G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\u015fen DevOps d\u00fcnyas\u0131nda, CI\/CD s\u00fcre\u00e7leri yaz\u0131l\u0131m geli\u015ftirme d\u00f6ng\u00fcs\u00fcn\u00fcn ayr\u0131lmaz bir par\u00e7as\u0131 haline geldi. GitHub Actions gibi platformlar, otomatik derleme, test ve da\u011f\u0131t\u0131m s\u00fcre\u00e7lerini kolayla\u015ft\u0131r\u0131rken, bu otomasyonun g\u00fcvenli\u011fi her zaman \u00f6ncelikli bir endi\u015fe kayna\u011f\u0131 olmu\u015ftur. Geleneksel olarak, GitHub Actions’tan AWS kaynaklar\u0131na eri\u015fim i\u00e7in statik AWS eri\u015fim anahtarlar\u0131 (access keys) kullan\u0131l\u0131rd\u0131. Ancak bu yakla\u015f\u0131m, anahtar s\u0131z\u0131nt\u0131s\u0131, yetkisiz eri\u015fim ve y\u00f6netim zorluklar\u0131 gibi ciddi g\u00fcvenlik risklerini beraberinde getiriyor. Neyse ki, OpenID Connect (OIDC) sayesinde bu riskleri ortadan kald\u0131rabilir, GitHub Actions i\u015f ak\u0131\u015flar\u0131n\u0131z i\u00e7in daha g\u00fcvenli ve y\u00f6netilebilir bir kimlik do\u011frulama mekanizmas\u0131 olu\u015fturabiliriz. Bu rehber, AWS eri\u015fim anahtarlar\u0131n\u0131 terk edip OIDC’nin sundu\u011fu ge\u00e7ici kimlik bilgilerinin g\u00fcc\u00fcnden nas\u0131l yararlanaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r.<\/p>\n
Statik AWS eri\u015fim anahtarlar\u0131, uzun \u00f6m\u00fcrl\u00fc ve de\u011fi\u015fmez olduklar\u0131 i\u00e7in bir\u00e7ok g\u00fcvenlik zafiyetine yol a\u00e7abilir. Bu anahtarlar\u0131n kullan\u0131m\u0131 kolay olsa da, beraberinde getirdi\u011fi riskler, modern g\u00fcvenlik standartlar\u0131yla uyumlu de\u011fildir.<\/p>\n
Statik eri\u015fim anahtarlar\u0131, bir kez olu\u015fturulduktan sonra s\u00fcresiz olarak ge\u00e7erli kal\u0131r. Bu durum, bir anahtar\u0131n yanl\u0131\u015fl\u0131kla bir kod deposuna y\u00fcklenmesi, bir g\u00fcnl\u00fck dosyas\u0131na s\u0131zmas\u0131 veya bir geli\u015ftiricinin cihaz\u0131nda \u00e7al\u0131nmas\u0131 halinde b\u00fcy\u00fck bir risk olu\u015fturur. K\u00f6t\u00fc niyetli ki\u015filer bu anahtarlar\u0131 ele ge\u00e7irdiklerinde, anahtar\u0131n yetkilendirildi\u011fi t\u00fcm AWS kaynaklar\u0131na eri\u015febilir ve ciddi veri ihlallerine veya mali kay\u0131plara neden olabilirler.<\/p>\n
Eri\u015fim anahtarlar\u0131n\u0131n d\u00fczenli olarak d\u00f6nd\u00fcr\u00fclmesi (rotate edilmesi) ve g\u00fcvenli bir \u015fekilde saklanmas\u0131 gerekir. Bu, \u00f6zellikle b\u00fcy\u00fck ekiplerde ve \u00e7ok say\u0131da proje oldu\u011funda \u00f6nemli bir y\u00f6netim y\u00fck\u00fc olu\u015fturur. Anahtarlar\u0131n nerede sakland\u0131\u011f\u0131, kimlerin eri\u015fimi oldu\u011fu ve ne zaman yenilenmesi gerekti\u011fi gibi konular, karma\u015f\u0131k ve hataya a\u00e7\u0131k s\u00fcre\u00e7lere yol a\u00e7abilir. Ayr\u0131ca, bir anahtar\u0131n s\u00fcresi doldu\u011funda veya kayboldu\u011funda, i\u015f ak\u0131\u015flar\u0131n\u0131n kesintiye u\u011framas\u0131 ka\u00e7\u0131n\u0131lmazd\u0131r.<\/p>\n
Bir\u00e7ok end\u00fcstri standard\u0131 ve d\u00fczenleyici uyumluluk \u00e7er\u00e7evesi (\u00f6rne\u011fin, SOC 2, HIPAA, PCI DSS), uzun \u00f6m\u00fcrl\u00fc kimlik bilgilerinin kullan\u0131m\u0131n\u0131 k\u0131s\u0131tlar ve ge\u00e7ici, k\u0131sa \u00f6m\u00fcrl\u00fc kimlik bilgilerini te\u015fvik eder. Statik anahtarlar\u0131n kullan\u0131lmas\u0131, bu t\u00fcr uyumluluk gereksinimlerini kar\u015f\u0131lamay\u0131 zorla\u015ft\u0131r\u0131r ve denetim s\u00fcre\u00e7lerinde sorunlara yol a\u00e7abilir. Olay incelemelerinde, statik anahtarlar\u0131n kim taraf\u0131ndan ve ne zaman kullan\u0131ld\u0131\u011f\u0131n\u0131 takip etmek de zor olabilir.<\/p>\n
OIDC, OAuth 2.0 protokol\u00fcn\u00fcn \u00fczerine in\u015fa edilmi\u015f basit bir kimlik do\u011frulama katman\u0131d\u0131r. Kullan\u0131c\u0131lar\u0131n (veya bu durumda i\u015f y\u00fcklerinin) bir kimlik sa\u011flay\u0131c\u0131 taraf\u0131ndan do\u011frulanmas\u0131n\u0131 ve bu do\u011frulaman\u0131n g\u00fcvenli bir \u015fekilde ba\u015fka bir hizmete (hizmet sa\u011flay\u0131c\u0131ya) iletilmesini sa\u011flar.<\/p>\n
OIDC, kullan\u0131c\u0131lar\u0131n kimliklerini do\u011frulamak i\u00e7in bir “ID Token” kullan\u0131r. Bu token, kullan\u0131c\u0131n\u0131n kimli\u011fi hakk\u0131nda do\u011frulanm\u0131\u015f bilgiler i\u00e7eren bir JSON Web Token (JWT) format\u0131ndad\u0131r. Bir i\u015f y\u00fck\u00fc (\u00f6rne\u011fin, GitHub Actions i\u015f ak\u0131\u015f\u0131), bir kimlik sa\u011flay\u0131c\u0131dan (GitHub) bir ID Token al\u0131r ve bu token’\u0131 bir hizmet sa\u011flay\u0131c\u0131ya (AWS) sunarak kimli\u011fini kan\u0131tlar. AWS, token’\u0131 do\u011frular ve i\u015f y\u00fck\u00fcne ge\u00e7ici kimlik bilgileri verir.<\/p>\n
OIDC mimarisinde \u00fc\u00e7 ana bile\u015fen bulunur:<\/p>\n
AWS’de, bir OIDC kimlik sa\u011flay\u0131c\u0131s\u0131 olu\u015fturarak GitHub’a g\u00fcvenebilece\u011fimizi belirtiriz. Bu g\u00fcven ili\u015fkisi sayesinde, GitHub taraf\u0131ndan imzalanan bir ID Token’\u0131n ge\u00e7erli oldu\u011funu ve belirli ko\u015fullar\u0131 kar\u015f\u0131lad\u0131\u011f\u0131n\u0131 do\u011frulayabiliriz.<\/p>\n
GitHub Actions, her i\u015f ak\u0131\u015f\u0131 \u00e7al\u0131\u015ft\u0131rmas\u0131 i\u00e7in otomatik olarak benzersiz ve k\u0131sa \u00f6m\u00fcrl\u00fc bir OIDC ID Token’\u0131 olu\u015fturabilir. Bu token, i\u015f ak\u0131\u015f\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 depoyu, dal\u0131, etiketi ve di\u011fer ba\u011flamsal bilgileri i\u00e7erir. AWS, bu token’\u0131 al\u0131p do\u011frulad\u0131ktan sonra, i\u015f ak\u0131\u015f\u0131na belirli bir IAM rol\u00fcn\u00fc \u00fcstlenmesi i\u00e7in ge\u00e7ici kimlik bilgileri sa\u011flar. Bu sayede statik anahtarlar yerine, her \u00e7al\u0131\u015ft\u0131rmada dinamik olarak olu\u015fturulan, k\u0131sa \u00f6m\u00fcrl\u00fc ve belirli bir ba\u011flama ba\u011fl\u0131 kimlik bilgileri kullan\u0131l\u0131r.<\/p>\n
GitHub Actions’tan OIDC kullanarak AWS’ye g\u00fcvenli bir \u015fekilde ba\u011flanmak i\u00e7in AWS IAM taraf\u0131nda baz\u0131 yap\u0131land\u0131rmalar yapman\u0131z gerekir.<\/p>\n
\u0130lk ad\u0131m, AWS IAM konsolunda bir OIDC kimlik sa\u011flay\u0131c\u0131s\u0131 olu\u015fturmakt\u0131r. Bu sa\u011flay\u0131c\u0131, GitHub’\u0131n OIDC token’lar\u0131n\u0131 do\u011frulayabilmemizi sa\u011flar.<\/p>\n
https:\/\/token.actions.githubusercontent.com<\/code> adresini girin. “Parmak \u0130zi Al” butonuna t\u0131klayarak otomatik olarak parmak izini doldurun.<\/li>\n- Hedef Kitle<\/strong> alan\u0131na
sts.amazonaws.com<\/code> de\u011ferini girin.<\/li>\n- Sa\u011flay\u0131c\u0131y\u0131 olu\u015fturun.<\/li>\n<\/ol>\n
G\u00fcven Politikas\u0131 Olu\u015fturma (Trust Policy)<\/h4>\n
Olu\u015fturdu\u011funuz OIDC sa\u011flay\u0131c\u0131s\u0131n\u0131 kullanarak bir IAM rol\u00fcne g\u00fcven politikas\u0131 eklemeniz gerekir. Bu politika, hangi GitHub depolar\u0131n\u0131n ve ko\u015fullar\u0131n\u0131n bu rol\u00fc \u00fcstlenmesine izin verildi\u011fini tan\u0131mlar.<\/p>\n
{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"Federated\": \"arn:aws:iam:::oidc-provider\/token.actions.githubusercontent.com\"\n },\n \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n \"Condition\": {\n \"StringEquals\": {\n \"token.actions.githubusercontent.com:aud\": \"sts.amazonaws.com\"\n },\n \"StringLike\": {\n \"token.actions.githubusercontent.com:sub\": \"repo:\/:*\"\n }\n }\n }\n ]\n}<\/pre>\n<\/code>
\nYukar\u0131daki politikada:<\/p>\n
\n<\/code> yerine kendi AWS hesap kimli\u011finizi girin.<\/li>\n\/<\/code> yerine GitHub'daki organizasyonunuzu ve depo ad\u0131n\u0131z\u0131 (\u00f6rn. my-org\/my-repo<\/code>) girin. Bu ko\u015ful, yaln\u0131zca belirli bir depodan gelen isteklerin bu rol\u00fc \u00fcstlenmesine izin verir. \u0130sterseniz repo:\/*:*<\/code> ile t\u00fcm depolara veya ref:refs\/heads\/main<\/code> gibi dallara \u00f6zel ko\u015fullar ekleyebilirsiniz.<\/li>\n<\/ul>\nGitHub Actions Rol\u00fc Olu\u015fturma<\/h4>\n
Son olarak, GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131z\u0131n \u00fcstlenece\u011fi bir IAM rol\u00fc olu\u015fturman\u0131z gerekir. Bu rol, i\u015f ak\u0131\u015f\u0131n\u0131z\u0131n AWS'de hangi eylemleri ger\u00e7ekle\u015ftirebilece\u011fini tan\u0131mlayan izin politikalar\u0131n\u0131 i\u00e7erecektir.<\/p>\n
\n- IAM konsolunda \"Roller\"e gidin ve \"Rol Olu\u015ftur\" butonuna t\u0131klay\u0131n.<\/li>\n
- \"\u00d6zel varl\u0131k\" olarak \"Web kimli\u011fi\"ni se\u00e7in.<\/li>\n
- \"Kimlik Sa\u011flay\u0131c\u0131s\u0131\" olarak az \u00f6nce olu\u015fturdu\u011funuz OIDC sa\u011flay\u0131c\u0131s\u0131n\u0131 (
token.actions.githubusercontent.com<\/code>) se\u00e7in.<\/li>\n- \"Hedef Kitle\" olarak
sts.amazonaws.com<\/code> de\u011ferini se\u00e7in.<\/li>\n- \u0130leri'ye t\u0131klay\u0131n ve rol i\u00e7in gerekli izin politikalar\u0131n\u0131 (\u00f6rne\u011fin, S3'e yazma, EC2 ba\u015flatma vb.) ekleyin. En az ayr\u0131cal\u0131k prensibini uygulayarak yaln\u0131zca ihtiya\u00e7 duyulan izinleri verdi\u011finizden emin olun.<\/li>\n
- \u0130leri'ye t\u0131klay\u0131n, bir rol ad\u0131 (\u00f6rn.
github-actions-deploy-role<\/code>) ve a\u00e7\u0131klama girin.<\/li>\n- Rol\u00fc olu\u015fturun. Rol\u00fcn ARN'sini (Amazon Resource Name) not al\u0131n, \u00e7\u00fcnk\u00fc bunu GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131zda kullanacaks\u0131n\u0131z.<\/li>\n<\/ol>\n
GitHub Actions \u0130\u015f Ak\u0131\u015f\u0131n\u0131z\u0131 G\u00fcncelleme<\/h3>\n
AWS'deki yap\u0131land\u0131rmay\u0131 tamamlad\u0131ktan sonra, GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131z\u0131 OIDC kullanacak \u015fekilde g\u00fcncellemeniz gerekir.<\/p>\n
OIDC Kimlik Do\u011frulama Ad\u0131m\u0131<\/h4>\n
GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131zda, actions\/configure-aws-credentials<\/code> eylemini kullanarak OIDC kimlik do\u011frulamas\u0131n\u0131 yap\u0131land\u0131rabilirsiniz.<\/p>\nname: Deploy to AWS with OIDC\n\non:\n push:\n branches:\n - main\n\npermissions:\n id-token: write # Bu izni eklemek zorunludur\n contents: read\n\njobs:\n deploy:\n runs-on: ubuntu-latest\n steps:\n - name: Checkout code\n uses: actions\/checkout@v4\n\n - name: Configure AWS credentials\n uses: aws-actions\/configure-aws-credentials@v4\n with:\n role-to-assume: arn:aws:iam:::role\/\n aws-region: <\/pre>\n<\/code>
\n\u00d6nemli:<\/strong> permissions<\/code> blo\u011funda id-token: write<\/code> iznini eklemek zorunludur. Bu izin, GitHub Actions'\u0131n OIDC ID Token'\u0131 olu\u015fturmas\u0131na ve AWS'ye g\u00f6ndermesine olanak tan\u0131r. Ayr\u0131ca, <\/code>, <\/code> ve <\/code> de\u011ferlerini kendi ortam\u0131n\u0131za g\u00f6re g\u00fcncellemeyi unutmay\u0131n.<\/p>\nAWS Kimlik Bilgilerini Kullanma<\/h4>\n
configure-aws-credentials<\/code> eylemi ba\u015far\u0131yla \u00e7al\u0131\u015ft\u0131ktan sonra, i\u015f ak\u0131\u015f\u0131n\u0131zdaki sonraki ad\u0131mlar otomatik olarak ge\u00e7ici AWS kimlik bilgilerini kullanacakt\u0131r. Art\u0131k AWS_ACCESS_KEY_ID<\/code>, AWS_SECRET_ACCESS_KEY<\/code> veya AWS_SESSION_TOKEN<\/code> gibi ortam de\u011fi\u015fkenlerini manuel olarak ayarlaman\u0131za gerek kalmaz. AWS CLI, SDK'lar veya di\u011fer AWS ara\u00e7lar\u0131, bu ge\u00e7ici kimlik bilgilerini otomatik olarak alg\u0131layacak ve kullanacakt\u0131r.<\/p>\n\u00d6rnek \u0130\u015f Ak\u0131\u015f\u0131 Yap\u0131land\u0131rmas\u0131<\/h4>\n
\u0130\u015fte bir S3 kovas\u0131na dosya y\u00fckleyen basit bir GitHub Actions i\u015f ak\u0131\u015f\u0131 \u00f6rne\u011fi:<\/p>\n
name: S3 Deployment with OIDC\n\non:\n push:\n branches:\n - main\n\npermissions:\n id-token: write\n contents: read\n\njobs:\n deploy:\n runs-on: ubuntu-latest\n steps:\n - name: Checkout code\n uses: actions\/checkout@v4\n\n - name: Configure AWS credentials\n uses: aws-actions\/configure-aws-credentials@v4\n with:\n role-to-assume: arn:aws:iam:::role\/github-actions-s3-deploy-role\n aws-region: us-east-1\n\n - name: Install AWS CLI\n run: |\n sudo apt-get update\n sudo apt-get install -y awscli\n\n - name: Deploy to S3\n run: |\n aws s3 cp .\/index.html s3:\/\/your-s3-bucket-name\/index.html --acl public-read\n echo \"index.html successfully deployed to S3!\"<\/pre>\n<\/code>
\nBu \u00f6rnekte, github-actions-s3-deploy-role<\/code> adl\u0131 IAM rol\u00fcne S3'e yazma izinleri verilmi\u015f olmal\u0131d\u0131r.<\/p>\nPratik Uygulama ve En \u0130yi Y\u00f6ntemler<\/h3>\n
OIDC ile g\u00fcvenli bir CI\/CD ortam\u0131 kurarken g\u00f6z \u00f6n\u00fcnde bulundurman\u0131z gereken baz\u0131 en iyi uygulamalar vard\u0131r.<\/p>\n
En Az Ayr\u0131cal\u0131k Prensibi<\/h4>\n
IAM rollerine her zaman yaln\u0131zca i\u015flerini yapmalar\u0131 i\u00e7in kesinlikle gerekli olan minimum izinleri verin. \u00d6rne\u011fin, bir da\u011f\u0131t\u0131m rol\u00fcn\u00fcn bir S3 kovas\u0131na yaln\u0131zca yazma iznine ihtiyac\u0131 varsa, ona tam y\u00f6netici eri\u015fimi vermeyin. Bu, olas\u0131 g\u00fcvenlik ihlallerinin etkisini s\u0131n\u0131rlar.<\/p>\n
Rollerin Kapsam\u0131n\u0131 S\u0131n\u0131rland\u0131rma<\/h4>\n
AWS'deki IAM g\u00fcven politikalar\u0131nda, Condition<\/code> blo\u011funu kullanarak GitHub Actions i\u015f ak\u0131\u015flar\u0131n\u0131z\u0131n rol \u00fcstlenme yetene\u011fini daha da k\u0131s\u0131tlayabilirsiniz. \u00d6rne\u011fin, yaln\u0131zca belirli bir dal (ref:refs\/heads\/main<\/code>), belirli bir ortam (environment:production<\/code>) veya belirli bir i\u015f ak\u0131\u015f\u0131 (workflow:deploy.yml<\/code>) taraf\u0131ndan ba\u015flat\u0131lan \u00e7al\u0131\u015ft\u0131rmalar\u0131n rol \u00fcstlenmesine izin verebilirsiniz. Bu, yetkisiz eri\u015fimi daha da zorla\u015ft\u0131r\u0131r.<\/p>\n{\n \"StringLike\": {\n \"token.actions.githubusercontent.com:sub\": \"repo:my-org\/my-repo:ref:refs\/heads\/main\"\n }\n}<\/pre>\n<\/code>
\nBu ko\u015ful, rol\u00fcn yaln\u0131zca my-org\/my-repo<\/code> deposunun main<\/code> dal\u0131ndaki \u00e7al\u0131\u015ft\u0131rmalar taraf\u0131ndan \u00fcstlenilmesini sa\u011flar.<\/p>\nOIDC Sa\u011flay\u0131c\u0131s\u0131n\u0131 Y\u00f6netme<\/h4>\n
OIDC sa\u011flay\u0131c\u0131n\u0131z\u0131n URL'sinin ve parmak izinin g\u00fcncel oldu\u011fundan emin olun. GitHub, zaman zaman OIDC u\u00e7 noktalar\u0131n\u0131 g\u00fcncelleyebilir, bu nedenle d\u00fczenli olarak kontrol etmek iyi bir uygulamad\u0131r. Ayr\u0131ca, kullan\u0131lmayan OIDC sa\u011flay\u0131c\u0131lar\u0131n\u0131 ve rolleri temizlemek, g\u00fcvenlik duru\u015funuzu g\u00fc\u00e7lendirecektir.<\/p>\n
Olas\u0131 Sorunlar ve Giderme<\/h3>\n
OIDC kurulumu s\u0131ras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz baz\u0131 yayg\u0131n sorunlar ve bunlar\u0131n \u00e7\u00f6z\u00fcmleri.<\/p>\n
G\u00fcven Politikas\u0131 Hatalar\u0131<\/h4>\n
E\u011fer GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131z sts:AssumeRoleWithWebIdentity<\/code> eyleminde yetkilendirme hatas\u0131 al\u0131yorsa, b\u00fcy\u00fck olas\u0131l\u0131kla IAM rol\u00fcn\u00fcz\u00fcn g\u00fcven politikas\u0131nda bir sorun vard\u0131r.<\/p>\n\n- \u00c7\u00f6z\u00fcm:<\/strong> IAM rol\u00fcn\u00fcz\u00fcn g\u00fcven politikas\u0131n\u0131 dikkatlice inceleyin. AWS hesap kimli\u011finizin, OIDC sa\u011flay\u0131c\u0131s\u0131 ARN'sinin ve
Condition<\/code> blo\u011fundaki GitHub depo ad\u0131n\u0131n do\u011fru oldu\u011fundan emin olun. \u00d6zellikle StringLike<\/code> ko\u015fulundaki depo ad\u0131n\u0131n (repo:\/:*<\/code>) do\u011fru yaz\u0131ld\u0131\u011f\u0131n\u0131 kontrol edin.<\/li>\n<\/ul>\n\u0130zin Sorunlar\u0131<\/h4>\n
\u0130\u015f ak\u0131\u015f\u0131n\u0131z bir rol\u00fc ba\u015far\u0131yla \u00fcstleniyor ancak AWS kaynaklar\u0131na eri\u015firken \"Access Denied\" hatalar\u0131 al\u0131yorsa, bu rol\u00fcn gerekli izinlere sahip olmad\u0131\u011f\u0131 anlam\u0131na gelir.<\/p>\n
\n- \u00c7\u00f6z\u00fcm:<\/strong> IAM rol\u00fcne ekledi\u011finiz izin politikalar\u0131n\u0131 g\u00f6zden ge\u00e7irin. \u0130\u015f ak\u0131\u015f\u0131n\u0131z\u0131n ger\u00e7ekle\u015ftirmesi gereken t\u00fcm AWS eylemleri i\u00e7in (\u00f6rne\u011fin, S3'e yazma, EC2'yi ba\u015flatma) gerekli izinlerin verildi\u011finden emin olun. En az ayr\u0131cal\u0131k prensibini uygularken, eksik izinler vermemeye dikkat edin.<\/li>\n<\/ul>\n
Token Do\u011frulama Hatalar\u0131<\/h4>\n
Nadiren de olsa, OIDC token'\u0131n\u0131n do\u011frulanmas\u0131nda sorunlar ya\u015fanabilir. Bu genellikle OIDC sa\u011flay\u0131c\u0131s\u0131n\u0131n URL'si veya parmak izi ile ilgili bir uyu\u015fmazl\u0131ktan kaynaklan\u0131r.<\/p>\n
\n- \u00c7\u00f6z\u00fcm:<\/strong> IAM'deki OIDC sa\u011flay\u0131c\u0131n\u0131z\u0131n URL'sinin
https:\/\/token.actions.githubusercontent.com<\/code> oldu\u011fundan ve parmak izinin do\u011fru bir \u015fekilde al\u0131nd\u0131\u011f\u0131ndan emin olun. GitHub Actions i\u015f ak\u0131\u015f\u0131n\u0131zda permissions: id-token: write<\/code> izninin do\u011fru bir \u015fekilde ayarland\u0131\u011f\u0131n\u0131 kontrol edin.<\/li>\n<\/ul>\nSonu\u00e7<\/h3>\n
GitHub Actions'ta AWS eri\u015fim anahtarlar\u0131n\u0131 kullanmak, ciddi g\u00fcvenlik riskleri ta\u015f\u0131yan eski bir yakla\u015f\u0131md\u0131r. OpenID Connect (OIDC) entegrasyonu sayesinde, bu riskleri ortadan kald\u0131rarak i\u015f ak\u0131\u015flar\u0131n\u0131z i\u00e7in k\u0131sa \u00f6m\u00fcrl\u00fc, dinamik ve g\u00fcvenli kimlik bilgileri sa\u011flayabilirsiniz. Bu rehberde belirtilen ad\u0131mlar\u0131 izleyerek, AWS'de OIDC sa\u011flay\u0131c\u0131n\u0131z\u0131 ve IAM rollerinizi yap\u0131land\u0131rabilir, GitHub Actions i\u015f ak\u0131\u015flar\u0131n\u0131z\u0131 g\u00fcncelleyerek modern ve g\u00fcvenli bir CI\/CD hatt\u0131 olu\u015fturabilirsiniz. G\u00fcvenlik, DevOps s\u00fcre\u00e7lerinin temel ta\u015f\u0131d\u0131r ve OIDC, bu temeli sa\u011flamla\u015ft\u0131rmak i\u00e7in atabilece\u011finiz en \u00f6nemli ad\u0131mlardan biridir.<\/p>\n
SSS (S\u0131k Sorulan Sorular)<\/h3>\nOIDC kullanmak \u00fccretli mi?<\/h4>\n
Hay\u0131r, OIDC protokol\u00fcn\u00fc kullanmak veya GitHub Actions'\u0131n OIDC token'lar\u0131n\u0131 olu\u015fturmas\u0131 i\u00e7in ek bir \u00fccret \u00f6demezsiniz. AWS IAM servisi ve GitHub Actions kullan\u0131m\u0131, kendi fiyatland\u0131rma modellerine tabidir.<\/p>\n
Mevcut i\u015f ak\u0131\u015flar\u0131m\u0131 nas\u0131l ge\u00e7irebilirim?<\/h4>\n
Mevcut i\u015f ak\u0131\u015flar\u0131n\u0131zda statik eri\u015fim anahtarlar\u0131n\u0131 kullanan ad\u0131mlar\u0131, aws-actions\/configure-aws-credentials<\/code> eylemini kullanan OIDC tabanl\u0131 bir kimlik do\u011frulama ad\u0131m\u0131yla de\u011fi\u015ftirmeniz gerekir. Daha sonra, AWS_ACCESS_KEY_ID<\/code>, AWS_SECRET_ACCESS_KEY<\/code> gibi ortam de\u011fi\u015fkenlerini kald\u0131ra ve AWS CLI\/SDK'lar\u0131n otomatik olarak OIDC taraf\u0131ndan sa\u011flanan ge\u00e7ici kimlik bilgilerini kullanmas\u0131n\u0131 sa\u011flay\u0131n.<\/p>\nOIDC sadece GitHub Actions i\u00e7in mi ge\u00e7erli?<\/h4>\n
Hay\u0131r, OIDC genel bir kimlik do\u011frulama protokol\u00fcd\u00fcr ve bir\u00e7ok farkl\u0131 CI\/CD platformu (\u00f6rne\u011fin, GitLab CI\/CD, CircleCI) ve di\u011fer hizmetler taraf\u0131ndan da desteklenmektedir. AWS, bir\u00e7ok farkl\u0131 OIDC sa\u011flay\u0131c\u0131s\u0131yla entegrasyonu destekler.<\/p>\n
OIDC ile hangi AWS servislerine eri\u015febilirim?<\/h4>\n
OIDC arac\u0131l\u0131\u011f\u0131yla \u00fcstlendi\u011finiz IAM rol\u00fcne verdi\u011finiz izinlere ba\u011fl\u0131 olarak, AWS'deki herhangi bir servise eri\u015febilirsiniz. \u00d6nemli olan, rol\u00fcn en az ayr\u0131cal\u0131k prensibine uygun olarak yaln\u0131zca ihtiya\u00e7 duydu\u011fu izinlere sahip olmas\u0131d\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"GitHub Actions’ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi\nG\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\u015fen DevOps d\u00fcnyas\u0131nda, CI\/…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1406],"tags":[],"class_list":{"0":"post-36780","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-aws","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi\" \/>\n<meta property=\"og:description\" content=\"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\u015fen DevOps d\u00fcnyas\u0131nda, CI\/...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-22T22:30:35+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"GitHub Actions’ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi\",\"datePublished\":\"2025-12-22T22:30:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\"},\"wordCount\":2342,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"AWS\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\",\"name\":\"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-12-22T22:30:35+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub Actions’ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi","og_description":"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla geli\u015fen DevOps d\u00fcnyas\u0131nda, CI\/...","og_url":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-12-22T22:30:35+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"13 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"GitHub Actions’ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi","datePublished":"2025-12-22T22:30:35+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/"},"wordCount":2342,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["AWS"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/","name":"GitHub Actions'ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-12-22T22:30:35+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/github-actionsta-aws-erisim-anahtarlarini-kullanmayi-birakin-ihtiyaciniz-olan-oidc-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"GitHub Actions’ta AWS Eri\u015fim Anahtarlar\u0131n\u0131 Kullanmay\u0131 B\u0131rak\u0131n: \u0130htiyac\u0131n\u0131z Olan OIDC Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/36780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=36780"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/36780\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=36780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=36780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=36780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}