{"id":43381,"date":"2026-07-16T21:01:15","date_gmt":"2026-07-16T18:01:15","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/"},"modified":"2026-07-16T21:01:46","modified_gmt":"2026-07-16T18:01:46","slug":"kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/","title":{"rendered":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi"},"content":{"rendered":"<h2>Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi<\/h2>\n<p>Kodla AWS WAF y\u00f6netimi ile web uygulamalar\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 koruyun. Terraform ve CloudFormation kullanarak g\u00fcvenli\u011finizi kolayca otomatikle\u015ftirebilirsiniz.<\/p>\n<p>G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, web uygulamalar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak art\u0131k iste\u011fe ba\u011fl\u0131 bir durum de\u011fil, zorunlu bir ihtiya\u00e7 haline geldi. Web Application Firewall (Web Uygulamas\u0131 G\u00fcvenlik Duvar\u0131 &#8211; WAF) \u00e7\u00f6z\u00fcmleri, bu korumay\u0131 sa\u011flamak i\u00e7in en etkili ara\u00e7lardan biridir. Ancak, bulut ortamlar\u0131ndaki dinamik yap\u0131 nedeniyle, g\u00fcvenlik kurallar\u0131n\u0131 AWS y\u00f6netim konsolundan elle yap\u0131land\u0131rmak zamanla b\u00fcy\u00fck bir karma\u015faya yol a\u00e7ar. \u0130\u015fte bu noktada, altyap\u0131y\u0131 kod olarak y\u00f6netme (Infrastructure as Code &#8211; IaC) prensipleri devreye giriyor. Bu makalede, AWS WAF bile\u015fenlerini kod ile nas\u0131l y\u00f6netebilece\u011finizi, en iyi pratikleri ve ger\u00e7ek d\u00fcnya senaryolar\u0131n\u0131 ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n<h2>AWS WAF Nedir ve Neden Kodla Y\u00f6netilmelidir?<\/h2>\n<p>AWS WAF, web uygulamalar\u0131n\u0131z\u0131 yayg\u0131n web a\u00e7\u0131klar\u0131na ve k\u00f6t\u00fc ama\u00e7l\u0131 botlara kar\u015f\u0131 koruyan esnek bir g\u00fcvenlik duvar\u0131 hizmetidir. SQL Injection (SQL Enjeksiyonu), Cross-Site Scripting (Siteler Aras\u0131 Betik \u00c7al\u0131\u015ft\u0131rma &#8211; XSS) ve DDoS sald\u0131r\u0131lar\u0131 gibi tehditleri engellemek i\u00e7in kurallar tan\u0131mlaman\u0131za olanak tan\u0131r. Bu kurallar\u0131 AWS Application Load Balancer (Uygulama Y\u00fck Dengeleyici), Amazon CloudFront veya Amazon API Gateway gibi servislerinize do\u011frudan ba\u011flayabilirsiniz.<\/p>\n<p>Peki, bu kurallar\u0131 neden AWS konsolundan el ile t\u0131klayarak de\u011fil de kod yazarak y\u00f6netmeliyiz? \u00d6ncelikle, manuel yap\u0131lan her i\u015flem insan hatas\u0131na son derece a\u00e7\u0131kt\u0131r. K\u00fc\u00e7\u00fck bir IP adresinin yanl\u0131\u015f yaz\u0131lmas\u0131 veya bir kural \u00f6nceli\u011finin hatal\u0131 ayarlanmas\u0131, t\u00fcm sistemin eri\u015filemez hale gelmesine neden olabilir. Kodla y\u00f6netim sayesinde, t\u00fcm de\u011fi\u015fiklikleri \u00f6nceden test edebilir ve hata pay\u0131n\u0131 s\u0131f\u0131ra indirebilirsiniz.<\/p>\n<p>\u0130kinci olarak, s\u00fcr\u00fcm kontrol\u00fc (version control) avantaj\u0131ndan yararlan\u0131rs\u0131n\u0131z. AWS WAF kurallar\u0131n\u0131z\u0131 Git gibi bir versiyon kontrol sisteminde tuttu\u011funuzda, hangi kural\u0131n ne zaman, kim taraf\u0131ndan ve neden de\u011fi\u015ftirildi\u011fini kolayca g\u00f6rebilirsiniz. Bir sorun olu\u015ftu\u011funda ise tek bir komutla eski g\u00fcvenli s\u00fcr\u00fcme geri d\u00f6nebilirsiniz (rollback). Bu durum, \u00f6zellikle denetim (audit) s\u00fcre\u00e7lerinde g\u00fcvenlik ekiplerine inan\u0131lmaz bir kolayl\u0131k sa\u011flar.<\/p>\n<p>Son olarak, \u00e7oklu ortam y\u00f6netimi b\u00fcy\u00fck bir problem olmaktan \u00e7\u0131kar. Geli\u015ftirme (Development), test (Staging) ve canl\u0131 (Production) ortamlar\u0131n\u0131z\u0131n tamam\u0131nda ayn\u0131 g\u00fcvenlik standartlar\u0131n\u0131 uygulamak istiyorsan\u0131z, kodla y\u00f6netim tek mant\u0131kl\u0131 se\u00e7enektir. Kod tabanl\u0131 yakla\u015f\u0131m sayesinde, ayn\u0131 WAF kurallar\u0131n\u0131 saniyeler i\u00e7inde farkl\u0131 AWS hesaplar\u0131na ve b\u00f6lgelerine (regions) hatas\u0131z bir \u015fekilde da\u011f\u0131tabilirsiniz.<\/p>\n<h2>Altyap\u0131 Olarak Kod (IaC) ile AWS WAF Kurulumu Nas\u0131l Yap\u0131l\u0131r?<\/h2>\n<p>Altyap\u0131 olarak kod (IaC) yakla\u015f\u0131m\u0131, AWS kaynaklar\u0131n\u0131 tan\u0131mlamak ve y\u00f6netmek i\u00e7in deklaratif (tan\u0131mlay\u0131c\u0131) dosyalar kullan\u0131r. AWS WAF y\u00f6netiminde en pop\u00fcler iki ara\u00e7 Terraform ve AWS CloudFormation&#8217;d\u0131r. Terraform, bulut sa\u011flay\u0131c\u0131dan ba\u011f\u0131ms\u0131z yap\u0131s\u0131 ve geni\u015f topluluk deste\u011fi ile \u00f6ne \u00e7\u0131karken; CloudFormation, AWS&#8217;nin kendi yerel servisidir.<\/p>\n<p>Kodla AWS WAF y\u00f6netimine ba\u015flarken ilk yapman\u0131z gereken \u015fey, g\u00fcvenlik kurallar\u0131n\u0131z\u0131 mod\u00fcler hale getirmektir. Sabit de\u011ferleri (hardcoded) do\u011frudan kodun i\u00e7ine yazmak yerine, de\u011fi\u015fkenler (variables) kullanmal\u0131s\u0131n\u0131z. \u00d6rne\u011fin, engellenecek IP adreslerini i\u00e7eren bir listeyi kodun i\u00e7inde statik olarak tan\u0131mlamak yerine, dinamik olarak g\u00fcncellenen bir IP Set (IP K\u00fcmesi) kayna\u011f\u0131na ba\u011flamal\u0131s\u0131n\u0131z. B\u00f6ylece kodun okunabilirli\u011fini ve bak\u0131m\u0131n\u0131 kolayla\u015ft\u0131r\u0131rs\u0131n\u0131z.<\/p>\n<p>A\u015fa\u011f\u0131daki tabloda, manuel y\u00f6netim ile kodla y\u00f6netim aras\u0131ndaki temel farklar\u0131 daha net g\u00f6rebilirsiniz:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u00d6zellik<\/th>\n<th>Manuel Y\u00f6netim (Konsol)<\/th>\n<th>Kodla Y\u00f6netim (IaC)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Hata Oran\u0131<\/td>\n<td>Y\u00fcksek (\u0130nsan hatas\u0131na a\u00e7\u0131k)<\/td>\n<td>\u00c7ok D\u00fc\u015f\u00fck (Test edilebilir)<\/td>\n<\/tr>\n<tr>\n<td>S\u00fcr\u00fcm Kontrol\u00fc<\/td>\n<td>Yok (Sadece AWS CloudTrail loglar\u0131)<\/td>\n<td>Tam (Git ge\u00e7mi\u015fi ve commit detaylar\u0131)<\/td>\n<\/tr>\n<tr>\n<td>Ortamlar Aras\u0131 Tutarl\u0131l\u0131k<\/td>\n<td>Zor (Her ortamda elle kurulum)<\/td>\n<td>M\u00fckemmel (Ayn\u0131 kod \u015fablonu)<\/td>\n<\/tr>\n<tr>\n<td>Geri D\u00f6n\u00fc\u015f (Rollback) S\u00fcresi<\/td>\n<td>Uzun (De\u011fi\u015fiklikleri elle geri alma)<\/td>\n<td>Saniyeler i\u00e7inde (Git revert ve deploy)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Bu kar\u015f\u0131la\u015ft\u0131rma, \u00f6zellikle b\u00fcy\u00fck \u00f6l\u00e7ekli projelerde kodla y\u00f6netimin neden bir l\u00fcks de\u011fil, zorunluluk oldu\u011funu a\u00e7\u0131k\u00e7a ortaya koymaktad\u0131r. \u015eimdi, bu teorik bilgileri prati\u011fe d\u00f6kerek Terraform ile ilk AWS WAF kural\u0131m\u0131z\u0131 nas\u0131l yazaca\u011f\u0131m\u0131za bakal\u0131m.<\/p>\n<h2>Terraform ile Temel Bir AWS WAF Kural\u0131 Olu\u015fturma<\/h2>\n<p>AWS WAFv2 API&#8217;sini kullanarak Terraform ile bir Web ACL (Web Eri\u015fim Kontrol Listesi) olu\u015fturmak olduk\u00e7a basittir. \u0130lk olarak, s\u0131k\u00e7a kar\u015f\u0131la\u015f\u0131lan bir senaryoyu ele alal\u0131m: Belirli bir IP adres blo\u011fundan gelen istekleri engellemek ve di\u011fer t\u00fcm isteklere izin vermek istiyoruz. Bu senaryo, \u00f6zellikle belirli bir IP adresinden gelen siber sald\u0131r\u0131lar\u0131 veya tarama (scanning) faaliyetlerini engellemek i\u00e7in idealdir.<\/p>\n<p>Bunun i\u00e7in \u00f6ncelikle bir <code>aws_wafv2_ip_set<\/code> kayna\u011f\u0131 tan\u0131mlamal\u0131, ard\u0131ndan bu IP k\u00fcmesini kullanan bir <code>aws_wafv2_web_acl<\/code> olu\u015fturmal\u0131y\u0131z. \u0130\u015fte bu senaryoyu ger\u00e7ekle\u015ftiren \u00f6rnek Terraform kodu:<\/p>\n<div class=\"code-container\">\n<pre><code>resource \"aws_wafv2_ip_set\" \"kara_liste_ip\" {\n  name               = \"kara-liste-ip-seti\"\n  description        = \"Engellenen IP Adresleri\"\n  scope              = \"REGIONAL\"\n  ip_address_version = \"IPV4\"\n  addresses          = [\"192.0.2.0\/24\", \"198.51.100.0\/22\"]\n}\n\nresource \"aws_wafv2_web_acl\" \"web_guvenlik_duvari\" {\n  name        = \"web-guvenlik-duvari\"\n  description = \"Temel Web ACL Kurallar\u0131\"\n  scope       = \"REGIONAL\"\n\n  default_action {\n    allow {}\n  }\n\n  rule {\n    name     = \"IPEngellemeKurali\"\n    priority = 1\n\n    action {\n      block {}\n    }\n\n    statement {\n      ip_set_reference_statement {\n        arn = aws_wafv2_ip_set.kara_liste_ip.arn\n      }\n    }\n\n    visibility_config {\n      cloudwatch_metrics_enabled = true\n      metric_name                = \"IPEngellemeKuraliMetrik\"\n      sampled_requests_enabled   = true\n    }\n  }\n\n  visibility_config {\n    cloudwatch_metrics_enabled = true\n    metric_name                = \"webGuvenlikDuvariMetrik\"\n    sampled_requests_enabled   = true\n  }\n}<\/code><\/pre>\n<\/div>\n<p>Yukar\u0131daki kod blo\u011funda, ilk olarak <code>kara_liste_ip<\/code> ad\u0131nda bir IP k\u00fcmesi olu\u015fturduk. Ard\u0131ndan, <code>web_guvenlik_duvari<\/code> ad\u0131ndaki Web ACL kayna\u011f\u0131m\u0131z i\u00e7erisinde bu IP k\u00fcmesini referans g\u00f6steren bir kural (rule) tan\u0131mlad\u0131k. Bu kural, belirtilen IP&#8217;lerden gelen istekleri do\u011frudan engelleyecek (Block) \u015fekilde yap\u0131land\u0131r\u0131lm\u0131\u015ft\u0131r. En \u00f6nemlisi, <code>default_action<\/code> blo\u011fu ise bu kurala uymayan di\u011fer t\u00fcm temiz isteklere izin verecektir (Allow).<\/p>\n<h2>\u00c7oklu Hesap (Multi-Account) Ortamlar\u0131nda AWS WAF Y\u00f6netimi Nas\u0131l Olmal\u0131d\u0131r?<\/h2>\n<p>B\u00fcy\u00fck \u00f6l\u00e7ekli kurumsal \u015firketler genellikle tek bir AWS hesab\u0131 yerine, g\u00fcvenlik ve faturaland\u0131rma s\u0131n\u0131rlar\u0131n\u0131 belirlemek i\u00e7in \u00e7oklu AWS hesaplar\u0131 (Multi-Account) kullan\u0131rlar. Bu t\u00fcr yap\u0131larda, her hesapta ayr\u0131 ayr\u0131 WAF kurallar\u0131 tan\u0131mlamak s\u00fcrd\u00fcr\u00fclemez bir y\u00f6netim y\u00fck\u00fc olu\u015fturur. Ayr\u0131ca, farkl\u0131 ekiplerin g\u00fcvenlik kurallar\u0131n\u0131 bypass etme riski de ortaya \u00e7\u0131kar.<\/p>\n<p>Bu sorunu \u00e7\u00f6zmek i\u00e7in AWS Organizations ve AWS Firewall Manager servislerini kodla entegre etmelisiniz. AWS Firewall Manager, t\u00fcm organizasyonunuz genelinde AWS WAF kurallar\u0131n\u0131 merkezi olarak da\u011f\u0131tman\u0131za ve uygulaman\u0131za olanak tan\u0131r. Bu sayede, yeni a\u00e7\u0131lan bir AWS hesab\u0131 bile an\u0131nda \u015firketinizin standart g\u00fcvenlik kurallar\u0131 ile korunmaya ba\u015flar.<\/p>\n<p>Merkezi y\u00f6netim i\u00e7in \u015fu ad\u0131mlar\u0131 izleyebilirsiniz:<\/p>\n<ul>\n<li>AWS Organizations \u00fczerinde bir g\u00fcvenlik hesab\u0131 (Security Account) belirleyin.<\/li>\n<li>AWS Firewall Manager&#8217;\u0131 bu hesap \u00fczerinde etkinle\u015ftirin.<\/li>\n<li>Terraform veya CloudFormation kullanarak merkezi bir &#8220;WAF Politikas\u0131&#8221; (WAF Policy) yaz\u0131n.<\/li>\n<li>Bu politikay\u0131, organizasyonunuza yeni kat\u0131lan hesaplar da dahil olmak \u00fczere t\u00fcm hedef hesaplara otomatik olarak uygulay\u0131n.<\/li>\n<\/ul>\n<p>B\u00f6ylece, yeni bir mikro servis veya uygulama yay\u0131na al\u0131nd\u0131\u011f\u0131nda, g\u00fcvenlik ekibinin manuel m\u00fcdahalesine gerek kalmadan temel koruma kurallar\u0131 otomatik olarak aktif hale gelecektir. Bu yakla\u015f\u0131m, g\u00fcvenlik standartlar\u0131n\u0131n \u015firketin tamam\u0131nda eksiksiz uygulanmas\u0131n\u0131 sa\u011flar ve uyumluluk (compliance) s\u00fcre\u00e7lerini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde kolayla\u015ft\u0131r\u0131r.<\/p>\n<h2>CI\/CD S\u00fcre\u00e7lerine AWS WAF Entegrasyonu Nas\u0131l Sa\u011flan\u0131r?<\/h2>\n<p>G\u00fcvenlik kurallar\u0131n\u0131z\u0131 kod haline getirdikten sonra, bunlar\u0131 yaz\u0131l\u0131m geli\u015ftirme ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn (SDLC) bir par\u00e7as\u0131 haline getirmelisiniz. GitOps prensiplerini benimseyerek, WAF kurallar\u0131n\u0131zdaki her de\u011fi\u015fikli\u011fi otomatik bir CI\/CD (S\u00fcrekli Entegrasyon \/ S\u00fcrekli Da\u011f\u0131t\u0131m) hatt\u0131ndan ge\u00e7irebilirsiniz. Bu yakla\u015f\u0131m, g\u00fcvenli\u011fi yaz\u0131l\u0131m geli\u015ftirme s\u00fcrecinin en ba\u015f\u0131na entegre eden &#8220;DevSecOps&#8221; felsefesinin temelini olu\u015fturur.<\/p>\n<p>Bir geli\u015ftirici veya g\u00fcvenlik analisti yeni bir kural eklemek istedi\u011finde, Git \u00fczerinde bir Pull Request (De\u011fi\u015fiklik \u0130ste\u011fi) a\u00e7ar. CI\/CD hatt\u0131 (\u00f6rne\u011fin GitHub Actions, GitLab CI veya AWS CodePipeline) devreye girerek \u015fu ad\u0131mlar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131r:<\/p>\n<ol>\n<li><strong>Linting (Kod Analizi):<\/strong> Terraform veya CloudFormation kodunun s\u00f6zdizimi (syntax) hatalar\u0131n\u0131 kontrol eder.<\/li>\n<li><strong>G\u00fcvenlik Taramas\u0131:<\/strong> <code>tfsec<\/code> veya <code>checkov<\/code> gibi ara\u00e7lar kullanarak WAF kodunda g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olup olmad\u0131\u011f\u0131n\u0131 denetler (\u00f6rne\u011fin, varsay\u0131lan kural\u0131n yanl\u0131\u015fl\u0131kla herkese a\u00e7\u0131k b\u0131rak\u0131lmas\u0131).<\/li>\n<li><strong>Plan A\u015famas\u0131:<\/strong> <code>terraform plan<\/code> komutu ile hangi kurallar\u0131n eklenece\u011fini, de\u011fi\u015ftirilece\u011fini veya silinece\u011fini g\u00f6steren bir rapor olu\u015fturur.<\/li>\n<li><strong>Onay ve Da\u011f\u0131t\u0131m:<\/strong> K\u0131demli bir g\u00fcvenlik m\u00fchendisinin onay\u0131n\u0131n ard\u0131ndan, kod otomatik olarak hedef AWS ortam\u0131na da\u011f\u0131t\u0131l\u0131r (apply).<\/li>\n<\/ol>\n<h3>Vaka Analizi: T\u00fcrkiye&#8217;nin Lider E-Ticaret Platformunda WAF Otomasyonu<\/h3>\n<p>T\u00fcrkiye&#8217;de faaliyet g\u00f6steren b\u00fcy\u00fck bir e-ticaret platformu, Kas\u0131m ay\u0131 indirim d\u00f6nemlerinde (Black Friday) yo\u011fun bot sald\u0131r\u0131lar\u0131na maruz kal\u0131yordu. G\u00fcvenlik ekibi, sald\u0131rganlar\u0131n IP adreslerini manuel olarak engellemeye \u00e7al\u0131\u015f\u0131rken hem ge\u00e7 kal\u0131yor hem de yanl\u0131\u015fl\u0131kla ger\u00e7ek kullan\u0131c\u0131lar\u0131 engelliyordu. Bu durum ciddi ciro kay\u0131plar\u0131na yol a\u00e7\u0131yordu.<\/p>\n<p>\u015eirket, AWS WAF y\u00f6netimini tamamen Terraform&#8217;a ta\u015f\u0131d\u0131. Log analiz sistemlerini (AWS Athena ve Kinesis) WAF ile entegre ederek, anormal trafik \u00fcreten IP&#8217;leri otomatik tespit eden bir sistem kurdular. Bu sistem, \u015f\u00fcpheli IP&#8217;leri tespit etti\u011finde Git deposundaki bir IP listesini g\u00fcncelleyen otomatik bir Pull Request a\u00e7\u0131yordu. CI\/CD pipeline&#8217;\u0131 bu iste\u011fi 30 saniye i\u00e7inde test edip canl\u0131ya al\u0131yordu. Sonu\u00e7 olarak, bot sald\u0131r\u0131lar\u0131na yan\u0131t verme s\u00fcresi 45 dakikadan 1 dakikan\u0131n alt\u0131na d\u00fc\u015ft\u00fc ve m\u00fc\u015fteri memnuniyeti %99.8 seviyesinde korundu.<\/p>\n<h2>AWS WAF Kurallar\u0131n\u0131 Test Etmek \u0130\u00e7in Hangi Y\u00f6ntemler Kullan\u0131l\u0131r?<\/h2>\n<p>Yazd\u0131\u011f\u0131n\u0131z bir g\u00fcvenlik kural\u0131n\u0131n, ger\u00e7ek kullan\u0131c\u0131 trafi\u011fini engellemeyece\u011finden (False Positive &#8211; Hatal\u0131 Pozitif) nas\u0131l emin olabilirsiniz? Canl\u0131 ortama do\u011frudan &#8220;Block&#8221; (Engelle) modunda kural da\u011f\u0131tmak olduk\u00e7a risklidir. Yanl\u0131\u015f yaz\u0131lm\u0131\u015f bir d\u00fczenli ifade (Regex), m\u00fc\u015fterilerinizin sepet sayfas\u0131na eri\u015fmesini engelleyebilir.<\/p>\n<p>Bu riski azaltmak i\u00e7in AWS WAF&#8217;\u0131n &#8220;Count&#8221; (Say) modunu kullanmal\u0131s\u0131n\u0131z. Bir kural\u0131 kodunuzda tan\u0131mlarken aksiyonunu <code>Count<\/code> olarak belirlerseniz, WAF bu kurala e\u015fle\u015fen istekleri engellemez, sadece loglar ve metrikler \u00fczerinde i\u015faretler. B\u00f6ylece kural\u0131n ne kadar istek yakalad\u0131\u011f\u0131n\u0131 izleyebilirsiniz.<\/p>\n<p>Kural\u0131 en az 24-48 saat boyunca &#8220;Count&#8221; modunda \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, AWS Athena veya CloudWatch Logs Insights kullanarak loglar\u0131 analiz etmelisiniz. E\u011fer normal kullan\u0131c\u0131lar\u0131n istekleri bu kurala tak\u0131lm\u0131yorsa, kodunuzdaki kural aksiyonunu g\u00fcvenle <code>Block<\/code> olarak g\u00fcncelleyebilir ve CI\/CD hatt\u0131n\u0131z \u00fczerinden canl\u0131ya alabilirsiniz. Bu y\u00f6ntem, i\u015f s\u00fcreklili\u011fini bozmadan g\u00fcvenli\u011fi art\u0131rman\u0131n en sa\u011flam yoludur.<\/p>\n<h2>Kodla AWS WAF Y\u00f6netiminde S\u0131k Yap\u0131lan Hatalar ve \u00c7\u00f6z\u00fcmleri<\/h2>\n<p>Kodla altyap\u0131 y\u00f6netimi harika avantajlar sunsa da, baz\u0131 kritik hatalar b\u00fcy\u00fck sorunlara yol a\u00e7abilir. Bu hatalar\u0131 bilmek ve \u00f6nceden \u00f6nlem almak, sistemlerinizin kararl\u0131l\u0131\u011f\u0131 a\u00e7\u0131s\u0131ndan hayati \u00f6nem ta\u015f\u0131r.<\/p>\n<ul>\n<li><strong>WCU (WAF Capacity Unit) S\u0131n\u0131rlar\u0131n\u0131 G\u00f6z Ard\u0131 Etmek:<\/strong> AWS WAF&#8217;ta her kural\u0131n karma\u015f\u0131kl\u0131\u011f\u0131na g\u00f6re bir WCU bedeli vard\u0131r ve bir Web ACL i\u00e7in toplam s\u0131n\u0131r genellikle 1500&#8217;d\u00fcr. Kod yazarken kurallar\u0131n WCU maliyetlerini hesaplamamak, da\u011f\u0131t\u0131m (deployment) s\u0131ras\u0131nda hatalara yol a\u00e7ar. Kurallar\u0131n\u0131z\u0131 yazarken WCU de\u011ferlerini her zaman optimize edin.<\/li>\n<li><strong>Hassas Verileri Koda G\u00f6mme:<\/strong> IP adresleri veya \u00f6zel API anahtarlar\u0131 gibi hassas verileri do\u011frudan Git depolar\u0131nda saklamay\u0131n. Bunlar\u0131 AWS Secrets Manager veya Terraform de\u011fi\u015fkenleri (variables) arac\u0131l\u0131\u011f\u0131yla d\u0131\u015far\u0131dan besleyin.<\/li>\n<li><strong>Loglamay\u0131 \u0130hmal Etmek:<\/strong> WAF kurallar\u0131n\u0131 kodla da\u011f\u0131t\u0131p loglamay\u0131 aktif etmemek, karanl\u0131kta y\u00fcr\u00fcmeye benzer. <code>aws_wafv2_web_acl_logging_configuration<\/code> kayna\u011f\u0131n\u0131 kullanarak loglar\u0131 mutlaka bir Amazon S3 kovas\u0131na veya CloudWatch log grubuna y\u00f6nlendirin.<\/li>\n<\/ul>\n<h2>S\u0131k\u00e7a Sorulan Sorular (FAQ)<\/h2>\n<h3>AWS WAF kurallar\u0131n\u0131 kodla y\u00f6netmek performans\u0131 etkiler mi?<\/h3>\n<p>Hay\u0131r, AWS WAF kurallar\u0131n\u0131 kodla y\u00f6netmek (Terraform veya CloudFormation kullanmak) sadece kurallar\u0131n olu\u015fturulma ve g\u00fcncellenme s\u00fcrecini etkiler. WAF&#8217;\u0131n istekleri inceleme performans\u0131 \u00fczerinde hi\u00e7bir olumsuz etkisi yoktur.<\/p>\n<h3>Terraform ile yaz\u0131lan WAF kurallar\u0131 ne kadar s\u00fcrede aktif olur?<\/h3>\n<p>Terraform kodunuzu uygulad\u0131ktan (apply) sonra, AWS WAF kurallar\u0131 d\u00fcnya genelindeki t\u00fcm AWS u\u00e7 noktalar\u0131nda (edge locations) genellikle birka\u00e7 saniye i\u00e7inde aktif hale gelir.<\/p>\n<h3>AWS Managed Rules (Y\u00f6netilen Kurallar) kodla nas\u0131l entegre edilir?<\/h3>\n<p>AWS&#8217;nin sundu\u011fu haz\u0131r koruma paketlerini (\u00f6rne\u011fin SQLi veya Core Rule Set) kodunuza kolayca ekleyebilirsiniz. Bunun i\u00e7in Web ACL kayna\u011f\u0131n\u0131z\u0131n i\u00e7inde <code>managed_rule_group_statement<\/code> blo\u011funu kullanman\u0131z yeterlidir.<\/p>\n<h3>WAF kurallar\u0131nda hata yapt\u0131\u011f\u0131mda h\u0131zl\u0131ca nas\u0131l geri d\u00f6nebilirim?<\/h3>\n<p>Git s\u00fcr\u00fcm kontrol sisteminizde bir \u00f6nceki commit&#8217;e geri d\u00f6n\u00fcp (git revert) CI\/CD pipeline&#8217;\u0131n\u0131z\u0131 tekrar tetikleyerek birka\u00e7 dakika i\u00e7inde eski \u00e7al\u0131\u015fan WAF kurallar\u0131n\u0131z\u0131 geri y\u00fckleyebilirsiniz.<\/p>\n<p>#AWS #IaC #Terraform #SiberG\u00fcvenlik #CloudSecurity<\/p>\n<div class=\"github-example-link\"><strong>\u00d6rnek kod:<\/strong> <a href=\"https:\/\/github.com\/fatihsoysalcom\/aws-waf-rule-management-with-iac\" target=\"_blank\" rel=\"noopener noreferrer\">github.com\/fatihsoysalcom\/aws-waf-rule-management-with-iac<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"Kodla AWS WAF y\u00f6netimi ile web uygulamalar\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 koruyun. Terraform ve CloudFormation kullanarak g\u00fcvenli\u011finizi kolayca otomatikle\u015ftirebilirsiniz.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1406],"tags":[],"class_list":{"0":"post-43381","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-aws","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi\" \/>\n<meta property=\"og:description\" content=\"Kodla AWS WAF y\u00f6netimi ile web uygulamalar\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 koruyun. Terraform ve CloudFormation kullanarak g\u00fcvenli\u011finizi kolayca otomatikle\u015ftirebilirsiniz.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-16T18:01:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-16T18:01:46+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi\",\"datePublished\":\"2026-07-16T18:01:15+00:00\",\"dateModified\":\"2026-07-16T18:01:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\"},\"wordCount\":2221,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"AWS\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\",\"name\":\"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-07-16T18:01:15+00:00\",\"dateModified\":\"2026-07-16T18:01:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi","og_description":"Kodla AWS WAF y\u00f6netimi ile web uygulamalar\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 koruyun. Terraform ve CloudFormation kullanarak g\u00fcvenli\u011finizi kolayca otomatikle\u015ftirebilirsiniz.","og_url":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-07-16T18:01:15+00:00","article_modified_time":"2026-07-16T18:01:46+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"12 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi","datePublished":"2026-07-16T18:01:15+00:00","dateModified":"2026-07-16T18:01:46+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/"},"wordCount":2221,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["AWS"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/","name":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-07-16T18:01:15+00:00","dateModified":"2026-07-16T18:01:46+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/kodla-aws-waf-yonetimi-en-iyi-pratikler-ve-iac-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kodla AWS WAF Y\u00f6netimi: En \u0130yi Pratikler ve IaC Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=43381"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43381\/revisions"}],"predecessor-version":[{"id":43382,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43381\/revisions\/43382"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=43381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=43381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=43381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}