Reference architecture
Purpose: One defensible default architecture for enterprise AEM 6.5, with the reasoning behind each choice.
Who this page is for
| Audience | Why it matters to you |
|---|---|
| Architects / tech leads | Starting point to adapt |
| All engineers | The big picture |
The default shape
Internet
│
WAF + CDN ──────────── static/edge cache, TLS, DDoS
│
Load balancer
│ │
┌──────┴───┐ ┌────┴─────┐
│ Disp 1 │ │ Disp 2 │ dispatcher tier (per publish, autoscale-ready)
│ +Publish1│ │ +Publish2│ publish tier (N≥2, sized for cold-cache peak)
└──────────┘ └──────────┘
▲
replication (per-agent)
│
┌────────────┴───────────┐
│ Author (primary) │ author tier
│ Author (cold standby) │◀─ TarMK cold standby sync
└────────────────────────┘
Shared: S3/blob datastore (binaries), artefact repo, monitoring stack, log aggregationChoices and reasoning
| Choice | Default | Because |
|---|---|---|
| Author storage | TarMK + cold standby | Simplest ops; author HA needs are usually minutes-RTO, not zero (clustering elective otherwise) |
| Publish count | ≥2, sized for cold-cache peak | One publisher must carry traffic during rolling deploys |
| Dispatcher:publish | 1:1 paired | Simple invalidation semantics, per-pair cache consistency |
| Datastore | Shared blob store (S3/Azure) | Binary-less replication, cheaper storage, easier backup |
| CDN | Always | Edge offload; the dispatcher alone is not an edge |
| WAF | In front | AEM consoles/paths are high-value probe targets |
| Networks | Author private (VPN), publish DMZ pattern | Author is never internet-facing |
Sizing starting points (validate with load tests, not faith)
Publish: 4–8 vCPU / 16–32GB (heap ~half of RAM, capped sensibly) per instance as a baseline for content sites. Author: at least publish-sized, plus headroom for workflows/DAM. Disk: fast SSD, 3–5× repo size free for compaction. Real numbers come from capacity planning ⚡.