{"id":30678,"date":"2025-09-30T17:34:11","date_gmt":"2025-09-30T14:34:11","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/"},"modified":"2025-09-30T17:34:11","modified_gmt":"2025-09-30T14:34:11","slug":"aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/","title":{"rendered":"AWS Organizations&#8217;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131"},"content":{"rendered":"<p><body><\/p>\n<style>\n        body {\n            font-family: Arial, sans-serif;\n            line-height: 1.6;\n            color: #333;\n            max-width: 900px;\n            margin: 0 auto;\n            padding: 20px;\n        }\n        h2 {\n            color: #2c3e50;\n            margin-top: 30px;\n            padding-bottom: 10px;\n            border-bottom: 2px solid #3498db;\n        }\n        h3 {\n            color: #34495e;\n            margin-top: 25px;\n            padding-bottom: 5px;\n            border-bottom: 1px dashed #95a5a6;\n        }\n        p {\n            margin-bottom: 15px;\n            text-align: justify;\n        }\n        ul, ol {\n            margin-bottom: 15px;\n            padding-left: 20px;\n        }\n        li {\n            margin-bottom: 8px;\n        }\n        code {\n            background-color: #ecf0f1;\n            padding: 2px 4px;\n            border-radius: 4px;\n            font-family: \"Courier New\", Courier, monospace;\n            color: #c0392b;\n        }\n        pre {\n            background-color: #2d2d2d;\n            color: #f8f8f2;\n            padding: 15px;\n            border-radius: 8px;\n            overflow-x: auto;\n            margin-bottom: 20px;\n        }\n        pre code {\n            background-color: transparent;\n            color: inherit;\n            padding: 0;\n            border-radius: 0;\n        }\n        table {\n            width: 100%;\n            border-collapse: collapse;\n            margin-bottom: 20px;\n            background-color: #ffffff;\n            box-shadow: 0 2px 5px rgba(0,0,0,0.1);\n        }\n        th, td {\n            border: 1px solid #ddd;\n            padding: 10px;\n            text-align: left;\n        }\n        th {\n            background-color: #f2f2f2;\n            font-weight: bold;\n            color: #333;\n        }\n        tr:nth-child(even) {\n            background-color: #f9f9f9;\n        }\n        .expert-tip {\n            background-color: #e8f6f3;\n            border-left: 5px solid #1abc9c;\n            padding: 15px;\n            margin: 20px 0;\n            border-radius: 5px;\n            font-style: italic;\n            color: #2c3e50;\n        }\n        .faq-section {\n            margin-top: 40px;\n            border-top: 2px solid #bdc3c7;\n            padding-top: 20px;\n        }\n        .faq-question {\n            font-weight: bold;\n            color: #34495e;\n            margin-top: 15px;\n        }\n        .faq-answer {\n            margin-left: 20px;\n            margin-bottom: 10px;\n        }<\/p>\n<p>        \/* Mobil Uyumlu Tasar\u0131m *\/\n        @media (max-width: 768px) {\n            body {\n                padding: 15px;\n            }\n            h2 {\n                font-size: 24px;\n            }\n            h3 {\n                font-size: 20px;\n            }\n            table, thead, tbody, th, td, tr {\n                display: block;\n            }\n            thead tr {\n                position: absolute;\n                top: -9999px;\n                left: -9999px;\n            }\n            tr {\n                border: 1px solid #ccc;\n                margin-bottom: 10px;\n            }\n            td {\n                border: none;\n                border-bottom: 1px solid #eee;\n                position: relative;\n                padding-left: 50%;\n                text-align: right;\n            }\n            td:before {\n                position: absolute;\n                top: 6px;\n                left: 6px;\n                width: 45%;\n                padding-right: 10px;\n                white-space: nowrap;\n                content: attr(data-label);\n                font-weight: bold;\n                text-align: left;\n            }\n            .expert-tip {\n                padding: 10px;\n            }\n        }\n    <\/style>\n<p>AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.<\/p>\n<p>Modern bulut altyap\u0131lar\u0131, \u00f6zellikle AWS gibi dinamik ve \u00f6l\u00e7eklenebilir platformlar, i\u015fletmelere b\u00fcy\u00fck esneklik sunar. Ancak bu esneklik, beraberinde karma\u015f\u0131k g\u00fcvenlik y\u00f6netimi zorluklar\u0131n\u0131 da getirir. B\u00fcy\u00fck \u015firketler ve kurumsal yap\u0131lar genellikle \u00e7ok say\u0131da AWS hesab\u0131na, ekibine ve projesine sahip olur. Bu durum, merkezi bir y\u00f6netim ekibinin t\u00fcm bu hesaplardaki IAM (Kimlik ve Eri\u015fim Y\u00f6netimi) rollerini ve politikalar\u0131n\u0131 do\u011frudan y\u00f6netmesini son derece zorla\u015ft\u0131r\u0131r.<\/p>\n<p>\u00d6rne\u011fin, bir geli\u015ftirme ekibinin kendi projeleri i\u00e7in belirli AWS kaynaklar\u0131na (\u00f6rne\u011fin EC2, S3, Lambda) ihtiya\u00e7 duydu\u011funu d\u00fc\u015f\u00fcnelim. Y\u00f6netim ekibi, geli\u015ftiricilere ihtiya\u00e7 duyduklar\u0131 rolleri olu\u015fturma yetkisi vermek isteyebilir; ancak bu yetkinin s\u0131n\u0131rl\u0131 ve kontrol edilebilir olmas\u0131n\u0131 da arzu eder. Aksi takdirde, bir geli\u015ftirici istemeden veya bilerek \u00e7ok geni\u015f yetkilere sahip bir rol olu\u015fturabilir ve bu da ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. \u0130\u015fte bu noktada delegasyon devreye girer. Delegasyon, belirli g\u00f6rev ve sorumluluklar\u0131 daha alt seviyedeki ekiplere veya hesaplara devretme s\u00fcrecidir. Ancak bu delegasyonun g\u00fcvenli bir \u015fekilde yap\u0131lmas\u0131 hayati \u00f6nem ta\u015f\u0131r. Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f bir delegasyon modeli, &#8220;yetki t\u0131rmanmas\u0131&#8221; (privilege escalation) riskini beraberinde getirir. Yani, ba\u015flang\u0131\u00e7ta s\u0131n\u0131rl\u0131 yetkili bir kullan\u0131c\u0131 veya rol, kendine daha geni\u015f yetkiler tan\u0131mlayabilme imkan\u0131na sahip olabilir. Bu, bulut g\u00fcvenli\u011findeki en b\u00fcy\u00fck endi\u015felerden biridir.<\/p>\n<p>AWS Organizations y\u00f6netim hesab\u0131nda, t\u00fcm organizasyon i\u00e7in g\u00fcvenlik ve maliyet y\u00f6netimi gibi merkezi fonksiyonlar bulunur. Bu hesap, genellikle en y\u00fcksek yetkilere sahip hesap oldu\u011fundan, burada yap\u0131lan her de\u011fi\u015fikli\u011fin titizlikle denetlenmesi gerekir. Bu nedenle, alt hesaplara veya belirli ekiplere rol olu\u015fturma yetkisi verirken, y\u00f6netim hesab\u0131n\u0131n kendi g\u00fcvenlik duru\u015funu tehlikeye atmadan bu i\u015flemi ger\u00e7ekle\u015ftirmesi zorunludur. Y\u00f6netim hesab\u0131ndaki bir rol, yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetli bir \u015fekilde, t\u00fcm AWS Organizations yap\u0131s\u0131 \u00fczerinde \u00e7ok geni\u015f yetkiler kazanabilir. Bu durum, organizasyonun genel g\u00fcvenlik post\u00fcr\u00fcn\u00fc zay\u0131flat\u0131r ve uyumluluk gereksinimlerini kar\u015f\u0131lamay\u0131 zorla\u015ft\u0131r\u0131r. \u0130\u015fte bu t\u00fcr senaryolarda, \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries) gibi geli\u015fmi\u015f IAM \u00f6zellikleri devreye girerek, delegasyonun kontrol alt\u0131nda tutulmas\u0131n\u0131 sa\u011flar ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n \u00f6n\u00fcne ge\u00e7er. Dolay\u0131s\u0131yla, g\u00fcvenli ve \u00f6l\u00e7eklenebilir bir bulut ortam\u0131 i\u00e7in, yetki delegasyonunu do\u011fru ara\u00e7larla ve do\u011fru stratejilerle y\u00f6netmek kritik \u00f6neme sahiptir.<\/p>\n<h2>Temel Kavramlar: AWS IAM Rolleri ve \u0130zin S\u0131n\u0131rlar\u0131 Nelerdir?<\/h2>\n<p>AWS bulut ortamlar\u0131nda kimlik ve eri\u015fim y\u00f6netimi (IAM), kaynaklara kimin, ne zaman ve ne \u015fekilde eri\u015febilece\u011fini belirleyen temel g\u00fcvenlik hizmetidir. IAM&#8217;in iki ana bile\u015feni kullan\u0131c\u0131lar ve rollerdir. Kullan\u0131c\u0131lar genellikle bireysel ki\u015filerle e\u015fle\u015firken, roller uygulamalar, hizmetler veya ge\u00e7ici olarak yetki almas\u0131 gereken kullan\u0131c\u0131lar i\u00e7in tasarlanm\u0131\u015ft\u0131r. Bu b\u00f6l\u00fcmde, IAM rollerini ve ard\u0131ndan \u0130zin S\u0131n\u0131rlar\u0131 kavram\u0131n\u0131 detayl\u0131ca inceleyece\u011fiz.<\/p>\n<h3>IAM Rolleri Nas\u0131l \u00c7al\u0131\u015f\u0131r ve Neden \u00d6nemlidir?<\/h3>\n<p>IAM rolleri, AWS&#8217;te ge\u00e7ici ve yetkilendirilmi\u015f eri\u015fim sa\u011flaman\u0131n en g\u00fcvenli ve esnek yoludur. Bir rol, belirli bir AWS hesab\u0131 i\u00e7indeki veya hesaplar aras\u0131 g\u00fcven ili\u015fkisiyle ba\u015fka bir hesaptaki kaynaklara eri\u015fmek i\u00e7in kullan\u0131labilecek izinler k\u00fcmesidir. Rollerin \u00f6nemi, kullan\u0131c\u0131 kimlik bilgileri (kullan\u0131c\u0131 ad\u0131 ve \u015fifre) gerektirmemelerinden kaynaklan\u0131r. Bunun yerine, bir varl\u0131k (kullan\u0131c\u0131, uygulama veya AWS hizmeti) bir rol\u00fc \u00fcstlendi\u011finde, o rol\u00fcn tan\u0131mlad\u0131\u011f\u0131 ge\u00e7ici g\u00fcvenlik kimlik bilgilerini (ge\u00e7ici eri\u015fim anahtar\u0131, gizli eri\u015fim anahtar\u0131 ve oturum belirteci) al\u0131r. Bu ge\u00e7ici kimlik bilgileri belirli bir s\u00fcre sonra otomatik olarak sona erer, bu da uzun \u00f6m\u00fcrl\u00fc ve \u00e7al\u0131nma riski ta\u015f\u0131yan kimlik bilgilerine olan ihtiyac\u0131 ortadan kald\u0131r\u0131r.<\/p>\n<p>Rollerin temel avantajlar\u0131 \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Ge\u00e7ici Yetkilendirme:<\/strong> Uzun \u00f6m\u00fcrl\u00fc kimlik bilgileri y\u00f6netimi ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r.<\/li>\n<li><strong>Hesaplar Aras\u0131 Eri\u015fim:<\/strong> Farkl\u0131 AWS hesaplar\u0131 aras\u0131nda g\u00fcvenli ve kontroll\u00fc kaynak eri\u015fimi sa\u011flar.<\/li>\n<li><strong>Hizmet Yetkilendirmesi:<\/strong> EC2, Lambda gibi AWS hizmetlerinin di\u011fer AWS kaynaklar\u0131na g\u00fcvenli bir \u015fekilde eri\u015fmesini sa\u011flar.<\/li>\n<li><strong>Least Privilege (En Az Ayr\u0131cal\u0131k) \u0130lkesi:<\/strong> Yaln\u0131zca bir g\u00f6revi yerine getirmek i\u00e7in gereken minimum izinleri vererek g\u00fcvenlik riskini azalt\u0131r.<\/li>\n<\/ul>\n<p>\u00d6rne\u011fin, bir Lambda fonksiyonunun bir S3 bucket&#8217;\u0131na yazmas\u0131 gerekti\u011finde, bu Lambda fonksiyonuna \u00f6zel bir IAM rol\u00fc atan\u0131r ve bu rol yaln\u0131zca o S3 bucket&#8217;\u0131na yazma izni verir. Bu, Lambda fonksiyonunun di\u011fer hassas kaynaklara eri\u015fmesini engeller.<\/p>\n<h3>\u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries) Nedir ve Nas\u0131l Fark Yarat\u0131r?<\/h3>\n<p>\u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), AWS IAM&#8217;de bir kimli\u011fin (kullan\u0131c\u0131 veya rol) sahip olabilece\u011fi maksimum izinleri belirlemek i\u00e7in kullan\u0131lan geli\u015fmi\u015f bir \u00f6zelliktir. Kendi ba\u015f\u0131na bir izin verme mekanizmas\u0131 de\u011fildir; aksine, varl\u0131\u011fa (kullan\u0131c\u0131 veya rol) eklenmi\u015f olan di\u011fer t\u00fcm izin politikalar\u0131n\u0131n izinlerini k\u0131s\u0131tlayan bir &#8220;\u00fcst limit&#8221; g\u00f6revi g\u00f6r\u00fcr. Yani, bir kimli\u011fe hem bir izin politikas\u0131 hem de bir izin s\u0131n\u0131r\u0131 eklenmi\u015fse, kimli\u011fin etkili izinleri, her iki politikada da a\u00e7\u0131k\u00e7a izin verilen eylemlerin kesi\u015fimi olacakt\u0131r. E\u011fer bir eylem izin politikalar\u0131nda izin verilmi\u015f ancak izin s\u0131n\u0131r\u0131nda a\u00e7\u0131k\u00e7a reddedilmi\u015fse veya izin s\u0131n\u0131r\u0131nda hi\u00e7 bahsedilmemi\u015fse, o eylem ger\u00e7ekle\u015ftirilemez.<\/p>\n<p>Bu konsepti bir \u00f6rnekle a\u00e7\u0131klayal\u0131m: Bir geli\u015ftiriciye &#8220;t\u00fcm EC2 i\u015flemlerini yapabilir&#8221; izni veren bir politika atad\u0131\u011f\u0131n\u0131z\u0131 d\u00fc\u015f\u00fcn\u00fcn. Ancak ayn\u0131 geli\u015ftiriciye, &#8220;yaln\u0131zca belirli bir VPC i\u00e7indeki EC2&#8217;leri y\u00f6netebilir&#8221; \u015feklinde bir izin s\u0131n\u0131r\u0131 atarsan\u0131z, geli\u015ftirici t\u00fcm EC2 i\u015flemlerini yapma iznine sahip olsa bile, izin s\u0131n\u0131r\u0131 nedeniyle yaln\u0131zca belirli VPC i\u00e7indeki kaynaklarda i\u015flem yapabilecektir. Bu, \u00f6zellikle y\u00f6netim hesaplar\u0131nda veya yetki devri senaryolar\u0131nda, alt ekiplerin kendilerine veya ba\u015fkalar\u0131na gere\u011finden fazla yetki atamas\u0131n\u0131 engellemek i\u00e7in inan\u0131lmaz derecede g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r.<\/p>\n<p>\u0130zin S\u0131n\u0131rlar\u0131&#8217;n\u0131n temel faydalar\u0131 \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>G\u00fcvenli Yetki Delegasyonu:<\/strong> Y\u00f6neticilerin, belirli alt ekiplere veya hesaplara rol olu\u015fturma veya politika ekleme yetkisi verirken, bu yetkinin kapsam\u0131n\u0131 net bir \u015fekilde s\u0131n\u0131rlamas\u0131n\u0131 sa\u011flar.<\/li>\n<li><strong>&#8220;Privilege Escalation&#8221;\u0131 \u00d6nleme:<\/strong> Bir kullan\u0131c\u0131n\u0131n veya rol\u00fcn kendi izinlerini art\u0131rmas\u0131n\u0131 (\u00f6rne\u011fin kendine y\u00f6netici yetkisi vermesini) engeller.<\/li>\n<li><strong>Merkezi G\u00fcvenlik Politikas\u0131 Uygulamas\u0131:<\/strong> Organizasyon genelinde g\u00fcvenlik uyumluluk kurallar\u0131n\u0131n tutarl\u0131 bir \u015fekilde uygulanmas\u0131na yard\u0131mc\u0131 olur.<\/li>\n<li><strong>Basitle\u015ftirilmi\u015f G\u00fcvenlik Denetimi:<\/strong> Etkili izinleri analiz etmeyi kolayla\u015ft\u0131r\u0131r, \u00e7\u00fcnk\u00fc bir rol\u00fcn ne yapabilece\u011fi hem rol\u00fcn kendi politikalar\u0131 hem de izin s\u0131n\u0131r\u0131 taraf\u0131ndan belirlenir.<\/li>\n<\/ul>\n<p>\u00d6zetle, IAM rolleri belirli g\u00f6revler i\u00e7in yetkilendirme sa\u011flarken, \u0130zin S\u0131n\u0131rlar\u0131 bu yetkilendirmenin \u00fcst s\u0131n\u0131r\u0131n\u0131 belirleyerek g\u00fcvenli\u011fi daha da s\u0131k\u0131la\u015ft\u0131r\u0131r. Bu iki kavram\u0131n birle\u015fimi, AWS ortamlar\u0131nda sa\u011flam ve \u00f6l\u00e7eklenebilir bir g\u00fcvenlik duru\u015fu olu\u015fturmak i\u00e7in vazge\u00e7ilmezdir.<\/p>\n<h2>Neden AWS Organizations Y\u00f6netim Hesab\u0131nda \u0130zin S\u0131n\u0131rlar\u0131 Kullanmal\u0131y\u0131z?<\/h2>\n<p>AWS Organizations, birden fazla AWS hesab\u0131n\u0131 merkezi olarak y\u00f6netmenizi sa\u011flayan g\u00fc\u00e7l\u00fc bir hizmettir. Organizasyon i\u00e7indeki t\u00fcm hesaplar \u00fczerinde politika y\u00f6netimi, faturaland\u0131rma birle\u015ftirme ve merkezi g\u00fcvenlik kontrolleri gibi \u00f6zellikler sunar. Y\u00f6netim hesab\u0131, bu yap\u0131n\u0131n merkezindedir ve en y\u00fcksek ayr\u0131cal\u0131klara sahip olma e\u011filimindedir. Bu durum, y\u00f6netim hesab\u0131nda olu\u015fturulan IAM rollerinin ve verilen yetkilerin \u00f6zel bir dikkatle ele al\u0131nmas\u0131n\u0131 gerektirir.<\/p>\n<h3>Y\u00f6netim Hesab\u0131ndaki Hassasiyet ve Riskler<\/h3>\n<p>Y\u00f6netim hesab\u0131 (Master\/Payer account), t\u00fcm organizasyonun k\u00f6k hesab\u0131d\u0131r. Bu hesapta herhangi bir g\u00fcvenlik ihlali, t\u00fcm ba\u011fl\u0131 hesaplara yay\u0131larak felaketle sonu\u00e7lanabilecek bir etki yaratabilir. Y\u00f6netim hesab\u0131ndaki bir kullan\u0131c\u0131 veya rol\u00fcn a\u015f\u0131r\u0131 geni\u015f yetkilere sahip olmas\u0131, a\u015fa\u011f\u0131daki ciddi riskleri beraberinde getirir:<\/p>\n<ul>\n<li><strong>Hesaplar Aras\u0131 Yetki T\u0131rmanmas\u0131:<\/strong> Y\u00f6netim hesab\u0131ndaki bir varl\u0131k, di\u011fer ba\u011fl\u0131 hesaplardaki kaynaklara eri\u015fimi art\u0131rabilir, hatta kendilerine y\u00f6netici yetkileri atayabilir.<\/li>\n<li><strong>Merkezi Politika \u0130hlali:<\/strong> AWS Organizations&#8217;\u0131n Service Control Policies (SCP&#8217;ler) gibi merkezi g\u00fcvenlik politikalar\u0131n\u0131 bypass etme potansiyeli.<\/li>\n<li><strong>Yanl\u0131\u015fl\u0131kla Geni\u015f Yetki Verme:<\/strong> Geli\u015ftiriciler veya operasyon ekipleri, kendi g\u00f6revlerini yerine getirmek i\u00e7in rol olu\u015fturma veya politika ekleme yetkisine ihtiya\u00e7 duyabilir. Ancak bu yetkiyi s\u0131n\u0131rs\u0131z vermek, istemeden veya bilmeden g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7an \u00e7ok geni\u015f rollerin olu\u015fturulmas\u0131na neden olabilir.<\/li>\n<li><strong>Uyumsuzluk Riski:<\/strong> S\u0131k\u0131 d\u00fczenleyici gereksinimleri olan sekt\u00f6rlerde (finans, sa\u011fl\u0131k vb.), y\u00f6netim hesab\u0131ndaki yetkilerin tam kontrol\u00fc ve denetlenebilirli\u011fi hayati \u00f6neme sahiptir. \u0130zin S\u0131n\u0131rlar\u0131 olmadan bu kontrol\u00fc sa\u011flamak \u00e7ok daha zordur.<\/li>\n<\/ul>\n<h3>\u0130zin S\u0131n\u0131rlar\u0131n\u0131n Sundu\u011fu \u00c7\u00f6z\u00fcmler ve Avantajlar<\/h3>\n<p>\u0130\u015fte bu riskleri minimize etmek ve y\u00f6netim hesab\u0131ndaki g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirmek i\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 kritik bir rol oynar. \u0130zin S\u0131n\u0131rlar\u0131 kullanarak, y\u00f6netim hesab\u0131nda yetki devri yaparken bile kontrol\u00fc elinizde tutabilirsiniz. Bunun ba\u015fl\u0131ca nedenleri ve avantajlar\u0131 \u015funlard\u0131r:<\/p>\n<ol>\n<li><strong>&#8220;Never Exceed&#8221; Prensibinin Uygulanmas\u0131:<\/strong> \u0130zin S\u0131n\u0131rlar\u0131, bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n hi\u00e7bir zaman a\u015famayaca\u011f\u0131 maksimum izin setini tan\u0131mlar. Bu sayede, alt ekiplere &#8220;rol olu\u015fturma&#8221; yetkisi verdi\u011finizde dahi, olu\u015fturacaklar\u0131 rollerin belirli bir izin k\u00fcmesinin d\u0131\u015f\u0131na \u00e7\u0131kamayaca\u011f\u0131n\u0131 garanti alt\u0131na al\u0131rs\u0131n\u0131z. \u00d6rne\u011fin, bir ekip sadece EC2 ve S3 kaynaklar\u0131 \u00fczerinde i\u015flem yapacak roller olu\u015fturabilir; asla IAM veya Organizations \u00fczerinde yetki atayamaz.<\/li>\n<li><strong>G\u00fcvenli Delegasyon Modeli:<\/strong> Bir merkezi g\u00fcvenlik ekibi, \u0130zin S\u0131n\u0131rlar\u0131 tan\u0131mlayarak di\u011fer ekiplerin kendi ihtiya\u00e7lar\u0131na uygun IAM rolleri olu\u015fturmas\u0131na izin verebilir. Bu, merkezi ekibin i\u015f y\u00fck\u00fcn\u00fc azalt\u0131rken, yerel ekiplere \u00f6zerklik verir ve &#8220;h\u0131zl\u0131 hareket etme&#8221; kabiliyetini korur. Delegasyon, g\u00fcvenli bir \u00e7er\u00e7evede ger\u00e7ekle\u015fir.<\/li>\n<li><strong>&#8220;Privilege Escalation&#8221;\u0131n \u00d6nlenmesi:<\/strong> Bir IAM rol\u00fc olu\u015fturma yetkisine sahip k\u00f6t\u00fc niyetli bir kullan\u0131c\u0131 veya uygulama, kendisi i\u00e7in geni\u015f yetkilere sahip bir rol olu\u015fturmaya \u00e7al\u0131\u015fabilir. Ancak, y\u00f6netim hesab\u0131nda \u0130zin S\u0131n\u0131rlar\u0131 uyguland\u0131\u011f\u0131nda, olu\u015fturulacak yeni rollerin izinleri, atanm\u0131\u015f \u0130zin S\u0131n\u0131r\u0131 taraf\u0131ndan otomatik olarak k\u0131s\u0131tlan\u0131r. Bu, bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n, do\u011frudan veya dolayl\u0131 olarak, kendisine izin s\u0131n\u0131r\u0131n\u0131n izin verdi\u011finden daha fazla yetki atamas\u0131n\u0131 engeller.<\/li>\n<li><strong>Organizasyonel Uyum ve Standartla\u015ft\u0131rma:<\/strong> Organizasyonunuz genelinde tutarl\u0131 g\u00fcvenlik standartlar\u0131 ve en iyi uygulamalar\u0131 zorunlu k\u0131lmak i\u00e7in \u0130zin S\u0131n\u0131rlar\u0131n\u0131 kullanabilirsiniz. \u00d6rne\u011fin, t\u00fcm yeni rollerin bir belirli etiketleme standard\u0131na uymas\u0131n\u0131 veya hassas veri eri\u015fimi olan rollerin Multi-Factor Authentication (MFA) gerektirmesini zorunlu k\u0131lan \u0130zin S\u0131n\u0131rlar\u0131 olu\u015fturulabilir.<\/li>\n<li><strong>Geli\u015fmi\u015f Denetlenebilirlik ve Uyumluluk:<\/strong> \u0130zin S\u0131n\u0131rlar\u0131, bir rol\u00fcn etkili izin setini daha \u015feffaf hale getirir. Bu, denetimler s\u0131ras\u0131nda bir rol\u00fcn neden belirli bir eylemi yap\u0131p yapamad\u0131\u011f\u0131n\u0131 anlamay\u0131 kolayla\u015ft\u0131r\u0131r. Uyumluluk denet\u00e7ileri i\u00e7in, g\u00fcvenlik politikalar\u0131n\u0131n nas\u0131l uyguland\u0131\u011f\u0131n\u0131 g\u00f6stermek daha basittir.<\/li>\n<\/ol>\n<p>Sonu\u00e7 olarak, AWS Organizations y\u00f6netim hesab\u0131nda \u0130zin S\u0131n\u0131rlar\u0131 kullanmak, delegasyonun faydalar\u0131ndan yararlan\u0131rken ayn\u0131 zamanda en y\u00fcksek g\u00fcvenlik seviyesini koruman\u0131z\u0131 sa\u011flar. Bu, b\u00fcy\u00fck ve karma\u015f\u0131k AWS ortamlar\u0131nda g\u00fcvenli\u011fin temel direklerinden biridir ve &#8220;least privilege&#8221; ilkesini daha g\u00fc\u00e7l\u00fc bir \u015fekilde uygulaman\u0131za olanak tan\u0131r.<\/p>\n<div class=\"expert-tip\">\n        Uzman \u0130pucu: \u0130zin S\u0131n\u0131rlar\u0131 yaln\u0131zca bir &#8220;\u00fcst limit&#8221;tir. Rol\u00fcn kendisine atanm\u0131\u015f politikalar, s\u0131n\u0131r\u0131n i\u00e7inde kalarak ger\u00e7ek izinlerini belirler. Yani, s\u0131n\u0131r geni\u015f olsa bile, role az izin verilirse, rol yine de az yetkiye sahip olur.\n    <\/div>\n<h2>Bir IAM \u0130zin S\u0131n\u0131r\u0131 Politikas\u0131 Nas\u0131l Olu\u015fturulur ve Uygulan\u0131r?<\/h2>\n<p>\u0130zin S\u0131n\u0131rlar\u0131&#8217;n\u0131n teorik faydalar\u0131n\u0131 anlad\u0131ktan sonra, \u015fimdi pratik uygulamas\u0131na ge\u00e7elim. Bir \u0130zin S\u0131n\u0131r\u0131 olu\u015fturmak ve bunu IAM rollerine uygulamak, san\u0131ld\u0131\u011f\u0131 kadar karma\u015f\u0131k de\u011fildir ancak dikkatli bir planlama ve uygulama gerektirir. Bu b\u00f6l\u00fcmde, ad\u0131m ad\u0131m bir \u0130zin S\u0131n\u0131r\u0131 politikas\u0131 olu\u015fturma ve bunu yeni bir IAM rol\u00fcne nas\u0131l atayaca\u011f\u0131n\u0131z\u0131 g\u00f6sterece\u011fiz.<\/p>\n<h3>Ad\u0131m 1: \u0130zin S\u0131n\u0131r\u0131 Politikas\u0131n\u0131 Tan\u0131mlama ve Olu\u015fturma<\/h3>\n<p>\u0130zin S\u0131n\u0131r\u0131, asl\u0131nda standart bir IAM y\u00f6netilen (managed) politikas\u0131d\u0131r. Bu politika, bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n \u00fcstlenebilece\u011fi maksimum izinleri i\u00e7erir. Yani, bu politikada &#8220;izin verilen&#8221; eylemler, rol\u00fcn \u00fcst s\u0131n\u0131r\u0131n\u0131 olu\u015fturur. Politikan\u0131z\u0131 tasarlarken, delegasyon yapmak istedi\u011finiz ekiplerin ne t\u00fcr AWS kaynaklar\u0131 \u00fczerinde i\u015flem yapmas\u0131na izin vermek istedi\u011finizi \u00e7ok net belirlemelisiniz. \u00d6rne\u011fin, bir geli\u015ftirme ekibinin yaln\u0131zca EC2 ve S3 hizmetlerinde i\u015flem yapabilen roller olu\u015fturmas\u0131n\u0131 istiyorsak, \u0130zin S\u0131n\u0131r\u0131 politikam\u0131z bu hizmetlerin d\u0131\u015f\u0131ndaki i\u015flemleri otomatik olarak k\u0131s\u0131tlamal\u0131d\u0131r.<\/p>\n<p>A\u015fa\u011f\u0131da, bir geli\u015ftirme ekibinin IAM rolleri olu\u015ftururken yaln\u0131zca belirli hizmetleri kullanmas\u0131na izin veren basit bir \u0130zin S\u0131n\u0131r\u0131 politikas\u0131 \u00f6rne\u011fi bulunmaktad\u0131r. Bu politika, olu\u015fturulan rollerin hi\u00e7bir zaman IAM, Organizations veya tam y\u00f6netici yetkisi (<code>*:*<\/code>) gibi hassas eylemleri i\u00e7eren izinlere sahip olmamas\u0131n\u0131 sa\u011flar.<\/p>\n<pre><code>\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"RestrictSensitiveActions\",\n            \"Effect\": \"Deny\",\n            \"Action\": [\n                \"iam:*\",\n                \"organizations:*\",\n                \"cloudtrail:DeleteTrail\",\n                \"cloudtrail:StopLogging\",\n                \"sns:Publish\",\n                \"s3:DeleteBucketPolicy\",\n                \"s3:PutBucketPolicy\",\n                \"s3:PutBucketPublicAccessBlock\",\n                \"s3:PutAccountPublicAccessBlock\",\n                \"s3:PutBucketAcl\",\n                \"s3:DeleteBucketAcl\",\n                \"s3:PutBucketVersioning\",\n                \"s3:DeleteBucketVersioning\",\n                \"s3:PutBucketWebsite\",\n                \"s3:DeleteBucketWebsite\",\n                \"s3:PutObjectAcl\",\n                \"s3:DeleteObjectAcl\",\n                \"ec2:DeleteInternetGateway\",\n                \"ec2:DeleteNetworkAcl\",\n                \"ec2:DeleteRouteTable\",\n                \"ec2:DeleteSecurityGroup\",\n                \"ec2:DeleteVpc\",\n                \"ec2:DetachInternetGateway\",\n                \"kms:DeleteAlias\",\n                \"kms:DisableKey\",\n                \"kms:ScheduleKeyDeletion\",\n                \"kms:CancelKeyDeletion\"\n            ],\n            \"Resource\": \"*\",\n            \"Condition\": {\n                \"Null\": {\n                    \"aws:TagKeys\": \"false\"\n                }\n            }\n        },\n        {\n            \"Sid\": \"AllowSafeActions\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"ec2:*\",\n                \"s3:*\",\n                \"lambda:*\",\n                \"rds:*\",\n                \"dynamodb:*\",\n                \"sqs:*\",\n                \"sns:*\",\n                \"logs:*\",\n                \"cloudwatch:*\",\n                \"ssm:*\",\n                \"secretsmanager:*\",\n                \"kms:Describe*\",\n                \"kms:Encrypt\",\n                \"kms:Decrypt\",\n                \"kms:GenerateDataKey*\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Sid\": \"RequireMFAForSensitiveActions\",\n            \"Effect\": \"Deny\",\n            \"Action\": [\n                \"s3:DeleteObject\",\n                \"s3:DeleteBucket\"\n            ],\n            \"Resource\": \"*\",\n            \"Condition\": {\n                \"BoolIfExists\": {\n                    \"aws:MultiFactorAuthPresent\": \"false\"\n                }\n            }\n        }\n    ]\n}\n    <\/pre>\n<p><\/code><\/p>\n<p>Bu politika, baz\u0131 hassas IAM ve Organizations eylemlerini a\u00e7\u0131k\u00e7a yasaklaman\u0131n yan\u0131 s\u0131ra, genellikle geli\u015ftiricilerin ihtiya\u00e7 duydu\u011fu hizmetlere (EC2, S3, Lambda vb.) genel eri\u015fim sa\u011flar. Ayr\u0131ca, belirli kritik S3 silme i\u015flemleri i\u00e7in MFA (\u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama) kullan\u0131m\u0131n\u0131 zorunlu k\u0131lar, bu da ekstra bir g\u00fcvenlik katman\u0131 ekler. Politikan\u0131n <code>Deny<\/code> b\u00f6l\u00fcm\u00fcndeki <code>Condition<\/code> ifadesi (<code>\"Condition\": { \"Null\": { \"aws:TagKeys\": \"false\" } }<\/code>), bu \u00f6zel reddetme kural\u0131n\u0131n yaln\u0131zca belirtilen etiket anahtar\u0131 mevcut olmad\u0131\u011f\u0131nda uygulanaca\u011f\u0131n\u0131 belirtir. Bu, daha karma\u015f\u0131k politika y\u00f6netimi senaryolar\u0131nda faydal\u0131 olabilir, \u00f6rne\u011fin belirli etiketlere sahip kaynaklarda daha esnek davran\u0131lmas\u0131na izin verirken di\u011ferlerinde kat\u0131 k\u0131s\u0131tlamalar uygulamak gibi.<\/p>\n<p>Politikay\u0131 olu\u015fturmak i\u00e7in AWS IAM konsoluna gidin, \"Policies\" b\u00f6l\u00fcm\u00fcne t\u0131klay\u0131n ve \"Create policy\" d\u00fc\u011fmesine bas\u0131n. JSON sekmesini se\u00e7in ve yukar\u0131daki JSON i\u00e7eri\u011fini yap\u0131\u015ft\u0131r\u0131n. Politikaya anlaml\u0131 bir isim verin, \u00f6rne\u011fin <code>DevTeamPermissionBoundary<\/code>. Daha sonra politikay\u0131 kaydedin.<\/p>\n<h3>Ad\u0131m 2: IAM Rol\u00fc Olu\u015ftururken \u0130zin S\u0131n\u0131r\u0131n\u0131 Uygulama<\/h3>\n<p>\u0130zin S\u0131n\u0131r\u0131 politikas\u0131n\u0131 olu\u015fturduktan sonra, s\u0131ra onu yeni olu\u015fturaca\u011f\u0131n\u0131z IAM rollerine atamaya gelir. Bu, bir rol olu\u015fturma s\u00fcrecinin bir par\u00e7as\u0131d\u0131r ve konsol, CLI veya SDK arac\u0131l\u0131\u011f\u0131yla yap\u0131labilir.<\/p>\n<h4>AWS Konsolu \u00dczerinden Uygulama:<\/h4>\n<ol>\n<li>IAM konsoluna gidin ve \"Roles\" b\u00f6l\u00fcm\u00fcne t\u0131klay\u0131n.<\/li>\n<li>\"Create role\" d\u00fc\u011fmesine bas\u0131n.<\/li>\n<li>Rol\u00fcn g\u00fcvenilir varl\u0131\u011f\u0131n\u0131 (trusted entity) se\u00e7in (\u00f6rne\u011fin, \"AWS service\" veya \"Another AWS account\").<\/li>\n<li>\u0130zinleri ekleme ad\u0131m\u0131 s\u0131ras\u0131nda, \"Add permissions\" veya \"Attach permissions policies\" b\u00f6l\u00fcm\u00fcne gelmeden \u00f6nce sayfan\u0131n alt k\u0131sm\u0131nda \"Permissions boundary - optional\" b\u00f6l\u00fcm\u00fcn\u00fc g\u00f6receksiniz.<\/li>\n<li>\"Set permissions boundary\" se\u00e7ene\u011fini etkinle\u015ftirin ve arama \u00e7ubu\u011funu kullanarak Ad\u0131m 1'de olu\u015fturdu\u011funuz <code>DevTeamPermissionBoundary<\/code> politikas\u0131n\u0131 se\u00e7in.<\/li>\n<li>Daha sonra, bu role atamak istedi\u011finiz di\u011fer standart izin politikalar\u0131n\u0131 se\u00e7in. Unutmay\u0131n, bu politikalar\u0131n izinleri, \u0130zin S\u0131n\u0131r\u0131 taraf\u0131ndan belirlenen \u00fcst s\u0131n\u0131r\u0131 a\u015famayacakt\u0131r.<\/li>\n<li>Rol ad\u0131n\u0131 belirleyin ve rol\u00fc olu\u015fturma i\u015flemini tamamlay\u0131n.<\/li>\n<\/ol>\n<p>Bu ad\u0131mlar\u0131 takip ederek, yeni olu\u015fturulan her rol, hem kendi izin politikalar\u0131 hem de atad\u0131\u011f\u0131n\u0131z \u0130zin S\u0131n\u0131r\u0131 taraf\u0131ndan k\u0131s\u0131tlanacakt\u0131r. Bu y\u00f6ntem, y\u00f6netim hesab\u0131ndaki IAM rol\u00fc olu\u015fturma delegasyonunu g\u00fcvenli bir \u015fekilde yapman\u0131z\u0131 sa\u011flar.<\/p>\n<h4>AWS CLI \u00dczerinden Uygulama:<\/h4>\n<p>E\u011fer otomasyon ve Infrastructure as Code (IaC) yakla\u015f\u0131mlar\u0131n\u0131 kullan\u0131yorsan\u0131z, AWS CLI veya SDK'lar arac\u0131l\u0131\u011f\u0131yla \u0130zin S\u0131n\u0131r\u0131 atayabilirsiniz. \u0130\u015fte bir CLI \u00f6rne\u011fi:<\/p>\n<p>\u0130lk olarak, g\u00fcven ili\u015fkisi politikan\u0131z\u0131 tan\u0131mlay\u0131n (\u00f6rne\u011fin, bir EC2 \u00f6rne\u011finin bu rol\u00fc \u00fcstlenmesine izin vermek i\u00e7in):<\/p>\n<pre><code>\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Service\": \"ec2.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n    <\/pre>\n<p><\/code><\/p>\n<p>Bu i\u00e7eri\u011fi <code>trust-policy.json<\/code> olarak kaydedin.<\/p>\n<p>\u015eimdi, rol\u00fc olu\u015fturun ve <code>PermissionsBoundary<\/code> parametresi ile izin s\u0131n\u0131r\u0131n\u0131 belirtin:<\/p>\n<pre><code>\naws iam create-role \\\n    --role-name MyLimitedEC2Role \\\n    --assume-role-policy-document file:\/\/trust-policy.json \\\n    --permissions-boundary arn:aws:iam::ACCOUNT_ID:policy\/DevTeamPermissionBoundary \\\n    --description \"A limited EC2 role with a permission boundary\"\n    <\/pre>\n<p><\/code><\/p>\n<p><code>ACCOUNT_ID<\/code> yerine kendi AWS hesap ID'nizi yazmay\u0131 unutmay\u0131n. Rol olu\u015fturulduktan sonra, ona ek izin politikalar\u0131 ekleyebilirsiniz:<\/p>\n<pre><code>\naws iam attach-role-policy \\\n    --role-name MyLimitedEC2Role \\\n    --policy-arn arn:aws:iam::aws:policy\/AmazonS3ReadOnlyAccess\n\naws iam attach-role-policy \\\n    --role-name MyLimitedEC2Role \\\n    --policy-arn arn:aws:iam::aws:policy\/AmazonEC2ReadOnlyAccess\n    <\/pre>\n<p><\/code><\/p>\n<p>Bu ad\u0131mlarla, <code>MyLimitedEC2Role<\/code> rol\u00fc, hem <code>AmazonS3ReadOnlyAccess<\/code> ve <code>AmazonEC2ReadOnlyAccess<\/code> politikalar\u0131n\u0131n izinlerine sahip olacak hem de <code>DevTeamPermissionBoundary<\/code> politikas\u0131n\u0131n belirledi\u011fi \u00fcst s\u0131n\u0131r\u0131n d\u0131\u015f\u0131na \u00e7\u0131kamayacakt\u0131r. Bu sayede, delegasyonun kontrol\u00fc her zaman y\u00f6netim hesab\u0131n\u0131n elinde kal\u0131r.<\/p>\n<h2>Ger\u00e7ek D\u00fcnya Senaryosu: Geli\u015ftirici Rol\u00fc Delegasyonu \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131<\/h2>\n<p>Bir\u00e7ok b\u00fcy\u00fck organizasyonda, geli\u015ftirme ekiplerine kendi AWS kaynaklar\u0131n\u0131 y\u00f6netme ve da\u011f\u0131tma yetkisi vermek yayg\u0131n bir uygulamad\u0131r. Bu, \"h\u0131zl\u0131 hareket etme\" ve \"devops\" k\u00fclt\u00fcr\u00fcn\u00fc te\u015fvik eder. Ancak, bu delegasyonun kontrols\u00fcz yap\u0131lmas\u0131 b\u00fcy\u00fck g\u00fcvenlik riskleri ta\u015f\u0131r. \u0130\u015fte bu senaryoda \u0130zin S\u0131n\u0131rlar\u0131'n\u0131n nas\u0131l kurtar\u0131c\u0131 bir rol oynad\u0131\u011f\u0131n\u0131 g\u00f6steren ger\u00e7ek\u00e7i bir vaka analizi.<\/p>\n<h3>Problem: Kontrols\u00fcz Geli\u015ftirici Yetkilendirmesi<\/h3>\n<p>B\u00fcy\u00fck bir e-ticaret \u015firketi olan \"GlobalShop\", AWS Organizations yap\u0131s\u0131n\u0131 kullanmaktad\u0131r. Farkl\u0131 \u00fcr\u00fcn ekipleri i\u00e7in ayr\u0131lm\u0131\u015f bir\u00e7ok AWS hesab\u0131 (\u00f6rne\u011fin, \"Product A Dev\", \"Product B Dev\") bulunmaktad\u0131r. G\u00fcvenlik ekibi, geli\u015ftiricilerin kendi hesaplar\u0131 i\u00e7inde Lambda fonksiyonlar\u0131, S3 bucket'lar\u0131 ve EC2 \u00f6rnekleri gibi kaynaklar\u0131 olu\u015fturmalar\u0131na izin veren bir IAM rol\u00fc (<code>DevOpsEngineerRole<\/code>) sa\u011flam\u0131\u015ft\u0131r. Bu rol, geli\u015ftiricilere yeni IAM rolleri ve politikalar\u0131 olu\u015fturma yetkisi de dahil olmak \u00fczere olduk\u00e7a geni\u015f yetkiler vermi\u015ftir. Ancak, bu durum bir dizi soruna yol a\u00e7m\u0131\u015ft\u0131r:<\/p>\n<ul>\n<li><strong>\u0130stemsiz Yetki T\u0131rmanmas\u0131:<\/strong> Bir geli\u015ftirici, test amac\u0131yla veya bilgisizlikle, <code>IAMFullAccess<\/code> gibi \u00e7ok geni\u015f yetkilere sahip bir IAM politikas\u0131 olu\u015fturdu ve bunu bir Lambda fonksiyonuna atad\u0131. Bu durum, Lambda fonksiyonunun (ve dolay\u0131s\u0131yla geli\u015ftiricinin) ama\u00e7lanandan \u00e7ok daha geni\u015f bir AWS kontrol\u00fcne sahip olmas\u0131na neden oldu.<\/li>\n<li><strong>G\u00fcvenlik Standartlar\u0131ndan Sapma:<\/strong> Farkl\u0131 ekipler, farkl\u0131 g\u00fcvenlik anlay\u0131\u015flar\u0131yla, organizasyonun belirledi\u011fi etiketleme standartlar\u0131na uymayan veya gereksiz yere genel eri\u015fim sa\u011flayan S3 bucket'lar\u0131 gibi kaynaklar\u0131 olu\u015fturdu.<\/li>\n<li><strong>Denetim Zorluklar\u0131:<\/strong> G\u00fcvenlik denetimleri s\u0131ras\u0131nda, her bir rol\u00fcn etkili izinlerini anlamak zorla\u015ft\u0131, \u00e7\u00fcnk\u00fc rollerin izinleri olu\u015fturuldu\u011fu zaman ve atanm\u0131\u015f politikalarla de\u011fi\u015fiyordu.<\/li>\n<li><strong>Merkezi G\u00fcvenlik Endi\u015fesi:<\/strong> Y\u00f6netim hesab\u0131, bu kontrols\u00fczl\u00fc\u011f\u00fcn gelecekteki g\u00fcvenlik ihlallerine davetiye \u00e7\u0131karaca\u011f\u0131ndan endi\u015fe duyuyordu.<\/li>\n<\/ul>\n<h3>\u00c7\u00f6z\u00fcm: \"DeveloperScopedBoundary\" \u0130zin S\u0131n\u0131r\u0131 Uygulamas\u0131<\/h3>\n<p>GlobalShop'un merkezi g\u00fcvenlik ekibi, bu sorunlar\u0131 \u00e7\u00f6zmek ve geli\u015ftiricilerin \u00e7evikliklerini korurken ayn\u0131 zamanda g\u00fcvenli\u011fi s\u0131k\u0131la\u015ft\u0131rmak i\u00e7in \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 kullanmaya karar verdi. A\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izlediler:<\/p>\n<h4>Ad\u0131m 1: \"DeveloperScopedBoundary\" Politikas\u0131n\u0131n Tan\u0131mlanmas\u0131<\/h4>\n<p>G\u00fcvenlik ekibi, t\u00fcm geli\u015ftirici odakl\u0131 rollerin a\u015famayaca\u011f\u0131 bir \"DeveloperScopedBoundary\" ad\u0131nda bir y\u00f6netilen IAM politikas\u0131 olu\u015fturdu. Bu politika, geli\u015ftiricilerin kendi hesaplar\u0131 i\u00e7inde yayg\u0131n olarak kulland\u0131klar\u0131 hizmetlere (EC2, S3, Lambda, RDS, DynamoDB, SQS, SNS, CloudWatch, CloudTrail Read-Only) tam eri\u015fim sa\u011fl\u0131yordu. Ancak, IAM \u00fczerinde politikalar olu\u015fturma, kullan\u0131c\u0131\/rol olu\u015fturma veya Organizations servisindeki i\u015flemleri (SCP'leri de\u011fi\u015ftirme, hesap silme vb.) kesinlikle yasakl\u0131yordu.<\/p>\n<pre><code>\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"AllowCommonDevActions\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"ec2:*\",\n                \"s3:*\",\n                \"lambda:*\",\n                \"rds:*\",\n                \"dynamodb:*\",\n                \"sqs:*\",\n                \"sns:*\",\n                \"logs:*\",\n                \"cloudwatch:*\",\n                \"cloudtrail:Describe*\",\n                \"cloudtrail:Get*\",\n                \"cloudtrail:LookupEvents\",\n                \"sagemaker:*\",\n                \"comprehend:*\",\n                \"translate:*\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Sid\": \"DenyIamAndOrgActions\",\n            \"Effect\": \"Deny\",\n            \"Action\": [\n                \"iam:*\",\n                \"organizations:*\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Sid\": \"DenySensitiveS3ActionsWithoutMFA\",\n            \"Effect\": \"Deny\",\n            \"Action\": [\n                \"s3:DeleteObject\",\n                \"s3:DeleteBucket\",\n                \"s3:PutBucketPolicy\"\n            ],\n            \"Resource\": \"*\",\n            \"Condition\": {\n                \"BoolIfExists\": {\n                    \"aws:MultiFactorAuthPresent\": \"false\"\n                }\n            }\n        },\n        {\n            \"Sid\": \"ForceResourceTagging\",\n            \"Effect\": \"Deny\",\n            \"Action\": \"*\",\n            \"Resource\": \"*\",\n            \"Condition\": {\n                \"Null\": {\n                    \"aws:RequestTag\/Project\": \"true\",\n                    \"aws:RequestTag\/Owner\": \"true\"\n                },\n                \"ForAnyValue:StringLike\": {\n                    \"iam:RequestTag\/Project\": [\n                        \"*\"\n                    ],\n                    \"iam:RequestTag\/Owner\": [\n                        \"*\"\n                    ]\n                }\n            }\n        }\n    ]\n}\n    <\/pre>\n<p><\/code><\/p>\n<p>Bu politika \u00f6zellikle IAM ve Organizations servislerine eri\u015fimi tamamen engelliyor. Ayr\u0131ca, S3 \u00fczerinde kritik silme ve politika atama i\u015flemlerini MFA olmadan yasakl\u0131yor. <code>ForceResourceTagging<\/code> b\u00f6l\u00fcm\u00fc ise yeni olu\u015fturulan kaynaklar i\u00e7in belirli etiketlerin zorunlu olmas\u0131n\u0131 sa\u011fl\u0131yor, bu da maliyet y\u00f6netimi ve denetlenebilirlik i\u00e7in kritik bir ad\u0131md\u0131r.<\/p>\n<h4>Ad\u0131m 2: Geli\u015ftirici Rol\u00fcne \u0130zin S\u0131n\u0131r\u0131n\u0131n Atanmas\u0131<\/h4>\n<p>G\u00fcvenlik ekibi, mevcut <code>DevOpsEngineerRole<\/code> rol\u00fcn\u00fc g\u00fcncelledi ve yeni olu\u015fturulacak t\u00fcm geli\u015ftirici rollerine (veya mevcut rollere bir denetim sonras\u0131) <code>DeveloperScopedBoundary<\/code> politikas\u0131n\u0131 \u0130zin S\u0131n\u0131r\u0131 olarak atad\u0131. Bu, geli\u015ftiricilerin rol olu\u015fturma yetkisine sahip olsalar bile, olu\u015fturduklar\u0131 herhangi bir rol\u00fcn <code>DeveloperScopedBoundary<\/code>'nin izin verdi\u011fi s\u0131n\u0131rlar\u0131n d\u0131\u015f\u0131na \u00e7\u0131kamayaca\u011f\u0131 anlam\u0131na geliyordu.<\/p>\n<h3>Sonu\u00e7lar ve Faydalar\u0131<\/h3>\n<p>Bu uygulama sayesinde GlobalShop a\u015fa\u011f\u0131daki \u00f6nemli faydalar\u0131 elde etti:<\/p>\n<ul>\n<li><strong>Geli\u015fmi\u015f G\u00fcvenlik Durumu:<\/strong> Art\u0131k geli\u015ftiriciler, istemeden veya kasten olsun, kendilerine veya uygulamalar\u0131na kritik AWS hizmetlerinde (IAM, Organizations) geni\u015f yetkiler veremiyorlard\u0131. \"Privilege escalation\" riski \u00f6nemli \u00f6l\u00e7\u00fcde azald\u0131.<\/li>\n<li><strong>Merkezi G\u00fcvenlik Kontrol\u00fc:<\/strong> G\u00fcvenlik ekibi, t\u00fcm organizasyondaki geli\u015ftirme rollerinin uymas\u0131 gereken temel g\u00fcvenlik standartlar\u0131n\u0131 merkezi olarak belirleyebildi ve uygulayabildi.<\/li>\n<li><strong>Geli\u015ftirici \u00d6zerkli\u011fi:<\/strong> Geli\u015ftiriciler, hala kendi hesaplar\u0131 i\u00e7inde ihtiya\u00e7 duyduklar\u0131 kaynaklar\u0131 h\u0131zl\u0131 bir \u015fekilde olu\u015fturabiliyor ve y\u00f6netebiliyorlard\u0131, ancak belirlenen g\u00fcvenlik s\u0131n\u0131rlar\u0131 i\u00e7inde. Bu, inovasyonu yava\u015flatmadan g\u00fcvenli\u011fi art\u0131rd\u0131.<\/li>\n<li><strong>Kolayla\u015ft\u0131r\u0131lm\u0131\u015f Denetim:<\/strong> Bir rol\u00fcn ne yapabilece\u011fini anlamak art\u0131k \u00e7ok daha basitti, \u00e7\u00fcnk\u00fc rol\u00fcn izinleri hem kendi politikalar\u0131 hem de \u0130zin S\u0131n\u0131r\u0131 taraf\u0131ndan net bir \u015fekilde tan\u0131mlan\u0131yordu.<\/li>\n<li><strong>Uyum Gerekliliklerinin Kar\u015f\u0131lanmas\u0131:<\/strong> \u015eirketin uyumluluk standartlar\u0131na (\u00f6rne\u011fin GDPR, SOC 2) uygunluk sa\u011flamak daha kolay hale geldi, \u00e7\u00fcnk\u00fc yetki devri kontroll\u00fc bir mekanizma ile yap\u0131l\u0131yordu.<\/li>\n<\/ul>\n<p>Bu vaka analizi, \u0130zin S\u0131n\u0131rlar\u0131'n\u0131n AWS Organizations ortam\u0131nda g\u00fcvenli ve \u00f6l\u00e7eklenebilir yetki delegasyonu sa\u011flamak i\u00e7in ne kadar g\u00fc\u00e7l\u00fc bir ara\u00e7 oldu\u011funu a\u00e7\u0131k\u00e7a g\u00f6stermektedir. Geli\u015ftirici verimlili\u011fini korurken g\u00fcvenlik risklerini azaltman\u0131n pratik bir yoludur.<\/p>\n<h2>\u0130leri D\u00fczey Kullan\u0131m: Programatik \u0130zin S\u0131n\u0131rlar\u0131 ve Otomasyon<\/h2>\n<p>B\u00fcy\u00fck AWS ortamlar\u0131nda, IAM y\u00f6netimi genellikle el ile yap\u0131lan i\u015flemlerden \u00e7ok, otomasyon ara\u00e7lar\u0131 ve Infrastructure as Code (IaC) yakla\u015f\u0131mlar\u0131yla ger\u00e7ekle\u015ftirilir. \u0130zin S\u0131n\u0131rlar\u0131 da bu otomasyon s\u00fcre\u00e7lerine sorunsuz bir \u015fekilde entegre edilebilir, b\u00f6ylece binlerce rol\u00fcn tutarl\u0131 bir \u015fekilde y\u00f6netilmesi ve g\u00fcvenli\u011finin sa\u011flanmas\u0131 m\u00fcmk\u00fcn olur. Bu b\u00f6l\u00fcmde, \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 programatik olarak nas\u0131l y\u00f6netece\u011finizi ve otomasyon stratejilerine nas\u0131l entegre edece\u011finizi inceleyece\u011fiz.<\/p>\n<h3>AWS CLI ve SDK'lar ile \u0130zin S\u0131n\u0131rlar\u0131 Y\u00f6netimi<\/h3>\n<p>AWS Komut Sat\u0131r\u0131 Arabirimi (CLI) ve yaz\u0131l\u0131m geli\u015ftirme kitleri (SDK'lar - Python i\u00e7in Boto3, JavaScript i\u00e7in AWS SDK gibi) \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 programatik olarak olu\u015fturma, g\u00fcncelleme ve silme imkan\u0131 sunar. Bu, \u00f6zellikle s\u00fcrekli entegrasyon\/s\u00fcrekli teslimat (CI\/CD) i\u015flem hatlar\u0131 i\u00e7inde IAM rol\u00fc olu\u015fturmay\u0131 otomatikle\u015ftiren ekipler i\u00e7in \u00e7ok de\u011ferlidir.<\/p>\n<h4>\u0130zin S\u0131n\u0131r\u0131 Politikas\u0131 Olu\u015fturma<\/h4>\n<p>Daha \u00f6nce g\u00f6sterdi\u011fimiz gibi, bir IAM y\u00f6netilen politikas\u0131 olu\u015fturmak i\u00e7in <code>aws iam create-policy<\/code> komutunu kullanabilirsiniz. Bu, \u0130zin S\u0131n\u0131r\u0131 olarak kullan\u0131lacak olan temel politikay\u0131 tan\u0131mlar.<\/p>\n<pre><code>\n# Policy.json dosyas\u0131n\u0131 yukar\u0131daki \"DeveloperScopedBoundary\" politikas\u0131 ile olu\u015fturun.\naws iam create-policy \\\n    --policy-name DeveloperScopedBoundary \\\n    --policy-document file:\/\/DeveloperScopedBoundary.json \\\n    --description \"Permission boundary for developer roles.\"\n    <\/pre>\n<p><\/code><\/p>\n<h4>Rol Olu\u015ftururken \u0130zin S\u0131n\u0131r\u0131 Atama<\/h4>\n<p>Bir rol olu\u015ftururken \u0130zin S\u0131n\u0131r\u0131 atamak i\u00e7in <code>create-role<\/code> komutunda <code>--permissions-boundary<\/code> parametresini kullan\u0131r\u0131z. Bu, IaC \u015fablonlar\u0131n\u0131zda (\u00f6rne\u011fin CloudFormation, Terraform) rol tan\u0131mlar\u0131n\u0131z\u0131 yaparken bu s\u0131n\u0131rlar\u0131 do\u011frudan uygulayabilece\u011finiz anlam\u0131na gelir.<\/p>\n<pre><code>\n# trust-policy.json dosyas\u0131n\u0131 olu\u015fturun (\u00f6rne\u011fin, bir EC2 servisi i\u00e7in)\n# {\n#     \"Version\": \"2012-10-17\",\n#     \"Statement\": [\n#         {\n#             \"Effect\": \"Allow\",\n#             \"Principal\": { \"Service\": \"ec2.amazonaws.com\" },\n#             \"Action\": \"sts:AssumeRole\"\n#         }\n#     ]\n# }\naws iam create-role \\\n    --role-name AutomatedDevRole \\\n    --assume-role-policy-document file:\/\/trust-policy.json \\\n    --permissions-boundary arn:aws:iam::ACCOUNT_ID:policy\/DeveloperScopedBoundary \\\n    --description \"Role for automated development processes with boundary.\"\n    <\/pre>\n<p><\/code><\/p>\n<h4>Mevcut Bir Role \u0130zin S\u0131n\u0131r\u0131 G\u00fcncelleme<\/h4>\n<p>Mevcut bir role \u0130zin S\u0131n\u0131r\u0131 eklemek veya de\u011fi\u015ftirmek i\u00e7in <code>put-role-permissions-boundary<\/code> komutunu kullanabilirsiniz. Bu, organizasyonunuzdaki g\u00fcvenlik politikalar\u0131 de\u011fi\u015fti\u011finde veya yeni s\u0131n\u0131rlar tan\u0131mland\u0131\u011f\u0131nda mevcut rolleri h\u0131zl\u0131ca g\u00fcncellemenizi sa\u011flar.<\/p>\n<pre><code>\naws iam put-role-permissions-boundary \\\n    --role-name ExistingDevRole \\\n    --permissions-boundary arn:aws:iam::ACCOUNT_ID:policy\/NewDeveloperScopedBoundary\n    <\/pre>\n<p><\/code><\/p>\n<p>\u0130zin S\u0131n\u0131r\u0131'n\u0131 bir rolden kald\u0131rmak i\u00e7in ise <code>delete-role-permissions-boundary<\/code> komutunu kullanabilirsiniz. Ancak bu i\u015flem, rol\u00fcn izinlerini s\u0131n\u0131rs\u0131z hale getirece\u011fi i\u00e7in dikkatli yap\u0131lmal\u0131d\u0131r.<\/p>\n<h3>IaC (Infrastructure as Code) ile Otomasyon<\/h3>\n<p>CloudFormation ve Terraform gibi IaC ara\u00e7lar\u0131, \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 AWS altyap\u0131n\u0131z\u0131n bir par\u00e7as\u0131 olarak tan\u0131mlaman\u0131za ve y\u00f6netmenize olanak tan\u0131r. Bu, IAM politikalar\u0131n\u0131 ve rol atamalar\u0131n\u0131 versiyon kontrol\u00fc alt\u0131nda tutarak de\u011fi\u015fiklikleri izlenebilir, tekrar edilebilir ve tutarl\u0131 hale getirir.<\/p>\n<h4>AWS CloudFormation ile \u0130zin S\u0131n\u0131r\u0131 Tan\u0131mlama<\/h4>\n<p>CloudFormation \u015fablonunda bir IAM rol\u00fc tan\u0131mlarken, <code>PermissionsBoundary<\/code> \u00f6zelli\u011fini kullanarak bir \u0130zin S\u0131n\u0131r\u0131 ARN'si belirleyebilirsiniz:<\/p>\n<pre><code>\nResources:\n  MyAutomatedDevRole:\n    Type: AWS::IAM::Role\n    Properties:\n      RoleName: AutomatedDevRoleCFN\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service:\n                - ec2.amazonaws.com\n            Action:\n              - sts:AssumeRole\n      Description: \"An automated dev role managed by CloudFormation with a permission boundary.\"\n      ManagedPolicyArns:\n        - arn:aws:iam::aws:policy\/AmazonS3ReadOnlyAccess\n      PermissionsBoundary: !Sub \"arn:aws:iam::${AWS::AccountId}:policy\/DeveloperScopedBoundary\"\n    <\/pre>\n<p><\/code><\/p>\n<p>Burada <code>!Sub<\/code> fonksiyonu, mevcut AWS hesab\u0131 ID'sini dinamik olarak eklemek i\u00e7in kullan\u0131l\u0131r. Bu, \u015fablonun farkl\u0131 AWS hesaplar\u0131nda yeniden kullan\u0131labilir olmas\u0131n\u0131 sa\u011flar.<\/p>\n<h4>Terraform ile \u0130zin S\u0131n\u0131r\u0131 Tan\u0131mlama<\/h4>\n<p>Terraform kullan\u0131c\u0131lar\u0131 da benzer \u015fekilde <code>aws_iam_role<\/code> kayna\u011f\u0131nda <code>permissions_boundary<\/code> \u00f6zelli\u011fini kullanabilirler:<\/p>\n<pre><code>\nresource \"aws_iam_policy\" \"developer_boundary\" {\n  name        = \"DeveloperScopedBoundaryTerraform\"\n  description = \"Permission boundary for developer roles managed by Terraform.\"\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [\n      {\n        Sid = \"AllowCommonDevActions\"\n        Effect = \"Allow\"\n        Action = [\n            \"ec2:*\",\n            \"s3:*\",\n            \"lambda:*\",\n            \"rds:*\",\n            \"dynamodb:*\"\n        ]\n        Resource = \"*\"\n      },\n      {\n        Sid = \"DenyIamAndOrgActions\"\n        Effect = \"Deny\"\n        Action = [\n            \"iam:*\",\n            \"organizations:*\"\n        ]\n        Resource = \"*\"\n      }\n    ]\n  })\n}\n\nresource \"aws_iam_role\" \"automated_dev_role\" {\n  name               = \"AutomatedDevRoleTerraform\"\n  assume_role_policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [\n      {\n        Effect = \"Allow\"\n        Principal = {\n          Service = \"ec2.amazonaws.com\"\n        }\n        Action = \"sts:AssumeRole\"\n      }\n    ]\n  })\n  permissions_boundary = aws_iam_policy.developer_boundary.arn\n  description          = \"Automated dev role with a permission boundary managed by Terraform.\"\n}\n\nresource \"aws_iam_role_policy_attachment\" \"s3_read_attach\" {\n  role       = aws_iam_role.automated_dev_role.name\n  policy_arn = \"arn:aws:iam::aws:policy\/AmazonS3ReadOnlyAccess\"\n}\n    <\/pre>\n<p><\/code><\/p>\n<p>Bu Terraform kodu, hem \u0130zin S\u0131n\u0131r\u0131 politikas\u0131n\u0131 (<code>aws_iam_policy<\/code>) hem de bu s\u0131n\u0131ra sahip rol\u00fc (<code>aws_iam_role<\/code>) tan\u0131mlar ve ona ek bir politika ekler. Bu sayede, g\u00fcvenlik politikalar\u0131n\u0131z kod olarak y\u00f6netilebilir ve otomatik da\u011f\u0131t\u0131m s\u00fcre\u00e7lerine entegre edilebilir.<\/p>\n<p>Programatik \u0130zin S\u0131n\u0131r\u0131 y\u00f6netimi ve otomasyonu, \u00f6zellikle b\u00fcy\u00fck \u00f6l\u00e7ekli ve dinamik AWS ortamlar\u0131nda IAM g\u00fcvenli\u011fini art\u0131rmak i\u00e7in vazge\u00e7ilmezdir. Bu yakla\u015f\u0131mla, g\u00fcvenlik standartlar\u0131n\u0131z\u0131n her yeni rol olu\u015fturuldu\u011funda otomatik olarak uygulanmas\u0131n\u0131 sa\u011flayabilir, insan hatas\u0131n\u0131 azaltabilir ve genel g\u00fcvenlik duru\u015funuzu s\u00fcrekli olarak g\u00fc\u00e7lendirebilirsiniz.<\/p>\n<h2>\u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131rken Dikkat Edilmesi Gerekenler ve En \u0130yi Uygulamalar<\/h2>\n<p>\u0130zin S\u0131n\u0131rlar\u0131, AWS IAM g\u00fcvenli\u011fini g\u00fc\u00e7lendirmek i\u00e7in son derece g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r, ancak etkili bir \u015fekilde kullan\u0131lmad\u0131\u011f\u0131nda veya yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda karma\u015f\u0131kl\u0131\u011fa yol a\u00e7abilir veya beklenmedik eri\u015fim sorunlar\u0131na neden olabilir. \u0130\u015fte \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 kullan\u0131rken dikkat etmeniz gerekenler ve en iyi uygulamalar.<\/p>\n<h3>1. \u0130zin S\u0131n\u0131rlar\u0131 \"\u0130zin Vermez\", Sadece \"S\u0131n\u0131rlar\"<\/h3>\n<p>Bu, \u0130zin S\u0131n\u0131rlar\u0131 hakk\u0131ndaki en \u00f6nemli yan\u0131lg\u0131lardan biridir. \u0130zin S\u0131n\u0131rlar\u0131, bir kimli\u011fe kendi ba\u015f\u0131na herhangi bir izin vermez. Rol\u00fcn veya kullan\u0131c\u0131n\u0131n etkili izinleri, her zaman hem kimli\u011fe ba\u011fl\u0131 politikalar (inline veya managed) hem de \u0130zin S\u0131n\u0131r\u0131 politikas\u0131nda a\u00e7\u0131k\u00e7a izin verilen eylemlerin kesi\u015fimi olacakt\u0131r. E\u011fer bir eylem, kimli\u011fe ba\u011fl\u0131 politikalarda izin verilmi\u015f ancak \u0130zin S\u0131n\u0131r\u0131'nda reddedilmi\u015fse veya \u0130zin S\u0131n\u0131r\u0131'nda hi\u00e7 belirtilmemi\u015fse, o eylem ger\u00e7ekle\u015ftirilemez. Bu nedenle, \u0130zin S\u0131n\u0131r\u0131 politikalar\u0131n\u0131z\u0131 tasarlarken \"Allow\" ifadelerinin bile asl\u0131nda bir \u00fcst s\u0131n\u0131r belirledi\u011fini unutmay\u0131n. Daima \"least privilege\" prensibini g\u00f6z \u00f6n\u00fcnde bulundurarak hem rol\u00fcn kendisine atad\u0131\u011f\u0131n\u0131z politikalar\u0131 hem de \u0130zin S\u0131n\u0131r\u0131'n\u0131 tasarlay\u0131n.<\/p>\n<h3>2. Test Edin, Test Edin, Tekrar Test Edin!<\/h3>\n<p>\u0130zin S\u0131n\u0131rlar\u0131, IAM izinlerini anlamay\u0131 karma\u015f\u0131kla\u015ft\u0131rabilir. Bir \u0130zin S\u0131n\u0131r\u0131 uygulad\u0131ktan sonra, ilgili rol\u00fcn veya kullan\u0131c\u0131n\u0131n ger\u00e7ekten ihtiya\u00e7 duydu\u011fu t\u00fcm g\u00f6revleri yerine getirebildi\u011fini ve bunun \u00f6tesinde hi\u00e7bir yetkiye sahip olmad\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in kapsaml\u0131 testler yap\u0131n. AWS IAM Policy Simulator, bu s\u00fcre\u00e7te \u00e7ok faydal\u0131 bir ara\u00e7t\u0131r. Rol\u00fcn ve \u0130zin S\u0131n\u0131r\u0131 politikas\u0131n\u0131n birle\u015fiminin etkili izinlerini g\u00f6rmenize olanak tan\u0131r.<\/p>\n<div class=\"expert-tip\">\n        Uzman \u0130pucu: IAM Policy Simulator, bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n belirli bir \u0130zin S\u0131n\u0131r\u0131 ile hangi eylemleri ger\u00e7ekle\u015ftirebilece\u011fini veya hangi kaynaklara eri\u015febilece\u011fini sim\u00fcle etmek i\u00e7in vazge\u00e7ilmez bir ara\u00e7t\u0131r. Politikalar\u0131n\u0131z\u0131 devreye almadan \u00f6nce mutlaka bu arac\u0131 kullan\u0131n.\n    <\/div>\n<h3>3. \u0130zin S\u0131n\u0131r\u0131 Politikalar\u0131n\u0131 En Az Ayr\u0131cal\u0131k Prensibiyle Tasarlay\u0131n<\/h3>\n<p>\u0130zin S\u0131n\u0131r\u0131 politikalar\u0131n\u0131z\u0131, atand\u0131\u011f\u0131 rollerin ihtiya\u00e7 duyabilece\u011fi en geni\u015f yetki k\u00fcmesini kapsayacak \u015fekilde de\u011fil, aksine en k\u0131s\u0131tl\u0131 ama i\u015flevsel yetki k\u00fcmesini kapsayacak \u015fekilde tasarlay\u0131n. \u00d6rne\u011fin, t\u00fcm geli\u015ftirici rollerinin ihtiya\u00e7 duyabilece\u011fi hizmetleri (EC2, S3, Lambda) i\u00e7eren bir s\u0131n\u0131r olu\u015fturun, ancak IAM veya Organizations gibi hassas hizmetlere eri\u015fimi kesinlikle k\u0131s\u0131tlay\u0131n. Bu, delegasyonun g\u00fcvenli\u011fini en \u00fcst d\u00fczeye \u00e7\u0131kar\u0131r.<\/p>\n<h3>4. \u0130zin S\u0131n\u0131rlar\u0131 ve SCP'ler Aras\u0131ndaki Fark\u0131 Anlay\u0131n<\/h3>\n<p>Hem \u0130zin S\u0131n\u0131rlar\u0131 hem de Service Control Policies (SCP'ler) maksimum izinleri belirlemek i\u00e7in kullan\u0131labilir, ancak farkl\u0131 seviyelerde \u00e7al\u0131\u015f\u0131rlar:<\/p>\n<ul>\n<li><strong>SCP'ler:<\/strong> AWS Organizations seviyesinde \u00e7al\u0131\u015f\u0131r ve bir kurulu\u015f birimi (OU) veya hesap i\u00e7in t\u00fcm varl\u0131klar\u0131n (kullan\u0131c\u0131lar, roller) yapabilece\u011fi maksimum eylemleri s\u0131n\u0131rlar. SCP'ler, root kullan\u0131c\u0131s\u0131 dahil olmak \u00fczere t\u00fcm IAM varl\u0131klar\u0131n\u0131 etkiler ve varsay\u0131lan olarak \"reddetme\" (Deny) ilkesiyle \u00e7al\u0131\u015f\u0131r (ancak \"Allow\" SCP'leri de yaz\u0131labilir). Bir SCP bir eylemi reddederse, hi\u00e7bir IAM politikas\u0131 bu eyleme izin veremez.<\/li>\n<li><strong>\u0130zin S\u0131n\u0131rlar\u0131:<\/strong> IAM varl\u0131\u011f\u0131 (kullan\u0131c\u0131 veya rol) seviyesinde \u00e7al\u0131\u015f\u0131r. Bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n sahip olabilece\u011fi maksimum izinleri s\u0131n\u0131rlar. \u0130zin S\u0131n\u0131r\u0131 bir eylemi reddederse, kimli\u011fe ba\u011fl\u0131 politikalar o eyleme izin veremez.<\/li>\n<\/ul>\n<p>Bu iki mekanizma birbirini tamamlar. SCP'ler geni\u015f organizasyonel g\u00fcvenli\u011fi sa\u011flarken, \u0130zin S\u0131n\u0131rlar\u0131 daha gran\u00fcler delegasyon kontrol\u00fc sunar. Her ikisini de kullanmak, katmanl\u0131 bir g\u00fcvenlik yakla\u015f\u0131m\u0131 sa\u011flar.<\/p>\n<h3>5. Otomasyon ve S\u00fcr\u00fcm Kontrol\u00fcn\u00fc Kullan\u0131n<\/h3>\n<p>\u0130zin S\u0131n\u0131r\u0131 politikalar\u0131n\u0131 ve rol atamalar\u0131n\u0131 CloudFormation, Terraform gibi Infrastructure as Code (IaC) ara\u00e7lar\u0131yla y\u00f6netin. Bu, politikalar\u0131n tutarl\u0131l\u0131\u011f\u0131n\u0131 sa\u011flar, de\u011fi\u015fiklikleri izlenebilir hale getirir ve insan hatas\u0131 riskini azalt\u0131r. Ayr\u0131ca, t\u00fcm politikalar\u0131n\u0131z\u0131 s\u00fcr\u00fcm kontrol sistemlerinde (Git gibi) saklay\u0131n.<\/p>\n<h3>6. \u0130zin S\u0131n\u0131rlar\u0131n\u0131 D\u00fczenli Olarak G\u00f6zden Ge\u00e7irin ve G\u00fcncelleyin<\/h3>\n<p>\u0130\u015f gereksinimleri ve AWS hizmetleri s\u00fcrekli de\u011fi\u015fir. \u0130zin S\u0131n\u0131r\u0131 politikalar\u0131n\u0131z\u0131n hala ge\u00e7erli oldu\u011fundan, gereksiz izinler i\u00e7ermedi\u011finden ve yeni g\u00fcvenlik tehditlerine kar\u015f\u0131 koruma sa\u011flad\u0131\u011f\u0131ndan emin olmak i\u00e7in d\u00fczenli olarak g\u00f6zden ge\u00e7irin. Gerekirse, bunlar\u0131 i\u015flevsellikten \u00f6d\u00fcn vermeden s\u0131k\u0131la\u015ft\u0131r\u0131n.<\/p>\n<h3>7. Etiketleme Standartlar\u0131n\u0131 Zorlay\u0131n<\/h3>\n<p>\u0130zin S\u0131n\u0131rlar\u0131 i\u00e7inde, yeni olu\u015fturulan kaynaklar i\u00e7in belirli etiketlerin (\u00f6rne\u011fin \"Project\", \"Owner\", \"Environment\") zorunlu olmas\u0131n\u0131 sa\u011flayan ko\u015fullar (<code>aws:RequestTag<\/code>) ekleyebilirsiniz. Bu, kaynak envanter y\u00f6netimi, maliyet tahsisi ve g\u00fcvenlik denetimleri i\u00e7in \u00e7ok de\u011ferli bilgiler sa\u011flar.<\/p>\n<p>Bu en iyi uygulamalar\u0131 takip ederek, \u0130zin S\u0131n\u0131rlar\u0131'n\u0131 AWS Organizations y\u00f6netim hesab\u0131nda g\u00fcvenli\u011fi art\u0131rmak, yetki delegasyonunu kontrol alt\u0131nda tutmak ve genel bulut g\u00fcvenlik duru\u015funuzu g\u00fc\u00e7lendirmek i\u00e7in etkili bir \u015fekilde kullanabilirsiniz.<\/p>\n<h2>Sonu\u00e7: G\u00fcvenli ve \u00d6l\u00e7eklenebilir Bir Bulut Ortam\u0131 \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131<\/h2>\n<p>AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015fturma s\u00fcreci, kurulu\u015flar i\u00e7in hem esneklik hem de ciddi g\u00fcvenlik riskleri bar\u0131nd\u0131r\u0131r. G\u00fcvenli yetki delegasyonu, b\u00fcy\u00fck ve dinamik AWS ortamlar\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz en \u00f6nemli zorluklardan biridir. \u0130\u015fte bu noktada, \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), AWS ortam\u0131n\u0131zda g\u00fcvenli\u011fi art\u0131rmak ve \"en az ayr\u0131cal\u0131k\" (least privilege) ilkesini etkin bir \u015fekilde uygulamak i\u00e7in vazge\u00e7ilmez bir ara\u00e7 olarak kar\u015f\u0131m\u0131za \u00e7\u0131kmaktad\u0131r.<\/p>\n<p>Bu makalede, \u0130zin S\u0131n\u0131rlar\u0131'n\u0131n ne oldu\u011funu, IAM rolleriyle nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve \u00f6zellikle AWS Organizations y\u00f6netim hesab\u0131nda neden bu kadar kritik oldu\u011funu detayl\u0131ca ele ald\u0131k. Geli\u015ftirici rol\u00fc delegasyonu senaryosuyla ger\u00e7ek d\u00fcnya uygulamas\u0131n\u0131 g\u00f6sterdik ve \u0130zin S\u0131n\u0131rlar\u0131'n\u0131n programatik olarak nas\u0131l y\u00f6netilebilece\u011fine dair ileri d\u00fczey bilgiler sunduk. Unutmay\u0131n ki \u0130zin S\u0131n\u0131rlar\u0131, izin veren bir mekanizma de\u011fil, aksine bir rol\u00fcn veya kullan\u0131c\u0131n\u0131n sahip olabilece\u011fi maksimum yetkiyi belirleyen bir \"\u00fcst s\u0131n\u0131r\"d\u0131r. Bu \u00f6zelli\u011fi sayesinde, alt ekiplere veya otomatik s\u00fcre\u00e7lere rol olu\u015fturma yetkisi verirken bile, bu rollerin belirlenen g\u00fcvenlik parametrelerinin d\u0131\u015f\u0131na \u00e7\u0131kmas\u0131n\u0131 engelleyebilirsiniz.<\/p>\n<p>\u0130zin S\u0131n\u0131rlar\u0131'n\u0131 do\u011fru \u015fekilde yap\u0131land\u0131rmak ve y\u00f6netmek, yetki t\u0131rmanmas\u0131 riskini azalt\u0131r, merkezi g\u00fcvenlik standartlar\u0131n\u0131n tutarl\u0131 bir \u015fekilde uygulanmas\u0131n\u0131 sa\u011flar ve genel uyumluluk gereksinimlerini kar\u015f\u0131laman\u0131za yard\u0131mc\u0131 olur. Karma\u015f\u0131k bulut ortamlar\u0131nda g\u00fcvenlik stratejinizin temel ta\u015flar\u0131ndan biri olmal\u0131 ve otomasyon, d\u00fczenli denetim ve en iyi uygulamalarla desteklenmelidir. Gelecekte, AWS altyap\u0131n\u0131z b\u00fcy\u00fcd\u00fck\u00e7e ve geli\u015ftik\u00e7e, \u0130zin S\u0131n\u0131rlar\u0131, g\u00fcvenlik ve operasyonel verimlilik aras\u0131ndaki dengeyi koruman\u0131zda size kritik bir avantaj sa\u011flayacakt\u0131r. AWS kaynaklar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in bu g\u00fc\u00e7l\u00fc arac\u0131 ke\u015ffetmeye ve uygulamaya devam edin.<\/p>\n<div class=\"faq-section\">\n<h2>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h2>\n<div class=\"faq-question\">1. \u0130zin S\u0131n\u0131r\u0131 (Permission Boundary) ile SCP (Service Control Policy) aras\u0131ndaki temel fark nedir?<\/div>\n<div class=\"faq-answer\">\n            \u0130zin S\u0131n\u0131r\u0131, bir IAM kimli\u011fine (kullan\u0131c\u0131 veya rol) do\u011frudan eklenen bir IAM politikas\u0131d\u0131r ve o kimli\u011fin sahip olabilece\u011fi maksimum izinleri belirler. Yaln\u0131zca kimli\u011fin etkili izinlerini k\u0131s\u0131tlar. SCP ise AWS Organizations d\u00fczeyinde uygulan\u0131r ve bir kurulu\u015f birimindeki (OU) veya hesaptaki T\u00dcM IAM kimlikleri (root kullan\u0131c\u0131s\u0131 dahil) i\u00e7in maksimum izinleri belirler. SCP'ler, bir eylemi reddederse, hi\u00e7bir \u0130zin S\u0131n\u0131r\u0131 veya IAM politikas\u0131 o eyleme izin veremez. \u0130zin S\u0131n\u0131rlar\u0131 bireysel kimlikler i\u00e7in, SCP'ler ise organizasyonel d\u00fczeyde g\u00fcvenlik \"parmakl\u0131\u011f\u0131\" g\u00f6revi g\u00f6r\u00fcr.\n        <\/div>\n<div class=\"faq-question\">2. Bir role \u0130zin S\u0131n\u0131r\u0131 atand\u0131ktan sonra, o rol\u00fcn etkili izinlerini nas\u0131l kontrol edebilirim?<\/div>\n<div class=\"faq-answer\">\n            Bir role \u0130zin S\u0131n\u0131r\u0131 atand\u0131\u011f\u0131nda, rol\u00fcn etkili izinleri, role ba\u011fl\u0131 t\u00fcm politikalar (managed ve inline) ile \u0130zin S\u0131n\u0131r\u0131 politikas\u0131n\u0131n izin verilen eylemlerinin kesi\u015fimi olacakt\u0131r. En iyi yol, AWS IAM Policy Simulator'\u0131 kullanmakt\u0131r. Bu ara\u00e7, hem rol\u00fcn kendisine ba\u011fl\u0131 politikalar\u0131 hem de atanan \u0130zin S\u0131n\u0131r\u0131'n\u0131 dikkate alarak, bir rol\u00fcn belirli eylemleri hangi ko\u015fullarda ger\u00e7ekle\u015ftirebilece\u011fini sim\u00fcle etmenizi sa\u011flar.\n        <\/div>\n<div class=\"faq-question\">3. Mevcut bir role sonradan \u0130zin S\u0131n\u0131r\u0131 ekleyebilir miyim?<\/div>\n<div class=\"faq-answer\">\n            Evet, mevcut bir role AWS konsolu, CLI veya SDK'lar arac\u0131l\u0131\u011f\u0131yla sonradan \u0130zin S\u0131n\u0131r\u0131 ekleyebilirsiniz. AWS CLI'da <code>aws iam put-role-permissions-boundary<\/code> komutu bu i\u015flem i\u00e7in kullan\u0131l\u0131r. Ancak, \u0130zin S\u0131n\u0131r\u0131 eklendikten sonra rol\u00fcn etkili izinleri hemen de\u011fi\u015fecektir, bu da mevcut uygulamalar\u0131n veya s\u00fcre\u00e7lerin kesintiye u\u011framas\u0131na neden olabilir. Bu nedenle, mevcut rollere \u0130zin S\u0131n\u0131r\u0131 eklemeden \u00f6nce kapsaml\u0131 testler yap\u0131lmas\u0131 kritik \u00f6neme sahiptir.\n        <\/div>\n<div class=\"faq-question\">4. \u0130zin S\u0131n\u0131r\u0131, bir role tam y\u00f6netici (AdministratorAccess) yetkisi verilmesini engelleyebilir mi?<\/div>\n<div class=\"faq-answer\">\n            Kesinlikle evet. \u0130zin S\u0131n\u0131r\u0131'n\u0131n en g\u00fc\u00e7l\u00fc kullan\u0131m alanlar\u0131ndan biri budur. E\u011fer bir \u0130zin S\u0131n\u0131r\u0131 politikas\u0131 <code>iam:*<\/code> veya <code>*:*<\/code> gibi geni\u015f yetkileri a\u00e7\u0131k\u00e7a reddederse, o \u0130zin S\u0131n\u0131r\u0131'na sahip bir rol\u00fcn kendisine <code>AdministratorAccess<\/code> politikas\u0131 atansa bile, \u0130zin S\u0131n\u0131r\u0131 bu tam y\u00f6netici yetkilerini k\u0131s\u0131tlayacakt\u0131r. Dolay\u0131s\u0131yla, rol\u00fcn etkili izinleri, \u0130zin S\u0131n\u0131r\u0131'n\u0131n izin verdi\u011fi s\u0131n\u0131rlar i\u00e7inde kalacakt\u0131r. Bu, yetki t\u0131rmanmas\u0131n\u0131 engellemek i\u00e7in kritik bir g\u00fcvenlik kontrol\u00fcd\u00fcr.\n        <\/div>\n<div class=\"faq-question\">5. Hangi senaryolarda \u0130zin S\u0131n\u0131rlar\u0131 yerine SCP'leri tercih etmeliyim?<\/div>\n<div class=\"faq-answer\">\n            E\u011fer bir k\u0131s\u0131tlamay\u0131 organizasyonunuzdaki t\u00fcm hesaplar ve t\u00fcm IAM varl\u0131klar\u0131 (root kullan\u0131c\u0131s\u0131 dahil) i\u00e7in ge\u00e7erli k\u0131lmak istiyorsan\u0131z SCP'leri tercih etmelisiniz. \u00d6rne\u011fin, \"Hi\u00e7bir hesapta hi\u00e7bir zaman S3 bucket'lar\u0131 halka a\u00e7\u0131k olamaz\" veya \"T\u00fcm hesaplarda CloudTrail durdurulamaz\" gibi organizasyon genelinde uyulmas\u0131 gereken zorunlu g\u00fcvenlik politikalar\u0131 i\u00e7in SCP'ler idealdir. \u0130zin S\u0131n\u0131rlar\u0131 ise daha gran\u00fcler, rol veya kullan\u0131c\u0131 baz\u0131nda delegasyon kontrol\u00fc i\u00e7in kullan\u0131l\u0131rken, SCP'ler daha geni\u015f \u00e7apl\u0131, zorlay\u0131c\u0131 organizasyonel g\u00fcvenlik ilkeleri i\u00e7in kullan\u0131l\u0131r.\n        <\/div>\n<\/p><\/div>\n<p><\/body><\/p>\n","protected":false},"excerpt":{"rendered":"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi&hellip;","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1406],"tags":[],"class_list":{"0":"post-30678","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-aws","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>AWS Organizations&#039;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131<\/title>\n<meta name=\"description\" content=\"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Organizations&#039;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131\" \/>\n<meta property=\"og:description\" content=\"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-30T14:34:11+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"34 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"AWS Organizations&#8217;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131\",\"datePublished\":\"2025-09-30T14:34:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\"},\"wordCount\":6206,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"AWS\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\",\"name\":\"AWS Organizations'ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-09-30T14:34:11+00:00\",\"description\":\"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AWS Organizations&#8217;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AWS Organizations'ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131","description":"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/","og_locale":"tr_TR","og_type":"article","og_title":"AWS Organizations'ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131","og_description":"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.","og_url":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-09-30T14:34:11+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"34 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"AWS Organizations&#8217;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131","datePublished":"2025-09-30T14:34:11+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/"},"wordCount":6206,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["AWS"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/","url":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/","name":"AWS Organizations'ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-09-30T14:34:11+00:00","description":"AWS Organizations y\u00f6netim hesab\u0131nda IAM rol\u00fc olu\u015ftururken g\u00fcvenlik ve kontrol\u00fc nas\u0131l art\u0131r\u0131rs\u0131n\u0131z? \u0130zin S\u0131n\u0131rlar\u0131 (Permission Boundaries), delegasyon modelinizi g\u00fc\u00e7lendirerek yetki karma\u015fas\u0131n\u0131 ortadan kald\u0131r\u0131r ve g\u00fcvenlik duru\u015funuzu sa\u011flamla\u015ft\u0131r\u0131r. Bu makale, \u00f6zellikle b\u00fcy\u00fck ve karma\u015f\u0131k bulut ortamlar\u0131nda, yetki y\u00f6netiminin delegasyonunu g\u00fcvenli bir \u015fekilde nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/aws-organizationsta-iam-rolleri-icin-izin-sinirlari-kullanimi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS Organizations&#8217;ta IAM Rolleri \u0130\u00e7in \u0130zin S\u0131n\u0131rlar\u0131 Kullan\u0131m\u0131"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=30678"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30678\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=30678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=30678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=30678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}