{"id":30959,"date":"2025-10-04T01:31:42","date_gmt":"2025-10-03T22:31:42","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/"},"modified":"2025-10-04T01:31:42","modified_gmt":"2025-10-03T22:31:42","slug":"api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/","title":{"rendered":"API Gateway&#8217;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi"},"content":{"rendered":"<p><body><\/p>\n<p>Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.<\/p>\n<p>G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, kullan\u0131c\u0131 verilerinin g\u00fcvenli\u011fi ve API&#8217;lerin yetkisiz eri\u015fime kar\u015f\u0131 korunmas\u0131, her geli\u015ftiricinin ve IT profesyonelinin \u00f6ncelikli konular\u0131 aras\u0131nda yer almaktad\u0131r. Uygulamalar\u0131m\u0131z\u0131n omurgas\u0131n\u0131 olu\u015fturan API&#8217;ler, genellikle hassas bilgilere eri\u015fim noktalar\u0131d\u0131r. Bu nedenle, API&#8217;leri yetkisiz kullan\u0131c\u0131lardan korumak hayati \u00f6nem ta\u015f\u0131r. Geleneksel kimlik do\u011frulama y\u00f6ntemleri, b\u00fcy\u00fck \u00f6l\u00e7ekli ve dinamik bulut tabanl\u0131 uygulamalar i\u00e7in genellikle yetersiz kalabilir. Kullan\u0131c\u0131 y\u00f6netimi, oturum takibi, token yenileme ve \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama gibi \u00f6zelliklerin her API i\u00e7in ayr\u0131 ayr\u0131 geli\u015ftirilmesi hem zaman al\u0131c\u0131 hem de hata yapmaya a\u00e7\u0131k bir s\u00fcre\u00e7tir.<\/p>\n<p>\u0130\u015fte tam bu noktada, AWS ekosistemi i\u00e7erisinde sunulan Amazon API Gateway ve Amazon Cognito User Pools, bu karma\u015f\u0131k g\u00fcvenlik problemlerine g\u00fc\u00e7l\u00fc, \u00f6l\u00e7eklenebilir ve y\u00f6netilebilir bir \u00e7\u00f6z\u00fcm sunar. API Gateway, uygulamalar\u0131n\u0131z i\u00e7in bir &#8220;\u00f6n kap\u0131&#8221; g\u00f6revi g\u00f6rerek t\u00fcm gelen istekleri y\u00f6netir, y\u00f6nlendirir ve \u00e7e\u015fitli g\u00fcvenlik katmanlar\u0131 ekler. Amazon Cognito User Pools ise, uygulaman\u0131z i\u00e7in kullan\u0131c\u0131 dizini ve kimlik do\u011frulama hizmeti sa\u011flayarak kullan\u0131c\u0131 kayd\u0131, oturum a\u00e7ma, \u015fifre s\u0131f\u0131rlama ve \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama gibi i\u015flemleri kolayla\u015ft\u0131r\u0131r. Bu iki servisin entegrasyonuyla, API Gateway, gelen API isteklerini Cognito User Pool taraf\u0131ndan verilen standartla\u015ft\u0131r\u0131lm\u0131\u015f JSON Web Token (JWT) ile yetkilendirerek, API&#8217;lerinize yaln\u0131zca kimli\u011fi do\u011frulanm\u0131\u015f ve yetkili kullan\u0131c\u0131lar\u0131n eri\u015fimini sa\u011flar. Bu entegrasyon, geli\u015ftiricilerin g\u00fcvenlik mekanizmalar\u0131 yerine i\u015f mant\u0131\u011f\u0131na odaklanmas\u0131na olanak tan\u0131rken, ayn\u0131 zamanda y\u00fcksek g\u00fcvenlik standartlar\u0131n\u0131 ve operasyonel verimlili\u011fi garanti eder. Bu rehberde, bu entegrasyonun temel \u00e7al\u0131\u015fma prensiplerinden, ad\u0131m ad\u0131m yap\u0131land\u0131rma s\u00fcre\u00e7lerine, ger\u00e7ek d\u00fcnya senaryolar\u0131ndan ileri d\u00fczey optimizasyonlara kadar her y\u00f6n\u00fcn\u00fc detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Bu sayede, okuyucular\u0131m\u0131z, uygulamalar\u0131n\u0131n API g\u00fcvenli\u011fini sa\u011flamak i\u00e7in gerekli bilgi ve ara\u00e7lara sahip olacaklard\u0131r.<\/p>\n<h2>Temel Kavramlara Giri\u015f: AWS API Gateway ve Amazon Cognito Nedir ve Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n<p>API Gateway ve Cognito User Pools yetkilendiricisinin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 tam olarak anlayabilmek i\u00e7in, \u00f6ncelikle bu iki temel AWS hizmetinin ne oldu\u011funu ve ne i\u015fe yarad\u0131\u011f\u0131n\u0131 kavramak \u00f6nemlidir. Her ikisi de modern, bulut tabanl\u0131 uygulamalar\u0131n temel bile\u015fenlerindendir ve birlikte g\u00fc\u00e7l\u00fc bir g\u00fcvenlik ve eri\u015fim kontrol\u00fc mekanizmas\u0131 olu\u015ftururlar. Bu b\u00f6l\u00fcmde, her bir servisi ayr\u0131 ayr\u0131 ele alacak ve onlar\u0131n temel \u00f6zelliklerini ve rollerini a\u00e7\u0131klayaca\u011f\u0131z.<\/p>\n<h3>Amazon API Gateway&#8217;in Rol\u00fc Nedir ve Neden Kullan\u0131l\u0131r?<\/h3>\n<p>Amazon API Gateway, geli\u015ftiricilerin herhangi bir \u00f6l\u00e7ekte API olu\u015fturmas\u0131na, yay\u0131nlamas\u0131na, s\u00fcrd\u00fcrmesine, izlemesine ve g\u00fcvenli\u011fini sa\u011flamas\u0131na olanak tan\u0131yan tam olarak y\u00f6netilen bir hizmettir. Temel olarak, uygulamalar\u0131n\u0131z ile arka u\u00e7 hizmetleriniz (\u00f6rne\u011fin AWS Lambda fonksiyonlar\u0131, EC2&#8217;deki web sunucular\u0131 veya di\u011fer AWS servisleri) aras\u0131nda bir &#8220;\u00f6n kap\u0131&#8221; veya &#8220;\u00f6n u\u00e7&#8221; g\u00f6revi g\u00f6r\u00fcr. API Gateway, gelen HTTP isteklerini al\u0131r, bunlar\u0131 arka u\u00e7 servislerine iletir ve arka u\u00e7tan gelen yan\u0131tlar\u0131 istemciye geri g\u00f6nderir. Bu s\u00fcre\u00e7te bir\u00e7ok fayda sa\u011flar:<\/p>\n<ul>\n<li><strong>Request\/Response Y\u00f6netimi:<\/strong> Gelen istekleri do\u011fru arka u\u00e7 servisine y\u00f6nlendirir ve arka u\u00e7tan gelen yan\u0131tlar\u0131 d\u00f6n\u00fc\u015ft\u00fcrerek istemciye g\u00f6nderir.<\/li>\n<li><strong>Trafik Y\u00f6netimi:<\/strong> \u0130stek s\u0131n\u0131rlama (throttling), \u00f6nbellekleme (caching) ve versiyonlama gibi \u00f6zelliklerle API&#8217;lerinizin performans\u0131n\u0131 ve kararl\u0131l\u0131\u011f\u0131n\u0131 art\u0131r\u0131r.<\/li>\n<li><strong>G\u00fcvenlik:<\/strong> Kimlik do\u011frulama ve yetkilendirme mekanizmalar\u0131 (IAM, Lambda Authorizer, Cognito User Pool Authorizer) entegre ederek API&#8217;lerinizi korur. DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar.<\/li>\n<li><strong>\u0130zleme ve G\u00fcnl\u00fckleme:<\/strong> API \u00e7a\u011fr\u0131lar\u0131n\u0131, gecikmeleri ve hata oranlar\u0131n\u0131 izlemek i\u00e7in Amazon CloudWatch ile entegre \u00e7al\u0131\u015f\u0131r.<\/li>\n<li><strong>Esneklik:<\/strong> RESTful API&#8217;ler, WebSocket API&#8217;ler ve HTTP API&#8217;ler gibi farkl\u0131 API t\u00fcrlerini destekler.<\/li>\n<\/ul>\n<p>API Gateway&#8217;in en \u00f6nemli \u00f6zelliklerinden biri de, \u00e7e\u015fitli yetkilendirme mekanizmalar\u0131n\u0131 desteklemesidir. Bu yetkilendiriciler sayesinde, API&#8217;lerinize kimlerin ve hangi ko\u015fullar alt\u0131nda eri\u015febilece\u011fini belirleyebilirsiniz. Konumuz \u00f6zelinde, Cognito User Pool yetkilendiricisi, kullan\u0131c\u0131 tabanl\u0131 kimlik do\u011frulama ve yetkilendirme i\u00e7in g\u00fc\u00e7l\u00fc ve y\u00f6netimi kolay bir se\u00e7enek sunar.<\/p>\n<h3>Amazon Cognito User Pools&#8217;a Derin Bak\u0131\u015f: Kimlik Y\u00f6netiminin Kalbi<\/h3>\n<p>Amazon Cognito, web ve mobil uygulamalar\u0131n\u0131za kullan\u0131c\u0131 kayd\u0131, oturum a\u00e7ma ve eri\u015fim kontrol\u00fc eklemenizi kolayla\u015ft\u0131ran bir hizmettir. \u0130ki ana bile\u015fenden olu\u015fur: User Pools ve Identity Pools. Bu makalede odaklanaca\u011f\u0131m\u0131z User Pools, uygulamalar\u0131n\u0131z i\u00e7in g\u00fcvenli ve \u00f6l\u00e7eklenebilir bir kullan\u0131c\u0131 dizini g\u00f6revi g\u00f6r\u00fcr. \u00d6zetle, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n kimliklerini y\u00f6neten bir hizmettir. \u0130\u015fte temel \u00f6zellikleri:<\/p>\n<ul>\n<li><strong>Kullan\u0131c\u0131 Dizini:<\/strong> Milyonlarca kullan\u0131c\u0131y\u0131 bar\u0131nd\u0131rabilir ve y\u00f6netebilir.<\/li>\n<li><strong>Kimlik Do\u011frulama:<\/strong> Kullan\u0131c\u0131 ad\u0131 ve \u015fifre, sosyal kimlik sa\u011flay\u0131c\u0131lar\u0131 (Google, Facebook, Apple) veya SAML\/OIDC uyumlu kurumsal kimlik sa\u011flay\u0131c\u0131lar\u0131 \u00fczerinden oturum a\u00e7ma imkan\u0131 sunar.<\/li>\n<li><strong>Token Y\u00f6netimi:<\/strong> Ba\u015far\u0131l\u0131 bir oturum a\u00e7ma i\u015fleminden sonra, Cognito User Pools \u00fc\u00e7 temel JWT (JSON Web Token) t\u00fcr\u00fc verir:\n<ul>\n<li><strong>ID Token:<\/strong> Kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131n\u0131n kimlik bilgilerini (\u00f6rne\u011fin kullan\u0131c\u0131 ad\u0131, e-posta) i\u00e7erir. Kimlik do\u011frulamas\u0131 i\u00e7in kullan\u0131l\u0131r.<\/li>\n<li><strong>Access Token:<\/strong> API&#8217;lere ve kaynaklara eri\u015fim yetkisi verir. Kullan\u0131c\u0131n\u0131n hangi kaynaklara eri\u015febilece\u011fini belirleyen yetki kapsamlar\u0131n\u0131 (scopes) i\u00e7erebilir.<\/li>\n<li><strong>Refresh Token:<\/strong> Access ve ID token&#8217;lar\u0131 sona erdi\u011finde yeni token&#8217;lar almak i\u00e7in kullan\u0131l\u0131r. Bu sayede kullan\u0131c\u0131lar\u0131n s\u00fcrekli tekrar oturum a\u00e7mas\u0131 gerekmez.<\/li>\n<\/ul>\n<\/li>\n<li><strong>\u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA):<\/strong> SMS veya TOTP tabanl\u0131 MFA deste\u011fi sunarak g\u00fcvenli\u011fi art\u0131r\u0131r.<\/li>\n<li><strong>\u00d6zelle\u015ftirilebilir Kullan\u0131c\u0131 Ak\u0131\u015flar\u0131:<\/strong> Lambda tetikleyicileri ile oturum a\u00e7ma, kay\u0131t olma, \u015fifre s\u0131f\u0131rlama gibi s\u00fcre\u00e7leri \u00f6zelle\u015ftirebilirsiniz.<\/li>\n<\/ul>\n<p>Cognito User Pools, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n kimliklerini merkezi ve g\u00fcvenli bir \u015fekilde y\u00f6netirken, uygulamalar\u0131n\u0131z\u0131n API&#8217;lerine eri\u015fimi d\u00fczenlemek i\u00e7in API Gateway ile m\u00fckemmel bir uyum sa\u011flar. Kullan\u0131c\u0131lar Cognito arac\u0131l\u0131\u011f\u0131yla kimlik do\u011frulamas\u0131ndan ge\u00e7tikten sonra ald\u0131klar\u0131 Access Token, API Gateway&#8217;e g\u00f6nderilen isteklerin yetkilendirilmesi i\u00e7in kullan\u0131l\u0131r. Bu entegrasyon, kimlik y\u00f6netimi y\u00fck\u00fcn\u00fc AWS&#8217;ye devrederek geli\u015ftiricilerin i\u015f y\u00fck\u00fcn\u00fc \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.<\/p>\n<h2>Cognito User Pool Yetkilendiricisinin \u00c7al\u0131\u015fma Prensibi: Token&#8217;lar\u0131n Yolculu\u011fu<\/h2>\n<p>API Gateway&#8217;de Cognito User Pool yetkilendiricisinin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 anlamak, g\u00fcvenli bir mimari in\u015fa etmek i\u00e7in temeldir. Bu mekanizma, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n kimlik do\u011frulama ve API eri\u015fim s\u00fcre\u00e7lerini otomatize eden bir k\u00f6pr\u00fc g\u00f6revi g\u00f6r\u00fcr. \u0130\u015fte ad\u0131m ad\u0131m \u00e7al\u0131\u015fma prensibi:<\/p>\n<ol>\n<li><strong>Kullan\u0131c\u0131 Oturum A\u00e7ma ve Token Alma:<\/strong>\n<p>Kullan\u0131c\u0131, uygulaman\u0131z\u0131n (mobil, web veya tek sayfa uygulama) oturum a\u00e7ma aray\u00fcz\u00fc arac\u0131l\u0131\u011f\u0131yla Amazon Cognito User Pool&#8217;da kimlik do\u011frulamas\u0131 yapar. Bu i\u015flem sonucunda, Cognito, kullan\u0131c\u0131ya bir ID Token, bir Access Token ve bir Refresh Token verir. Bu token&#8217;lar JWT (JSON Web Token) format\u0131ndad\u0131r ve kriptografik olarak imzal\u0131d\u0131r, bu da onlar\u0131n g\u00fcvenilirli\u011fini garanti eder. Access Token, API Gateway taraf\u0131ndan API&#8217;ye eri\u015fim yetkisini do\u011frulamak i\u00e7in kullan\u0131lacak anahtar bile\u015fendir.<\/p>\n<\/li>\n<li><strong>API \u0130ste\u011fi G\u00f6nderme:<\/strong>\n<p>Kullan\u0131c\u0131, uygulamas\u0131nda korunan bir API kayna\u011f\u0131na eri\u015fmek istedi\u011finde, uygulama bu iste\u011fi API Gateway&#8217;e g\u00f6nderir. Bu iste\u011fin HTTP ba\u015fl\u0131klar\u0131ndan (genellikle <code>Authorization<\/code> ba\u015fl\u0131\u011f\u0131 alt\u0131nda <code>Bearer <Access Token><\/code> format\u0131nda) Access Token&#8217;\u0131 i\u00e7ermesi gerekir. Bu token, kullan\u0131c\u0131n\u0131n API&#8217;ye eri\u015fme yetkisini kan\u0131t\u0131d\u0131r.<\/p>\n<\/li>\n<li><strong>API Gateway Taraf\u0131ndan Yetkilendirme Ba\u015flatma:<\/strong>\n<p>API Gateway, gelen iste\u011fi al\u0131r almaz, iste\u011fin yap\u0131land\u0131r\u0131lm\u0131\u015f bir Cognito User Pool yetkilendiricisi taraf\u0131ndan korunup korunmad\u0131\u011f\u0131n\u0131 kontrol eder. E\u011fer korunan bir kaynak ise, API Gateway otomatik olarak yetkilendirme s\u00fcrecini ba\u015flat\u0131r. Bu a\u015famada, API Gateway, iste\u011fin <code>Authorization<\/code> ba\u015fl\u0131\u011f\u0131ndaki Access Token&#8217;\u0131 al\u0131r ve bu token&#8217;\u0131n ge\u00e7erlili\u011fini do\u011frulamak i\u00e7in gerekli ad\u0131mlar\u0131 atar.<\/p>\n<\/li>\n<li><strong>Access Token Do\u011frulama:<\/strong>\n<p>API Gateway, Access Token&#8217;\u0131 ald\u0131ktan sonra \u015fu do\u011frulama ad\u0131mlar\u0131n\u0131 uygular:<\/p>\n<ul>\n<li><strong>\u0130mza Do\u011frulamas\u0131:<\/strong> Token&#8217;\u0131n Cognito taraf\u0131ndan imzaland\u0131\u011f\u0131n\u0131 ve yolculuk s\u0131ras\u0131nda de\u011fi\u015ftirilmedi\u011fini do\u011frulamak i\u00e7in Cognito User Pool&#8217;un herkese a\u00e7\u0131k anahtar\u0131n\u0131 (public key) kullan\u0131r. Bu anahtarlar, Cognito&#8217;nun belirli bir User Pool i\u00e7in yay\u0131nlad\u0131\u011f\u0131 OpenID Connect (OIDC) meta veri u\u00e7 noktas\u0131ndan al\u0131nabilir.<\/li>\n<li><strong>Token S\u00fcresi (Expiration):<\/strong> Token&#8217;\u0131n s\u00fcresinin dolup dolmad\u0131\u011f\u0131n\u0131 kontrol eder. S\u00fcresi dolmu\u015f token&#8217;lar reddedilir.<\/li>\n<li><strong>Hedef Kitle (Audience):<\/strong> Token&#8217;\u0131n belirli bir uygulama istemcisi (app client) i\u00e7in verildi\u011fini ve yetkilendirilmi\u015f API&#8217;ye eri\u015fmek i\u00e7in uygun oldu\u011funu kontrol eder.<\/li>\n<li><strong>Veren Taraf (Issuer):<\/strong> Token&#8217;\u0131n do\u011fru Cognito User Pool&#8217;dan geldi\u011fini do\u011frular.<\/li>\n<li><strong>Kapsamlar (Scopes &#8211; iste\u011fe ba\u011fl\u0131):<\/strong> E\u011fer API kaynaklar\u0131 belirli kapsamlar gerektiriyorsa (\u00f6rne\u011fin, <code>admin.read<\/code> veya <code>user.write<\/code>), Access Token&#8217;daki kapsamlar\u0131n istenen API eri\u015fimi i\u00e7in yeterli olup olmad\u0131\u011f\u0131n\u0131 kontrol eder. Bu, daha ince taneli eri\u015fim kontrol\u00fc sa\u011flar.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Yetkilendirme Karar\u0131 ve \u0130ste\u011fin \u0130letilmesi:<\/strong>\n<p>E\u011fer t\u00fcm do\u011frulama ad\u0131mlar\u0131 ba\u015far\u0131l\u0131 olursa, Access Token ge\u00e7erli kabul edilir ve API Gateway, iste\u011fi arka u\u00e7 servisine (\u00f6rne\u011fin bir Lambda fonksiyonu veya ba\u015fka bir HTTP u\u00e7 noktas\u0131) iletir. Bu noktada, API Gateway, Access Token&#8217;daki kullan\u0131c\u0131 bilgilerini (kullan\u0131c\u0131 ID&#8217;si, gruplar vb.) arka uca HTTP ba\u015fl\u0131klar\u0131 veya di\u011fer mekanizmalar arac\u0131l\u0131\u011f\u0131yla aktarabilir. Bu bilgiler, arka u\u00e7 servisinin i\u015f mant\u0131\u011f\u0131nda daha fazla yetkilendirme karar\u0131 almak veya kullan\u0131c\u0131ya \u00f6zg\u00fc verileri i\u015flemek i\u00e7in kullan\u0131labilir.<\/p>\n<\/li>\n<li><strong>Hata Durumu:<\/strong>\n<p>E\u011fer do\u011frulama ad\u0131mlar\u0131ndan herhangi biri ba\u015far\u0131s\u0131z olursa (\u00f6rne\u011fin, ge\u00e7ersiz imza, s\u00fcresi dolmu\u015f token, eksik kapsam), API Gateway iste\u011fi reddeder ve istemciye bir hata yan\u0131t\u0131 (genellikle HTTP 401 Unauthorized veya 403 Forbidden) g\u00f6nderir. Bu, API&#8217;nizin yetkisiz eri\u015fime kar\u015f\u0131 korunmas\u0131n\u0131 sa\u011flar.<\/p>\n<\/li>\n<\/ol>\n<div class=\"expert-tip\">\n  Uzman \u0130pucu: API Gateway&#8217;deki \u00f6nbellekleme (caching) \u00f6zelli\u011fini etkinle\u015ftirerek yetkilendirici \u00e7a\u011fr\u0131lar\u0131n\u0131 optimize edebilirsiniz. Bu, ge\u00e7erli token&#8217;lar i\u00e7in tekrar tekrar do\u011frulama i\u015flemi yap\u0131lmas\u0131na gerek kalmadan performans\u0131 art\u0131r\u0131r ve maliyetleri d\u00fc\u015f\u00fcr\u00fcr. \u00d6nbellek s\u00fcresini (TTL) token&#8217;\u0131n ge\u00e7erlilik s\u00fcresinden k\u0131sa tutmak \u00f6nemlidir.\n<\/div>\n<p>Bu \u00e7al\u0131\u015fma prensibi sayesinde, API Gateway, API&#8217;lerinizin \u00f6n cephesinde sa\u011flam bir g\u00fcvenlik duvar\u0131 olu\u015ftururken, Amazon Cognito ise kullan\u0131c\u0131 kimlik y\u00f6netimi ve token \u00fcretim y\u00fck\u00fcn\u00fc tamamen \u00fcstlenir. Bu, geli\u015ftiricilerin g\u00fcvenli\u011fe odaklanmak yerine i\u015f mant\u0131\u011f\u0131na yo\u011funla\u015fmas\u0131na olanak tan\u0131r ve \u00f6l\u00e7eklenebilir, g\u00fcvenli uygulamalar\u0131n temelini olu\u015fturur.<\/p>\n<h2>Ad\u0131m Ad\u0131m Kurulum: API Gateway ile Cognito User Pool Yetkilendiricisi Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?<\/h2>\n<p>\u015eimdi teoriden prati\u011fe ge\u00e7elim ve AWS konsolu \u00fczerinden API Gateway ile Cognito User Pool yetkilendiricisini ad\u0131m ad\u0131m nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 inceleyelim. Bu s\u00fcre\u00e7, birka\u00e7 temel ad\u0131m\u0131 i\u00e7erir ve nispeten basittir, ancak her ad\u0131m\u0131n do\u011fru bir \u015fekilde yap\u0131lmas\u0131 \u00f6nemlidir.<\/p>\n<h3>Cognito User Pool Olu\u015fturma: Kullan\u0131c\u0131 Y\u00f6netiminizin Temelini At\u0131n<\/h3>\n<p>\u0130lk olarak, kullan\u0131c\u0131lar\u0131n\u0131z\u0131 y\u00f6netecek olan Cognito User Pool&#8217;u olu\u015fturman\u0131z gerekir:<\/p>\n<ol>\n<li><strong>Cognito Konsoluna Gitme:<\/strong> AWS konsolunda &#8220;Cognito&#8221; hizmetini aray\u0131n ve User Pools b\u00f6l\u00fcm\u00fcne gidin.<\/li>\n<li><strong>Yeni User Pool Olu\u015fturma:<\/strong> &#8220;Create a user pool&#8221; butonuna t\u0131klay\u0131n.<\/li>\n<li><strong>Ad\u0131m 1: Kullan\u0131c\u0131 Deneyimi Yap\u0131land\u0131rma:<\/strong>\n<ul>\n<li><strong>Cognito User Pool Giri\u015fi:<\/strong> Varsay\u0131lan ayarlar\u0131 kullanabilir veya kullan\u0131c\u0131lar\u0131n\u0131z\u0131n nas\u0131l oturum a\u00e7aca\u011f\u0131n\u0131 (kullan\u0131c\u0131 ad\u0131, e-posta, telefon numaras\u0131 gibi) se\u00e7ebilirsiniz. Genellikle e-posta veya kullan\u0131c\u0131 ad\u0131 tercih edilir.<\/li>\n<li><strong>Parola Politikas\u0131:<\/strong> G\u00fc\u00e7l\u00fc bir parola politikas\u0131 belirleyin.<\/li>\n<li><strong>MFA:<\/strong> \u0130ste\u011fe ba\u011fl\u0131 olarak \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) etkinle\u015ftirebilirsiniz (SMS veya TOTP tabanl\u0131).<\/li>\n<li>Di\u011fer ayarlar\u0131 (self-service signup, hesap kurtarma vb.) ihtiya\u00e7lar\u0131n\u0131za g\u00f6re yap\u0131land\u0131r\u0131n.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Ad\u0131m 2: G\u00fcvenlik Gereksinimlerini Yap\u0131land\u0131rma:<\/strong>\n<ul>\n<li><strong>Uygulama istemcisi olu\u015fturma (App Client):<\/strong> API Gateway&#8217;e veya uygulaman\u0131za token sa\u011flayacak bir &#8220;app client&#8221; olu\u015fturmal\u0131s\u0131n\u0131z. &#8220;Create an app client&#8221; se\u00e7ene\u011fini se\u00e7in, bir isim verin (\u00f6rn. <code>WebApiClient<\/code>). &#8220;Generate a client secret&#8221; se\u00e7ene\u011fini i\u015faretlemeyin; zira genel web veya mobil uygulamalar genellikle client secret kullanmaz.<\/li>\n<li>Callback URL&#8217;leri ve Logout URL&#8217;leri gibi di\u011fer OAuth ayarlar\u0131n\u0131, uygulaman\u0131z\u0131n y\u00f6nlendirme mant\u0131\u011f\u0131na g\u00f6re yap\u0131land\u0131r\u0131n.<\/li>\n<li>Kapsamlar (Scopes): Uygulaman\u0131z\u0131n ihtiya\u00e7 duydu\u011fu \u00f6zel kapsamlar\u0131 tan\u0131mlayabilirsiniz (\u00f6rn. <code>api\/read<\/code>, <code>api\/write<\/code>).<\/li>\n<\/ul>\n<\/li>\n<li><strong>Ad\u0131m 3: \u0130nceleme ve Olu\u015fturma:<\/strong> T\u00fcm ayarlar\u0131 g\u00f6zden ge\u00e7irin ve User Pool&#8217;u olu\u015fturun. Olu\u015fturduktan sonra, <strong>User Pool ID<\/strong> (\u00f6rn. <code>us-east-1_xxxxxxxxx<\/code>) ve <strong>App Client ID<\/strong> (\u00f6rn. <code>yyyyyyyyyyyyyyyyyyyyyy<\/code>) de\u011ferlerini not edin. Bu bilgiler API Gateway yap\u0131land\u0131rmas\u0131 i\u00e7in gereklidir.<\/li>\n<\/ol>\n<h3>API Gateway \u00dczerinde Yetkilendirici Tan\u0131mlama: K\u00f6pr\u00fcy\u00fc Kurun<\/h3>\n<p>Cognito User Pool&#8217;unuz haz\u0131r oldu\u011funa g\u00f6re, \u015fimdi API Gateway&#8217;de bu User Pool&#8217;u yetkilendirici olarak tan\u0131mlayal\u0131m:<\/p>\n<ol>\n<li><strong>API Gateway Konsoluna Gitme:<\/strong> AWS konsolunda &#8220;API Gateway&#8221; hizmetine gidin.<\/li>\n<li><strong>API&#8217;nizi Se\u00e7me veya Olu\u015fturma:<\/strong> Mevcut bir REST API&#8217;nizi se\u00e7in veya yeni bir API olu\u015fturun.<\/li>\n<li><strong>Yetkilendiriciler B\u00f6l\u00fcm\u00fcne Gitme:<\/strong> Sol men\u00fcden &#8220;Authorizers&#8221; (Yetkilendiriciler) se\u00e7ene\u011fine t\u0131klay\u0131n.<\/li>\n<li><strong>Yeni Yetkilendirici Olu\u015fturma:<\/strong> &#8220;Create new Authorizer&#8221; (Yeni yetkilendirici olu\u015ftur) butonuna t\u0131klay\u0131n.\n<ul>\n<li><strong>Yetkilendirici Ad\u0131:<\/strong> Anlaml\u0131 bir isim verin (\u00f6rn. <code>CognitoUserPoolAuthorizer<\/code>).<\/li>\n<li><strong>Type (T\u00fcr):<\/strong> &#8220;Cognito&#8221; se\u00e7ene\u011fini i\u015faretleyin.<\/li>\n<li><strong>Cognito User Pool:<\/strong> A\u00e7\u0131l\u0131r men\u00fcden daha \u00f6nce olu\u015fturdu\u011funuz User Pool&#8217;u se\u00e7in (User Pool ID&#8217;sini kullan\u0131n).<\/li>\n<li><strong>Token Source (Token Kayna\u011f\u0131):<\/strong> API Gateway&#8217;in Access Token&#8217;\u0131 nereden alaca\u011f\u0131n\u0131 belirtin. Varsay\u0131lan olarak <code>Authorization<\/code> ba\u015fl\u0131\u011f\u0131d\u0131r. Bu ba\u015fl\u0131k ad\u0131 genellikle <code>Authorization<\/code> olarak kal\u0131r, \u00e7\u00fcnk\u00fc istemciler genellikle token&#8217;lar\u0131n\u0131 bu ba\u015fl\u0131k alt\u0131nda g\u00f6nderirler.<\/li>\n<li><strong>Token Validation (\u0130ste\u011fe Ba\u011fl\u0131):<\/strong> RegEx kullanarak token&#8217;\u0131n belirli bir deseni takip etmesini sa\u011flayabilirsiniz, ancak \u00e7o\u011fu zaman buna gerek yoktur.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Kaydetme:<\/strong> Yetkilendiriciyi kaydedin.<\/li>\n<\/ol>\n<h3>API Kaynaklar\u0131 ve Metotlar\u0131 \u00dczerinde Yetkilendirme Uygulama: Korunan Kap\u0131lar<\/h3>\n<p>Yetkilendiricinizi tan\u0131mlad\u0131ktan sonra, \u015fimdi bunu API kaynaklar\u0131n\u0131za ve HTTP metotlar\u0131n\u0131za uygulaman\u0131z gerekiyor:<\/p>\n<ol>\n<li><strong>API&#8217;nizin Kaynaklar\u0131na Gitme:<\/strong> API Gateway konsolunda API&#8217;nizin &#8220;Resources&#8221; (Kaynaklar) b\u00f6l\u00fcm\u00fcne gidin.<\/li>\n<li><strong>Metot Se\u00e7imi:<\/strong> Yetkilendirme uygulamak istedi\u011finiz belirli bir kayna\u011f\u0131 (\u00f6rne\u011fin <code>\/items<\/code>) ve bir HTTP metodunu (\u00f6rne\u011fin <code>GET<\/code> veya <code>POST<\/code>) se\u00e7in.<\/li>\n<li><strong>Metot \u0130ste\u011fini Yap\u0131land\u0131rma:<\/strong> &#8220;Method Request&#8221; (Metot \u0130ste\u011fi) ba\u011flant\u0131s\u0131na t\u0131klay\u0131n.<\/li>\n<li><strong>Yetkilendiriciyi Se\u00e7me:<\/strong> &#8220;Authorization&#8221; (Yetkilendirme) a\u00e7\u0131l\u0131r men\u00fcs\u00fcnden, az \u00f6nce olu\u015fturdu\u011funuz Cognito User Pool yetkilendiricisini se\u00e7in (\u00f6rn. <code>CognitoUserPoolAuthorizer<\/code>).<\/li>\n<li><strong>Kapsamlar\u0131 Ekleme (\u0130ste\u011fe Ba\u011fl\u0131):<\/strong> E\u011fer API metodunuz belirli kapsamlar gerektiriyorsa, &#8220;OAuth Scopes&#8221; (OAuth Kapsamlar\u0131) alan\u0131na bu kapsamlar\u0131 ekleyin (\u00f6rn. <code>api\/read<\/code>). Bu, sadece ilgili kapsamlara sahip kullan\u0131c\u0131lar\u0131n bu API&#8217;ye eri\u015fmesini sa\u011flar.<\/li>\n<li><strong>Kaydetme:<\/strong> De\u011fi\u015fiklikleri kaydedin.<\/li>\n<li><strong>API&#8217;yi Da\u011f\u0131tma:<\/strong> Yapt\u0131\u011f\u0131n\u0131z de\u011fi\u015fikliklerin etkili olmas\u0131 i\u00e7in API&#8217;nizi bir &#8220;Stage&#8221; (A\u015fama) \u00fczerine da\u011f\u0131tman\u0131z gerekir. &#8220;Actions&#8221; men\u00fcs\u00fcnden &#8220;Deploy API&#8221; (API&#8217;yi Da\u011f\u0131t) se\u00e7ene\u011fini se\u00e7in ve mevcut bir a\u015famay\u0131 se\u00e7in veya yeni bir a\u015fama olu\u015fturun.<\/li>\n<\/ol>\n<h3>Bir Test \u0130ste\u011fi G\u00f6nderme: \u00c7al\u0131\u015ft\u0131\u011f\u0131n\u0131 Do\u011frulama<\/h3>\n<p>\u015eimdi her \u015feyin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test edelim. Bir kullan\u0131c\u0131 olarak oturum a\u00e7\u0131p bir Access Token almal\u0131 ve bu token ile API&#8217;ye istek g\u00f6ndermelisiniz. Postman, Insomnia veya cURL gibi ara\u00e7lar\u0131 kullanabilirsiniz.<\/p>\n<p>\u00d6ncelikle, Cognito User Pool&#8217;da bir kullan\u0131c\u0131 olu\u015fturun ve bu kullan\u0131c\u0131yla oturum a\u00e7arak bir Access Token al\u0131n. Bu token&#8217;\u0131 almak i\u00e7in Cognito&#8217;nun kimlik do\u011frulama ak\u0131\u015flar\u0131n\u0131 veya AWS SDK&#8217;y\u0131 kullanabilirsiniz. \u00d6rne\u011fin, AWS Amplify k\u00fct\u00fcphanesi web\/mobil uygulamalar i\u00e7in bu s\u00fcreci kolayla\u015ft\u0131r\u0131r.<\/p>\n<p>Ald\u0131\u011f\u0131n\u0131z Access Token&#8217;\u0131 kullanarak a\u015fa\u011f\u0131daki gibi bir cURL iste\u011fi g\u00f6nderebilirsiniz:<\/p>\n<pre><code>\n  curl -X GET 'https:\/\/your-api-gateway-id.execute-api.region.amazonaws.com\/your-stage\/your-resource' \\\n  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'\n<\/pre>\n<p><\/code><\/p>\n<p>E\u011fer her \u015fey do\u011fru yap\u0131land\u0131r\u0131ld\u0131ysa, API'nizden ba\u015far\u0131l\u0131 bir yan\u0131t almal\u0131s\u0131n\u0131z. E\u011fer token ge\u00e7ersizse veya eksikse, bir 401 Unauthorized veya 403 Forbidden hatas\u0131 al\u0131rs\u0131n\u0131z. Bu hatalar\u0131 AWS CloudWatch g\u00fcnl\u00fcklerinde de g\u00f6rebilirsiniz, bu da sorun giderme i\u00e7in \u00f6nemli bir kaynakt\u0131r.<\/p>\n<p>Bu ad\u0131mlarla, API Gateway'nizi Amazon Cognito User Pool yetkilendiricisi ile ba\u015far\u0131yla entegre etmi\u015f ve API'lerinizi g\u00fcvence alt\u0131na alm\u0131\u015f olursunuz. Bu yap\u0131land\u0131rma, hem g\u00fcvenlik hem de y\u00f6netim kolayl\u0131\u011f\u0131 a\u00e7\u0131s\u0131ndan modern uygulamalar i\u00e7in g\u00fc\u00e7l\u00fc bir temel sunar.<\/p>\n<h2>Ger\u00e7ek D\u00fcnya Senaryolar\u0131 ve \u0130leri D\u00fczey Kullan\u0131m \u0130pu\u00e7lar\u0131<\/h2>\n<p>Cognito User Pool yetkilendiricisi, sadece temel kimlik do\u011frulamadan \u00e7ok daha fazlas\u0131n\u0131 sunar. Ger\u00e7ek d\u00fcnya uygulamalar\u0131nda kar\u015f\u0131la\u015f\u0131lan karma\u015f\u0131k g\u00fcvenlik ve yetkilendirme ihtiya\u00e7lar\u0131n\u0131 kar\u015f\u0131lamak i\u00e7in \u00e7e\u015fitli ileri d\u00fczey senaryolarda kullan\u0131labilir. Bu b\u00f6l\u00fcmde, birka\u00e7 \u00f6nemli kullan\u0131m senaryosu ve optimizasyon ipucunu ele alaca\u011f\u0131z.<\/p>\n<h3>Mikroservis Mimarilerinde Kimlik Do\u011frulama: API Gateway'in Rol\u00fc<\/h3>\n<p>Mikroservis mimarileri, uygulaman\u0131z\u0131n farkl\u0131 i\u015flevlerini ba\u011f\u0131ms\u0131z, k\u00fc\u00e7\u00fck servisler halinde ay\u0131rman\u0131z\u0131 sa\u011flar. Bu mimarilerde, API Gateway, t\u00fcm mikroservisler i\u00e7in tek bir eri\u015fim noktas\u0131 (API fa\u00e7ade) g\u00f6revi g\u00f6r\u00fcr. Cognito User Pool yetkilendiricisini API Gateway seviyesinde yap\u0131land\u0131rmak, bu mimarilerde kimlik do\u011frulamay\u0131 merkezile\u015ftirmenin en etkili yoludur. Kullan\u0131c\u0131, sadece API Gateway'e token'\u0131n\u0131 g\u00f6nderir ve do\u011frulama burada ger\u00e7ekle\u015fir. API Gateway, iste\u011fi yetkilendirdikten sonra, iste\u011fi ilgili mikroservise (\u00f6rne\u011fin bir Lambda fonksiyonuna veya Fargate \u00fczerindeki bir servise) iletir. Bu durumda, arka u\u00e7 mikroservislerin her birinin kendi i\u00e7inde token do\u011frulama mant\u0131\u011f\u0131 i\u00e7ermesine gerek kalmaz. Ancak, arka u\u00e7 servislerin token'dan gelen kullan\u0131c\u0131 kimlik bilgilerini (kullan\u0131c\u0131 ID'si, roller, gruplar) kullanarak daha ince taneli yetkilendirme kararlar\u0131 almas\u0131 gerekebilir. API Gateway, bu bilgileri arka u\u00e7 servisine HTTP ba\u015fl\u0131klar\u0131 veya context nesnesi arac\u0131l\u0131\u011f\u0131yla iletebilir.<\/p>\n<pre><code>\n  \/\/ Python Flask \u00f6rne\u011fi - Gelen request header'dan kullan\u0131c\u0131 ID'si alma\n  from flask import Flask, request, jsonify\n\n  app = Flask(__name__)\n\n  @app.route('\/protected-resource')\n  def protected_resource():\n      # API Gateway'den gelen token bilgileri genellikle X-Amzn-Authorizer-Decoded-JWT veya benzeri ba\u015fl\u0131klarla gelir.\n      # Ya da Lambda integration ile context objesinde.\n      # Varsay\u0131msal olarak, API Gateway userId'yi bir ba\u015fl\u0131\u011fa eklemi\u015f olsun.\n      user_id = request.headers.get('X-User-ID') \n\n      if not user_id:\n          return jsonify({\"message\": \"Unauthorized\"}), 401\n      \n      # \u0130\u015f mant\u0131\u011f\u0131 burada ba\u015flar, user_id kullan\u0131larak veritaban\u0131ndan kullan\u0131c\u0131ya \u00f6zel veriler \u00e7ekilebilir\n      return jsonify({\"message\": f\"Hello, user {user_id}! This is your protected data.\"}), 200\n\n  if __name__ == '__main__':\n      app.run(debug=True)\n<\/pre>\n<p><\/code><\/p>\n<p>Bu yakla\u015f\u0131m, mikroservislerin \"kimlik do\u011frulama\" y\u00fck\u00fcnden kurtulup sadece \"yetkilendirme\" ve i\u015f mant\u0131\u011f\u0131na odaklanmas\u0131n\u0131 sa\u011flar.<\/p>\n<h3>\u00d6zel Kapsamlar (Custom Scopes) ve Yetkilendirme: Daha \u0130nce Taneli Kontrol<\/h3>\n<p>Bazen bir API kayna\u011f\u0131na eri\u015fim i\u00e7in sadece kullan\u0131c\u0131n\u0131n kimli\u011finin do\u011frulanm\u0131\u015f olmas\u0131 yeterli de\u011fildir; ayn\u0131 zamanda belirli bir yetkiye veya role sahip olmas\u0131 da gerekebilir. Cognito User Pools, bu t\u00fcr senaryolar i\u00e7in \u00f6zel kapsamlar (custom scopes) tan\u0131mlama imkan\u0131 sunar. \u00d6rne\u011fin, bir \"admin\" kullan\u0131c\u0131s\u0131n\u0131n <code>admin.read<\/code> ve <code>admin.write<\/code> kapsamlar\u0131na sahip olmas\u0131 gerekirken, \"normal\" bir kullan\u0131c\u0131n\u0131n sadece <code>user.read<\/code> kapsam\u0131na sahip olmas\u0131 yeterli olabilir. API Gateway'deki yetkilendiricinizi yap\u0131land\u0131r\u0131rken, belirli API metotlar\u0131 i\u00e7in bu \u00f6zel kapsamlar\u0131 belirtebilirsiniz. B\u00f6ylece, API Gateway, Access Token'daki kapsamlar\u0131n (<code>scope<\/code> claim) gerekli kapsamlar\u0131 i\u00e7erip i\u00e7ermedi\u011fini kontrol eder ve yaln\u0131zca uygun kapsama sahip token'lara sahip istekleri arka uca iletir.<\/p>\n<pre><code>\n  \/\/ API Gateway'de bir metod i\u00e7in OAuth kapsam\u0131 belirleme \u00f6rne\u011fi (pseudo kod)\n  \/\/ GET \/admin\/users metoduna sadece \"admin.read\" kapsam\u0131 ile eri\u015filebilir\n  \/\/ API Gateway Console -> Resource -> GET Method -> Method Request -> Authorization -> OAuth Scopes: admin.read\n<\/pre>\n<p><\/code><\/p>\n<h3>Hata Y\u00f6netimi ve G\u00f6zlem (Monitoring): Sorunlar\u0131 H\u0131zla Tespit Edin<\/h3>\n<p>API Gateway ve Cognito entegrasyonunda olu\u015fan hatalar\u0131 anlamak ve gidermek i\u00e7in etkili g\u00f6zlem \u00f6nemlidir. API Gateway, t\u00fcm istekleri ve yetkilendirme kararlar\u0131n\u0131 Amazon CloudWatch'a g\u00f6nderir. Yetkilendirme g\u00fcnl\u00fcklerini etkinle\u015ftirerek, Access Token'\u0131n neden reddedildi\u011fine dair detayl\u0131 bilgilere (s\u00fcresi dolmu\u015f, ge\u00e7ersiz imza, eksik kapsam vb.) eri\u015febilirsiniz. Bu, sorun giderme s\u00fcre\u00e7lerini h\u0131zland\u0131r\u0131r ve g\u00fcvenlik olaylar\u0131n\u0131 tespit etmenize yard\u0131mc\u0131 olur. CloudWatch Alarmlar\u0131 kurarak ba\u015far\u0131s\u0131z yetkilendirme denemeleri belirli bir e\u015fi\u011fi a\u015ft\u0131\u011f\u0131nda bildirim alabilirsiniz.<\/p>\n<h3>AWS WAF ile Ek G\u00fcvenlik Katmanlar\u0131: \u00c7ok Katmanl\u0131 Savunma<\/h3>\n<p>Cognito User Pool yetkilendiricisi, kimlik do\u011frulamay\u0131 sa\u011flarken, API'nizin di\u011fer yayg\u0131n web sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korunmas\u0131n\u0131 sa\u011flamaz. AWS Web Application Firewall (WAF) ile API Gateway'inizi entegre ederek SQL Injection, Cross-Site Scripting (XSS), bot sald\u0131r\u0131lar\u0131 ve DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 ek bir savunma katman\u0131 ekleyebilirsiniz. WAF, API Gateway'e ula\u015fan istekleri, yetkilendirmeden \u00f6nce belirli kurallara g\u00f6re filtreleyerek potansiyel tehditleri engeller. Bu, \u00e7ok katmanl\u0131 bir g\u00fcvenlik stratejisinin \u00f6nemli bir par\u00e7as\u0131d\u0131r ve API'lerinizin genel dayan\u0131kl\u0131l\u0131\u011f\u0131n\u0131 art\u0131r\u0131r.<\/p>\n<div class=\"expert-tip\">\n  Uzman \u0130pucu: Token'lar\u0131n s\u00fcresi (TTL - Time To Live) \u00e7ok uzun olmamal\u0131d\u0131r. K\u0131sa \u00f6m\u00fcrl\u00fc Access Token'lar (\u00f6rne\u011fin 1 saat) ve Refresh Token'lar ile kullan\u0131c\u0131 deneyimi ile g\u00fcvenli\u011fi dengeleyin. Refresh Token'lar, Access Token'lar\u0131n s\u00fcresi doldu\u011funda arka planda otomatik olarak yenilerini almak i\u00e7in kullan\u0131l\u0131r ve bu sayede kullan\u0131c\u0131n\u0131n tekrar oturum a\u00e7mas\u0131na gerek kalmaz. Client taraf\u0131nda Refresh Token y\u00f6netimini do\u011fru yapmak, ak\u0131c\u0131 bir kullan\u0131c\u0131 deneyimi i\u00e7in kritiktir.\n<\/div>\n<p>Bu ileri d\u00fczey kullan\u0131m senaryolar\u0131 ve ipu\u00e7lar\u0131, Cognito User Pool yetkilendiricisinin sadece basit bir kimlik do\u011frulama mekanizmas\u0131 olmad\u0131\u011f\u0131n\u0131, ayn\u0131 zamanda karma\u015f\u0131k, g\u00fcvenli ve \u00f6l\u00e7eklenebilir bulut uygulamalar\u0131 in\u015fa etmek i\u00e7in esnek ve g\u00fc\u00e7l\u00fc bir ara\u00e7 oldu\u011funu g\u00f6stermektedir. Do\u011fru yap\u0131land\u0131rma ve entegrasyon ile API'lerinizin g\u00fcvenli\u011fini en \u00fcst d\u00fczeye \u00e7\u0131karabilir ve geli\u015ftirme s\u00fcrecinizi optimize edebilirsiniz.<\/p>\n<h2>Performans, \u00d6l\u00e7eklenebilirlik ve Maliyet Optimizasyonu<\/h2>\n<p>Bir sistem tasarlarken, g\u00fcvenlik kadar performans, \u00f6l\u00e7eklenebilirlik ve maliyet de temel unsurlard\u0131r. AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi, bu alanlarda da \u00f6nemli avantajlar sunar, ancak do\u011fru yap\u0131land\u0131rma ve stratejilerle daha da optimize edilebilirler.<\/p>\n<h3>API Gateway \u00d6nbellekleme (Caching): Yetkilendirme Y\u00fck\u00fcn\u00fc Azaltma<\/h3>\n<p>API Gateway'deki Cognito User Pool yetkilendiricisi, her gelen istek i\u00e7in Access Token'\u0131 do\u011frular. Y\u00fcksek trafikli uygulamalarda bu, \u00f6nemli bir i\u015flem y\u00fck\u00fc olu\u015fturabilir. API Gateway'in \u00f6nbellekleme (caching) \u00f6zelli\u011fini kullanarak bu y\u00fck\u00fc azaltabilirsiniz. API Gateway, yetkilendirme sonu\u00e7lar\u0131n\u0131 ve hatta arka u\u00e7 yan\u0131tlar\u0131n\u0131 belirli bir s\u00fcre boyunca \u00f6nbellekte tutabilir. E\u011fer ayn\u0131 ge\u00e7erli token ile ard\u0131\u015f\u0131k istekler gelirse, yetkilendirici her seferinde yeniden \u00e7a\u011fr\u0131lmaz, \u00f6nbellekten yan\u0131t verilir. Bu, hem gecikmeyi (latency) azalt\u0131r hem de API Gateway maliyetlerini d\u00fc\u015f\u00fcr\u00fcr.<\/p>\n<ul>\n<li><strong>Yap\u0131land\u0131rma:<\/strong> API Gateway'in \"Stages\" (A\u015famalar) b\u00f6l\u00fcm\u00fcnde \u00f6nbellekleme ayarlar\u0131n\u0131 etkinle\u015ftirebilirsiniz. \"Cache capacity\" (\u00f6nbellek kapasitesi) ve \"Cache TTL\" (\u00f6nbellek ya\u015fam s\u00fcresi) de\u011ferlerini belirleyin.<\/li>\n<li><strong>Optimizasyon:<\/strong> Cache TTL'yi Access Token'\u0131n ge\u00e7erlilik s\u00fcresinden daha k\u0131sa tutman\u0131z \u00f6nemlidir. \u00d6rne\u011fin, Access Token 1 saat ge\u00e7erliyse, \u00f6nbellek TTL'sini 5-10 dakika olarak ayarlayarak, token s\u00fcresi dolmadan \u00f6nce \u00f6nbelle\u011fin yenilenmesini sa\u011flayabilirsiniz. Bu, ge\u00e7erlili\u011fini yitirmi\u015f token'lar\u0131n \u00f6nbellekte kalmas\u0131n\u0131 engeller.<\/li>\n<\/ul>\n<h3>Cognito'nun Do\u011fal \u00d6l\u00e7eklenebilirli\u011fi<\/h3>\n<p>Amazon Cognito, AWS'nin tam olarak y\u00f6netilen bir hizmeti oldu\u011fu i\u00e7in, milyonlarca kullan\u0131c\u0131y\u0131 destekleyecek \u015fekilde tasarlanm\u0131\u015ft\u0131r. Kullan\u0131c\u0131 taban\u0131n\u0131z b\u00fcy\u00fcd\u00fck\u00e7e, Cognito otomatik olarak \u00f6l\u00e7eklenir ve altyap\u0131 y\u00f6netimiyle u\u011fra\u015fman\u0131za gerek kalmaz. Bu, \u00f6zellikle h\u0131zla b\u00fcy\u00fcyen uygulamalar i\u00e7in b\u00fcy\u00fck bir avantajd\u0131r. Kullan\u0131c\u0131 havuzunuzun ve kimlik do\u011frulama taleplerinizin \u00f6l\u00e7e\u011fi ne olursa olsun, Cognito bu y\u00fck\u00fc kald\u0131rabilir.<\/p>\n<h3>Maliyet Optimizasyon Stratejileri<\/h3>\n<p>Hem API Gateway hem de Cognito, kulland\u0131k\u00e7a \u00f6de (pay-as-you-go) modeline sahiptir. Maliyetleri optimize etmek i\u00e7in \u015funlar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurabilirsiniz:<\/p>\n<ul>\n<li><strong>API Gateway \u0130stekleri:<\/strong> API Gateway'e gelen her API \u00e7a\u011fr\u0131s\u0131 ve data transferi \u00fccretlendirilir. \u00d6nbellekleme, tekrar eden istekler i\u00e7in arka u\u00e7 \u00e7a\u011fr\u0131lar\u0131n\u0131 ve dolay\u0131s\u0131yla maliyetleri azalt\u0131r.<\/li>\n<li><strong>Cognito Kullan\u0131c\u0131 Havuzu:<\/strong> Cognito, aktif kullan\u0131c\u0131 say\u0131s\u0131na (ayl\u0131k aktif kullan\u0131c\u0131lar - MAU) g\u00f6re \u00fccretlendirilir. B\u00fcy\u00fck kullan\u0131c\u0131 tabanlar\u0131nda maliyetler artabilir, ancak genellikle rekabet\u00e7i bir fiyata sahiptir. Lambda tetikleyicileri kullan\u0131l\u0131yorsa, Lambda \u00e7a\u011fr\u0131lar\u0131n\u0131n da maliyeti olacakt\u0131r.<\/li>\n<li><strong>G\u00f6zlem ve G\u00fcnl\u00fckleme:<\/strong> CloudWatch g\u00fcnl\u00fckleri de depolama ve sorgu hacmine g\u00f6re \u00fccretlendirilir. Gereksiz veya a\u015f\u0131r\u0131 detayl\u0131 g\u00fcnl\u00fcklemeyi k\u0131s\u0131tlamak maliyetleri d\u00fc\u015f\u00fcrebilir. Sadece kritik bilgileri g\u00fcnl\u00fcklemeye odaklan\u0131n.<\/li>\n<\/ul>\n<h3>Lambda Custom Authorizer ile Kar\u015f\u0131la\u015ft\u0131rma: Do\u011fru Yetkilendiriciyi Se\u00e7mek<\/h3>\n<p>API Gateway, Cognito User Pool yetkilendiricisinin yan\u0131 s\u0131ra, Lambda Custom Authorizer (\u00d6zel Lambda Yetkilendiricisi) se\u00e7ene\u011fi de sunar. Her ikisinin de kendine g\u00f6re avantajlar\u0131 ve dezavantajlar\u0131 vard\u0131r:<\/p>\n<table border=\"1\" style=\"width:100%; border-collapse: collapse;\">\n<thead>\n<tr>\n<th style=\"padding: 8px; border: 1px solid #ddd; text-align: left;\">\u00d6zellik<\/th>\n<th style=\"padding: 8px; border: 1px solid #ddd; text-align: left;\">Cognito User Pool Yetkilendiricisi<\/th>\n<th style=\"padding: 8px; border: 1px solid #ddd; text-align: left;\">Lambda Custom Authorizer<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 8px; border: 1px solid #ddd;\"><strong>Y\u00f6netim Kolayl\u0131\u011f\u0131<\/strong><\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Tamamen y\u00f6netilen, yap\u0131land\u0131rmas\u0131 kolay.<\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Lambda fonksiyonu yazmay\u0131 gerektirir, daha fazla y\u00f6netim.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px; border: 1px solid #ddd;\"><strong>Esneklik<\/strong><\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Standart JWT do\u011frulamas\u0131na odakl\u0131, belirli s\u0131n\u0131rlamalar var.<\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Herhangi bir kimlik do\u011frulama\/yetkilendirme mant\u0131\u011f\u0131n\u0131 uygulayabilir (\u00f6rne\u011fin \u00f6zel bir veritaban\u0131, 3. taraf JWT sa\u011flay\u0131c\u0131lar).<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px; border: 1px solid #ddd;\"><strong>Maliyet<\/strong><\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Sadece API Gateway ve Cognito kullan\u0131m\u0131na ba\u011fl\u0131.<\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">API Gateway ve ek olarak Lambda \u00e7a\u011fr\u0131 maliyeti.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px; border: 1px solid #ddd;\"><strong>Performans<\/strong><\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">D\u00fc\u015f\u00fck gecikme, yerel entegrasyon.<\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Lambda so\u011fuk ba\u015flang\u0131\u00e7lar\u0131 (cold start) nedeniyle daha y\u00fcksek gecikme olabilir.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 8px; border: 1px solid #ddd;\"><strong>Kullan\u0131m Alan\u0131<\/strong><\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Amazon Cognito taraf\u0131ndan y\u00f6netilen kullan\u0131c\u0131lar ve OIDC\/OAuth standartlar\u0131na uygun senaryolar.<\/td>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">\u00d6zel kimlik sa\u011flay\u0131c\u0131lar\u0131, karma\u015f\u0131k yetkilendirme mant\u0131\u011f\u0131 veya \u00e7oklu kimlik do\u011frulama \u015femalar\u0131.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Genel olarak, e\u011fer kullan\u0131c\u0131lar\u0131n\u0131z Amazon Cognito'da y\u00f6netiliyorsa ve standart OIDC\/OAuth 2.0 tabanl\u0131 JWT do\u011frulama sizin i\u00e7in yeterliyse, Cognito User Pool yetkilendiricisi en basit, en uygun maliyetli ve en performansl\u0131 \u00e7\u00f6z\u00fcmd\u00fcr. Ancak daha \u00f6zel ve karma\u015f\u0131k yetkilendirme gereksinimleriniz varsa, Lambda Custom Authorizer daha fazla esneklik sunabilir.<\/p>\n<p>Bu optimizasyon stratejileri, API Gateway ve Cognito entegrasyonunuzun sadece g\u00fcvenli de\u011fil, ayn\u0131 zamanda verimli, \u00f6l\u00e7eklenebilir ve maliyet-etkin olmas\u0131n\u0131 sa\u011flar. Do\u011fru dengeyi bulmak, uygulaman\u0131z\u0131n uzun vadeli ba\u015far\u0131s\u0131 i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n<h2>Sonu\u00e7: G\u00fcvenli ve \u00d6l\u00e7eklenebilir API'ler \u0130\u00e7in Anahtar<\/h2>\n<p>Bu kapsaml\u0131 rehber boyunca, AWS API Gateway ile Amazon Cognito User Pool yetkilendiricisinin entegrasyonunun modern, bulut tabanl\u0131 uygulamalar i\u00e7in neden vazge\u00e7ilmez bir g\u00fcvenlik katman\u0131 oldu\u011funu detayl\u0131 bir \u015fekilde inceledik. Temel kavramlardan ad\u0131m ad\u0131m kurulum s\u00fcre\u00e7lerine, ger\u00e7ek d\u00fcnya senaryolar\u0131ndan ileri d\u00fczey optimizasyonlara kadar bir\u00e7ok \u00f6nemli noktaya de\u011findik. G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere, bu entegrasyon, geli\u015ftiricilere hem g\u00fc\u00e7l\u00fc bir g\u00fcvenlik mekanizmas\u0131 sunuyor hem de kimlik y\u00f6netimi ve yetkilendirme s\u00fcre\u00e7lerinin karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131yor.<\/p>\n<p>API Gateway, uygulamalar\u0131n\u0131z i\u00e7in bir \u00f6n kap\u0131 g\u00f6revi g\u00f6rerek t\u00fcm API isteklerini merkezi bir noktadan y\u00f6netirken, Cognito User Pools ise kullan\u0131c\u0131 kimlik do\u011frulamas\u0131n\u0131 ve token \u00fcretimini \u00fcstleniyor. Bu iki servisin uyumlu \u00e7al\u0131\u015fmas\u0131 sayesinde, API'lerinize yaln\u0131zca kimli\u011fi do\u011frulanm\u0131\u015f ve uygun yetkilere sahip kullan\u0131c\u0131lar\u0131n eri\u015fimi sa\u011flan\u0131yor. B\u00f6ylece, geli\u015ftiriciler, g\u00fcvenlik endi\u015feleriyle bo\u011fu\u015fmak yerine, kendi i\u015f mant\u0131klar\u0131n\u0131 geli\u015ftirmeye odaklanabiliyorlar. Ayr\u0131ca, AWS'nin sundu\u011fu bu tam y\u00f6netilen hizmetler sayesinde, altyap\u0131 kurulumu, bak\u0131m ve \u00f6l\u00e7eklenebilirlik gibi operasyonel y\u00fckler de AWS taraf\u0131ndan \u00fcstleniliyor.<\/p>\n<p>\u00d6nbellekleme, \u00f6zel kapsamlar, \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama ve WAF entegrasyonu gibi ek \u00f6zelliklerle API'lerinizin g\u00fcvenli\u011fini ve performans\u0131n\u0131 daha da art\u0131rabilirsiniz. Sonu\u00e7 olarak, API Gateway'de Cognito User Pool yetkilendiricisini kullanmak, uygulamalar\u0131n\u0131z i\u00e7in sa\u011flam, \u00f6l\u00e7eklenebilir ve maliyet-etkin bir g\u00fcvenlik temeli olu\u015fturman\u0131n en etkili yollar\u0131ndan biridir. Bu rehberin, bu g\u00fc\u00e7l\u00fc entegrasyonu anlaman\u0131za ve kendi projelerinizde ba\u015far\u0131yla uygulaman\u0131za yard\u0131mc\u0131 oldu\u011funu umuyoruz.<\/p>\n<h2>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h2>\n<p>Bu b\u00f6l\u00fcmde, API Gateway'de Cognito User Pool yetkilendiricisi ile ilgili s\u0131k\u00e7a kar\u015f\u0131la\u015f\u0131lan sorular\u0131 ve cevaplar\u0131n\u0131 bulacaks\u0131n\u0131z.<\/p>\n<h3>Cognito User Pool Yetkilendiricisi ile Lambda Yetkilendiricisi aras\u0131ndaki temel fark nedir?<\/h3>\n<p><strong>Cevap:<\/strong> Temel fark, kimlik do\u011frulama mant\u0131\u011f\u0131n\u0131n nerede i\u015flendi\u011fidir. Cognito User Pool yetkilendiricisi, standart OIDC (OpenID Connect) ve OAuth 2.0 uyumlu JWT'leri (\u00f6zellikle Cognito taraf\u0131ndan verilen token'lar\u0131) otomatik olarak do\u011frular. Bu, Cognito'yu kimlik sa\u011flay\u0131c\u0131 olarak kulland\u0131\u011f\u0131n\u0131zda kurulumu kolay, y\u00f6netimi az olan bir \u00e7\u00f6z\u00fcmd\u00fcr. Lambda Yetkilendiricisi ise, kimlik do\u011frulama ve yetkilendirme mant\u0131\u011f\u0131n\u0131 tamamen kendi yazd\u0131\u011f\u0131n\u0131z bir Lambda fonksiyonuna devreder. Bu sayede \u00f6zel bir veritaban\u0131, \u00fc\u00e7\u00fcnc\u00fc taraf bir kimlik sa\u011flay\u0131c\u0131 veya \u00e7ok karma\u015f\u0131k i\u015f mant\u0131\u011f\u0131na dayal\u0131 yetkilendirme kurallar\u0131 gibi her t\u00fcrl\u00fc senaryoyu uygulayabilirsiniz. Lambda yetkilendiricisi daha fazla esneklik sunarken, geli\u015ftirme ve bak\u0131m y\u00fck\u00fc de artar.<\/p>\n<h3>Refresh Token'lar API Gateway taraf\u0131ndan do\u011frulan\u0131r m\u0131? Nas\u0131l kullan\u0131l\u0131rlar?<\/h3>\n<p><strong>Cevap:<\/strong> Hay\u0131r, Refresh Token'lar do\u011frudan API Gateway taraf\u0131ndan yetkilendirme i\u00e7in kullan\u0131lmaz veya do\u011frulanmaz. API Gateway, API isteklerindeki Access Token'lar\u0131 do\u011frular. Refresh Token'lar, Access Token'lar\u0131n s\u00fcresi doldu\u011funda yeni bir Access Token ve ID Token almak i\u00e7in Cognito User Pools ile do\u011frudan ileti\u015fim kuran istemci uygulamalar (mobil, web) taraf\u0131ndan kullan\u0131l\u0131r. Bu, kullan\u0131c\u0131n\u0131n tekrar oturum a\u00e7mas\u0131na gerek kalmadan uygulaman\u0131n kesintisiz \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar. Genellikle, uygulaman\u0131z\u0131n SDK's\u0131 (\u00f6rne\u011fin AWS Amplify) bu yenileme s\u00fcrecini arka planda otomatik olarak y\u00f6netir.<\/p>\n<h3>API Gateway'de 401 Unauthorized hatas\u0131 al\u0131yorum, nas\u0131l sorun giderebilirim?<\/h3>\n<p><strong>Cevap:<\/strong> 401 Unauthorized hatas\u0131 genellikle yetkilendirme sorunlar\u0131na i\u015faret eder. \u0130\u015fte kontrol etmeniz gerekenler:<\/p>\n<ol>\n<li><strong>Token Ge\u00e7erlili\u011fi:<\/strong> Kulland\u0131\u011f\u0131n\u0131z Access Token'\u0131n s\u00fcresinin dolmad\u0131\u011f\u0131ndan emin olun.<\/li>\n<li><strong>Token Format\u0131:<\/strong> \u0130ste\u011finizin <code>Authorization: Bearer YOUR_ACCESS_TOKEN<\/code> format\u0131nda oldu\u011fundan emin olun. \"Bearer\" kelimesini unutmay\u0131n.<\/li>\n<li><strong>Cognito User Pool ID:<\/strong> API Gateway yetkilendiricisinde do\u011fru Cognito User Pool ID'sini yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun.<\/li>\n<li><strong>Uygulama \u0130stemcisi ID (App Client ID):<\/strong> Access Token'\u0131n verildi\u011fi uygulama istemcisi ID'sinin API Gateway yetkilendiricisi ile uyumlu oldu\u011fundan emin olun.<\/li>\n<li><strong>CloudWatch G\u00fcnl\u00fckleri:<\/strong> API Gateway ve Cognito'nun CloudWatch g\u00fcnl\u00fcklerini kontrol edin. Yetkilendirme hatalar\u0131n\u0131n nedenini (\u00f6rne\u011fin imza do\u011frulama ba\u015far\u0131s\u0131zl\u0131\u011f\u0131, s\u00fcresi dolmu\u015f token, eksik kapsam) g\u00f6steren detayl\u0131 mesajlar bulabilirsiniz.<\/li>\n<li><strong>API Da\u011f\u0131t\u0131m\u0131:<\/strong> API Gateway'deki t\u00fcm de\u011fi\u015fikliklerinizi bir a\u015famaya da\u011f\u0131tt\u0131\u011f\u0131n\u0131zdan emin olun.<\/li>\n<\/ol>\n<h3>API Gateway ve Cognito entegrasyonunda \u00f6zel kapsamlar (custom scopes) ne i\u015fe yarar?<\/h3>\n<p><strong>Cevap:<\/strong> \u00d6zel kapsamlar, API'lerinizde daha ince taneli eri\u015fim kontrol\u00fc sa\u011flamak i\u00e7in kullan\u0131l\u0131r. Bir kullan\u0131c\u0131n\u0131n kimli\u011fi do\u011frulanm\u0131\u015f olsa bile, API'nin belirli bir i\u015flevine (\u00f6rne\u011fin, \"\u00fcr\u00fcnleri oku\" veya \"\u00fcr\u00fcnleri g\u00fcncelle\") eri\u015febilmesi i\u00e7in gerekli olan spesifik izinleri tan\u0131mlaman\u0131za olanak tan\u0131r. Cognito User Pool'unuzda \u00f6zel kapsamlar tan\u0131mlayabilir ve uygulama istemcilerinize belirli kapsamlar\u0131 atayabilirsiniz. API Gateway'de, korunan bir metod i\u00e7in gerekli kapsamlar\u0131 belirterek, yaln\u0131zca Access Token'\u0131nda bu kapsamlar\u0131 i\u00e7eren kullan\u0131c\u0131lar\u0131n o metoda eri\u015fmesine izin verebilirsiniz. Bu, g\u00fcvenlik modelinizi \"kullan\u0131c\u0131 kimli\u011fi\"nden \"kullan\u0131c\u0131n\u0131n ne yapmas\u0131na izin verildi\u011fi\" seviyesine ta\u015f\u0131r.<\/p>\n<style>\n    \/* Basit mobil uyumlu stil \u00f6rne\u011fi - Genellikle bir CSS dosyas\u0131na dahil edilir *\/\n    body {\n        font-family: Arial, sans-serif;\n        line-height: 1.6;\n        margin: 0;\n        padding: 20px;\n        background-color: #f4f4f4;\n        color: #333;\n    }\n    h2, h3 {\n        color: #2c3e50;\n        margin-top: 2em;\n        margin-bottom: 0.8em;\n    }\n    h2 {\n        border-bottom: 2px solid #3498db;\n        padding-bottom: 10px;\n    }\n    p {\n        margin-bottom: 1em;\n    }\n    ul, ol {\n        margin-left: 20px;\n        margin-bottom: 1em;\n    }\n    pre {\n        background: #ecf0f1;\n        padding: 15px;\n        border-radius: 5px;\n        overflow-x: auto;\n        margin-bottom: 1em;\n    }\n    code {\n        font-family: 'Courier New', monospace;\n        color: #c0392b;\n    }\n    pre code {\n        color: #2c3e50;\n    }\n    table {\n        width: 100%;\n        border-collapse: collapse;\n        margin-bottom: 1em;\n    }\n    th, td {\n        border: 1px solid #ddd;\n        padding: 8px;\n        text-align: left;\n    }\n    th {\n        background-color: #f2f2f2;\n    }\n    .expert-tip {\n        background-color: #e8f5e9; \/* Light green *\/\n        border-left: 5px solid #4CAF50; \/* Green *\/\n        margin: 1.5em 0;\n        padding: 1em 1.5em;\n        color: #388e3c; \/* Dark green *\/\n        border-radius: 3px;\n        font-style: italic;\n    }<\/p>\n<p>    \/* Mobil uyumluluk i\u00e7in medya sorgusu *\/\n    @media (max-width: 768px) {\n        body {\n            padding: 10px;\n        }\n        h2 {\n            font-size: 1.5em;\n        }\n        h3 {\n            font-size: 1.2em;\n        }\n        table, thead, tbody, th, td, tr {\n            display: block;\n        }\n        thead tr {\n            position: absolute;\n            top: -9999px;\n            left: -9999px;\n        }\n        tr { border: 1px solid #ccc; }\n        td {\n            border: none;\n            border-bottom: 1px solid #eee;\n            position: relative;\n            padding-left: 50%;\n            text-align: right;\n        }\n        td:before {\n            position: absolute;\n            top: 6px;\n            left: 6px;\n            width: 45%;\n            padding-right: 10px;\n            white-space: nowrap;\n            text-align: left;\n            font-weight: bold;\n        }\n        td:nth-of-type(1):before { content: \"\u00d6zellik\"; }\n        td:nth-of-type(2):before { content: \"Cognito User Pool Yetkilendiricisi\"; }\n        td:nth-of-type(3):before { content: \"Lambda Custom Authorizer\"; }\n    }\n<\/style>\n<p><\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS&hellip;","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-30959","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>API Gateway&#039;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi<\/title>\n<meta name=\"description\" content=\"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"API Gateway&#039;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi\" \/>\n<meta property=\"og:description\" content=\"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-03T22:31:42+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"28 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"API Gateway&#8217;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi\",\"datePublished\":\"2025-10-03T22:31:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\"},\"wordCount\":5433,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\",\"name\":\"API Gateway'de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-03T22:31:42+00:00\",\"description\":\"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"API Gateway&#8217;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"API Gateway'de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi","description":"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"API Gateway'de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi","og_description":"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.","og_url":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-03T22:31:42+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"28 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"API Gateway&#8217;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi","datePublished":"2025-10-03T22:31:42+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/"},"wordCount":5433,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/","name":"API Gateway'de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-03T22:31:42+00:00","description":"Modern web uygulamalar\u0131 geli\u015ftirirken API g\u00fcvenli\u011fi ve kullan\u0131c\u0131 kimlik do\u011frulama s\u00fcre\u00e7leri karma\u015f\u0131k hale gelebilir. Peki, bu zorluklar\u0131 AWS API Gateway ve Amazon Cognito User Pool yetkilendiricisi ile nas\u0131l basitle\u015ftirebilir, ayn\u0131 zamanda \u00f6l\u00e7eklenebilir ve g\u00fcvenli bir yap\u0131 kurabiliriz? Bu kapsaml\u0131 rehber, konuya s\u0131f\u0131rdan ba\u015flayarak ileri seviye ipu\u00e7lar\u0131na kadar her detay\u0131 a\u00e7\u0131kl\u0131yor.","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/api-gatewayde-cognito-user-pool-yetkilendiricisi-guvenli-api-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"API Gateway&#8217;de Cognito User Pool Yetkilendiricisi: G\u00fcvenli API Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30959","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=30959"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30959\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=30959"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=30959"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=30959"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}