Set up push invalidation for AWS CloudFront

Push invalidation automatically purges content on the customer's production CDN (e.g. www.yourdomain.com) whenever content or code changes are made on AEM origins with the main branch in the host name (e.g. main--site--org.aem.live). Changes pushed to other origins do not trigger push invalidation.

Push invalidation is enabled by setting up the CloudFront purge credentials in the CDN section of the configuration service.

curl --request POST \
  --url https://admin.hlx.page/config/{org}/sites/{site}/cdn.json \
  --header 'content-type: application/json' \
  --data '{
 "prod": {
  "host": "{production host}",
  "type": "cloudfront",
  "distributionId": "{distributionId}",
  "accessKeyId": "{accessKeyId}",
  "secretAccessKey": "{secretAccessKey}",
  "tagInvalidationEnabled": true|false
 }
}'

Configuration properties:

NB: If Use cache tags for cache invalidation (introduced May 2026) has not been enabled on the CloudFront Distribution, invalidations by cache tag/key always trigger a purge all. It is therefore strongly recommended to enable this feature and set tagInvalidationEnabled: true in the configuration.

To create the AWS credentials:

In the AWS Console, open the IAM dashboard, then select Policies → Create policy:

In the following screen, select CloudFront as a service, and CreateInvalidation as action, then click Add ARNs to restrict the permissions to a single distribution.

Enter you Distribution Id and click on Add ARNs:

Click Next to go to the Review and create page.

Enter a name for the new policy, e.g. “AEM<YourSite>Invalidate”, and click on Create policy:

In the IAM dashboard, select Users → Create user

Enter a user name (e.g. “Invalidator”) and click on Next:

On the Set permissions pane, select Attach policies directly and select the newly created policy (“AEM<YourSite>Invalidate” in our example):

Proceed to the Next step, click on Create user and then View user:

Select the Security credentials tab and click on Create access key:

Select Third-party service, click the checkbox and proceed to Next:

Finally, copy the Access key ID and Secret access key values:

You can validate the credentials with this tool.