AEM As Cloud

a) Obtain the dedicated egress IP address by using a DNS Resolver 

(such as DNSChecker.org) on the host: p{programId}.external.adobeaemcloud.com.

For example, if your program id is '12345' 

12345.external.adobeaemcloud.com, open dnschecker website and paste your adobe cloud external program id detail and hit search button. You will be able to see the public ip in response.

 

b) Running 'dig' from the command line.

An example AEM Cloud program given blow and its dig command

 

Execute below dig command on your command prompt.

Note: Please be aware that the dedicated egress IP address is utilized by all AEM as a Cloud Service environments within the program.

Security.txt in AEM

How do security researchers and bug hunters determine whom to contact when they discover vulnerabilities within an organization's system? Without defined reporting channels, researchers may struggle to identify where to report these vulnerabilities, leaving the organization exposed to potential attacks. However, organizations can address this challenge by following CISA's guidance and implementing a straightforward solution: the security.txt file.

Security.txt is a proposed Internet standard, RFC 9116, which concisely advertises an entity’s vulnerability disclosure process. 

Similar to robots.txt, the security.txt file is machine-readable and is typically located on a public-facing webserver, either in the root directory or the "well-known" directory. This file enables security professionals and researchers to promptly identify an organization's preferences for reporting vulnerabilities. It's important to note that each domain and subdomain within an organization's network should have its own security.txt file.

Generally, security.txt files contains below fields,

Mandatory fields:

Contact	How researchers should contact entities to report security vulnerabilities, such as email, phone number, or a web page. Entities should list contact methods by order of preference, with the first being most preferred.
Expires	Date and time after which the data contained in the "security.txt" file is considered stale and should not be used.

 

Optional fields:

 

Encryption	Link to the entity's public key (like OpenPGP) for researchers to encrypt communications with the entity.
Canonical	Canonical URIs where the “security.txt” file is located.
Acknowledgements	Link to a page where security researchers are recognized for their reports and collaboration.
Preferred-Languages	Comma-separated list of natural language in which researchers can submit reports to the entity. If the field is omitted, researchers should assume the preferred language is English. (Communication is key.) Example (for English, Spanish, and French): Preferred-Languages: en, es, fr
Policy	Link to the location of the entity’s vulnerability disclosure policy and reporting practices.
Hiring	Link to the entity’s security-related job positions.
CSAF	A link to the provider-metadata.json of your CSAF (Common Security Advisory Framework) provider. Remember to include "https://".

 

You can create a security.txt file in AEM’s content path and have rewrites to enable them. 

Ensure you make it available through inline options

Path: /dispatcher-cloud/src/conf.d/rewrites/

File: rewrite.rules

 

## content-disposition rule for security.txt

<LocationMatch ".*/.well-known/security.txt$">

    ForceType text/plain

    Header set Content-Disposition inline

</LocationMatch>