{"id":45150,"date":"2026-10-12T09:07:51","date_gmt":"2026-10-12T06:07:51","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/"},"modified":"2026-10-12T09:08:16","modified_gmt":"2026-10-12T06:08:16","slug":"aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/","title":{"rendered":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin"},"content":{"rendered":"

AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin<\/h2>\n

AWS \u00fczerinde kimlik bilgisi y\u00f6netimi ile hassas verilerinizi g\u00fcvenceye al\u0131n, kaynak kod i\u00e7erisine \u015fifre g\u00f6mme riskini profesyonel y\u00f6ntemlerle tamamen ortadan kald\u0131r\u0131n.<\/p>\n

Projelerin teslim tarihlerine yeti\u015fmeye \u00e7al\u0131\u015f\u0131rken bir\u00e7ok yaz\u0131l\u0131mc\u0131 benzer bir hata yapar. H\u0131zl\u0131 bir test yapmak amac\u0131yla veritaban\u0131 parolas\u0131n\u0131 do\u011frudan kaynak koda yaz\u0131p bir alt sat\u0131ra ge\u00e7mek olduk\u00e7a masum g\u00f6r\u00fcn\u00fcr. Ancak bu ge\u00e7ici g\u00f6r\u00fcnen hamle, \u00e7o\u011funlukla unutulur ve do\u011frudan versiyon kontrol sistemine (\u00f6rne\u011fin Git) g\u00f6nderilir. Bir sabah uyand\u0131\u011f\u0131n\u0131zda AWS faturan\u0131z\u0131n binlerce dolara ula\u015ft\u0131\u011f\u0131n\u0131 g\u00f6rebilir veya kullan\u0131c\u0131 verilerinizin internete s\u0131zd\u0131\u011f\u0131 haberiyle sars\u0131labilirsiniz. \u0130\u015fte bu y\u00fczden \u00fcretim ortam\u0131ndaki uygulamalarda kimlik bilgilerini (credentials) kod i\u00e7inde sabit olarak tutma, yani “hardcoding” al\u0131\u015fkanl\u0131\u011f\u0131n\u0131 kesin olarak terk etmemiz gerekir.<\/p>\n

Geli\u015ftiricilerin s\u0131kl\u0131kla d\u00fc\u015ft\u00fc\u011f\u00fc bu tuzak, modern bulut mimarisinde kabul edilemez bir zafiyettir. Bulut bili\u015fim d\u00fcnyas\u0131, dinamik altyap\u0131lar ve s\u00fcrekli da\u011f\u0131t\u0131m (CI\/CD) s\u00fcre\u00e7leri \u00fczerine kuruludur. Dolay\u0131s\u0131yla, statik ve kod i\u00e7erisine g\u00f6m\u00fclm\u00fc\u015f parolalar hem g\u00fcvenlik a\u00e7\u0131klar\u0131na davetiye \u00e7\u0131kar\u0131r hem de operasyonel esnekli\u011fi tamamen yok eder. Bu makalede, AWS ekosisteminde \u00fcretim seviyesindeki uygulamalar\u0131n hassas verileri nas\u0131l y\u00f6netti\u011fini, s\u0131f\u0131rdan ileri seviyeye ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n

Hardcoding Neden Bir Kabustur ve Hangi Riskleri Do\u011furur?<\/h2>\n

Kaynak koda \u015fifre yazmak, evinizin anahtar\u0131n\u0131 paspas\u0131n alt\u0131na koyup \u00fczerine de “anahtar buradad\u0131r” yazmaktan farks\u0131zd\u0131r. Bir\u00e7ok yaz\u0131l\u0131m ekibi, \u00f6zel depolar\u0131n (private repository) g\u00fcvenli oldu\u011funa inanarak bu yan\u0131lg\u0131ya d\u00fc\u015fer. Ancak \u015firket i\u00e7i yetkilendirme hatalar\u0131, \u00fc\u00e7\u00fcnc\u00fc taraf analiz ara\u00e7lar\u0131 veya eski \u00e7al\u0131\u015fanlar\u0131n eri\u015fim haklar\u0131 nedeniyle bu \u00f6zel depolar kolayca s\u0131zd\u0131r\u0131labilir. \u00dcstelik GitHub gibi platformlarda a\u00e7\u0131k kaynak kodlu depolara yanl\u0131\u015fl\u0131kla g\u00f6nderilen AWS eri\u015fim anahtarlar\u0131 (access keys), saniyeler i\u00e7inde otomatik botlar taraf\u0131ndan taran\u0131r ve kripto madencili\u011fi amac\u0131yla k\u00f6t\u00fcye kullan\u0131l\u0131r.<\/p>\n

G\u00fcvenlik boyutunun yan\u0131 s\u0131ra, bu yakla\u015f\u0131m inan\u0131lmaz bir operasyonel y\u00fck getirir. \u00d6rne\u011fin, bir veritaban\u0131 \u015fifresini de\u011fi\u015ftirmeniz gerekti\u011finde ne yapars\u0131n\u0131z? Kodu a\u00e7man\u0131z, \u015fifreyi g\u00fcncellemeniz, yeni bir s\u00fcr\u00fcm \u00e7\u0131kar\u0131p test etmeniz ve ard\u0131ndan t\u00fcm sunuculara yeniden da\u011f\u0131tman\u0131z gerekir. Bu s\u00fcre\u00e7 dakikalar hatta saatler s\u00fcrebilir. Bu s\u00fcre zarf\u0131nda sistemlerinizin kapal\u0131 kalmas\u0131 (downtime) ka\u00e7\u0131n\u0131lmaz hale gelir. Dolay\u0131s\u0131yla, \u015fifre de\u011fi\u015fimini bu kadar zorla\u015ft\u0131ran bir mimari, ekiplerin \u015fifreleri aylarca veya y\u0131llarca hi\u00e7 de\u011fi\u015ftirmemesine yol a\u00e7ar.<\/p>\n

Ayr\u0131ca denetim ve mevzuat uyumlulu\u011fu a\u00e7\u0131s\u0131ndan da b\u00fcy\u00fck engellerle kar\u015f\u0131la\u015f\u0131rs\u0131n\u0131z. T\u00fcrkiye’deki KVKK (Ki\u015fisel Verilerin Korunmas\u0131 Kanunu) veya uluslararas\u0131 alandaki ISO 27001 ve SOC 2 gibi standartlar, hassas verilerin \u015fifrelenmesini ve bu verilere kimin ne zaman eri\u015fti\u011finin kay\u0131t alt\u0131na al\u0131nmas\u0131n\u0131 \u015fart ko\u015far. Kaynak koda g\u00f6m\u00fclen bir kimlik bilgisi i\u00e7in eri\u015fim denetimi yapamazs\u0131n\u0131z; depoya eri\u015fimi olan herkes bu bilgiyi s\u0131n\u0131rs\u0131zca kullanabilir.<\/p>\n

AWS Parameter Store ve Secrets Manager Aras\u0131ndaki Fark Nedir?<\/h2>\n

AWS, hassas yap\u0131land\u0131rma verilerini ve gizli anahtarlar\u0131 g\u00fcvenle saklamak i\u00e7in iki temel servis sunar: AWS Systems Manager Parameter Store ve AWS Secrets Manager. \u0130ki servis de verileri \u015fifreleyerek depolar; ancak kullan\u0131m ama\u00e7lar\u0131 ve maliyet yap\u0131lar\u0131 a\u00e7\u0131s\u0131ndan belirgin farklara sahiptirler.<\/p>\n

Systems Manager Parameter Store, temel yap\u0131land\u0131rma verileri ve orta d\u00fczeyde hassas metinler i\u00e7in harika bir \u00e7\u00f6z\u00fcmd\u00fcr. \u00dccretsiz katmanda (standart parametreler) s\u0131n\u0131rs\u0131z parametre saklaman\u0131za izin verir ve istek ba\u015f\u0131na \u00fccret almaz. Buna kar\u015f\u0131n AWS Secrets Manager, \u00f6zellikle veritaban\u0131 parolalar\u0131, \u00fc\u00e7\u00fcnc\u00fc taraf API anahtarlar\u0131 ve OAuth belirte\u00e7leri gibi y\u00fcksek g\u00fcvenlik gerektiren dinamik veriler i\u00e7in \u00f6zel olarak geli\u015ftirilmi\u015ftir. Secrets Manager, otomatik parola rotasyonu (rotation) ve rastgele parola \u00fcretimi gibi kritik yetenekler sunar.<\/p>\n\n\n\n\n\n\n\n\n\n
\u00d6zellik<\/th>\nSSM Parameter Store<\/th>\nAWS Secrets Manager<\/th>\n<\/tr>\n<\/thead>\n
Otomatik Rotasyon<\/td>\nDo\u011fal olarak yok (Lambda ile manuel kurulmal\u0131)<\/td>\nRDS ve di\u011fer servisler i\u00e7in dahili destek<\/td>\n<\/tr>\n
Maliyet<\/td>\nStandart parametreler \u00fccretsiz<\/td>\nGizli anahtar ba\u015f\u0131na ayl\u0131k $0.40 + API \u00e7a\u011fr\u0131 \u00fccreti<\/td>\n<\/tr>\n
\u015eifreleme<\/td>\nAWS KMS (Key Management Service) deste\u011fi<\/td>\nAWS KMS ile zorunlu \u015fifreleme<\/td>\n<\/tr>\n
Maksimum De\u011fer Boyutu<\/td>\nStandart: 4 KB, Geli\u015fmi\u015f: 8 KB<\/td>\n64 KB<\/td>\n<\/tr>\n
\u00c7apraz Hesap Eri\u015fimi<\/td>\nS\u0131n\u0131rl\u0131 yap\u0131land\u0131rma gerektirir<\/td>\nYerel kaynak politikalar\u0131yla kolayca y\u00f6netilir<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Bu iki servis aras\u0131nda se\u00e7im yaparken projenizin b\u00fct\u00e7esini ve ihtiya\u00e7lar\u0131n\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmal\u0131s\u0131n\u0131z. \u00d6rne\u011fin, uygulaman\u0131z\u0131n log seviyesini veya API u\u00e7 noktalar\u0131n\u0131 (endpoint) Parameter Store \u00fczerinde tutabilirsiniz. Ancak do\u011frudan kredi kart\u0131 tahsilat API anahtarlar\u0131n\u0131 veya PostgreSQL k\u00f6k parolas\u0131n\u0131 Secrets Manager i\u00e7erisinde bar\u0131nd\u0131rmak en do\u011fru yakla\u015f\u0131md\u0131r.<\/p>\n

IAM Rolleri ile Parolas\u0131z Kimlik Do\u011frulama Nas\u0131l Yap\u0131l\u0131r?<\/h2>\n

Bulut ortam\u0131nda g\u00fcvenlik piramidinin en tepesinde IAM (Kimlik ve Eri\u015fim Y\u00f6netimi) rolleri yer al\u0131r. Geli\u015ftiricilerin yapt\u0131\u011f\u0131 en yayg\u0131n hatalardan biri, bir EC2 sanal sunucusuna veya ECS konteynerine AWS servislerine eri\u015febilmesi i\u00e7in statik bir AWS_ACCESS_KEY_ID<\/code> ve AWS_SECRET_ACCESS_KEY<\/code> tan\u0131mlamakt\u0131r. Bu anahtarlar s\u0131zd\u0131\u011f\u0131 takdirde sisteminiz tamamen savunmas\u0131z kal\u0131r.<\/p>\n

Oysa AWS, ge\u00e7ici kimlik bilgileri sa\u011flayan rol tabanl\u0131 bir mekanizma sunar. EC2 i\u00e7in Instance Profile, ECS i\u00e7in Task Role ve Kubernetes (EKS) i\u00e7in IRSA (IAM Roles for Service Accounts) kullanarak uygulamalar\u0131n\u0131za do\u011frudan rol atayabilirsiniz. Bu sayede uygulaman\u0131z AWS SDK (Yaz\u0131l\u0131m Geli\u015ftirme Kiti) arac\u0131l\u0131\u011f\u0131yla \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, arka plandaki AWS Metadata servisinden otomatik olarak k\u0131sa \u00f6m\u00fcrl\u00fc kimlik belirte\u00e7leri al\u0131r.<\/p>\n

Bu yakla\u015f\u0131m sayesinde hi\u00e7bir uzun \u00f6m\u00fcrl\u00fc kimlik bilgisini diskte saklamak veya ortam de\u011fi\u015fkenlerine (environment variables) yazmak zorunda kalmazs\u0131n\u0131z. AWS STS (Security Token Service), bu belirte\u00e7leri periyodik olarak yeniler. Sonu\u00e7 olarak, yetkisiz bir ki\u015fi sunucunuza eri\u015fse bile ele ge\u00e7irebilece\u011fi statik bir parola bulamaz.<\/p>\n

AWS Secrets Manager ile Veritaban\u0131 \u015eifre Rotasyonu Nas\u0131l Yap\u0131l\u0131r?<\/h2>\n

Parola rotasyonu, belirli aral\u0131klarla sistem \u015fifrelerinin otomatik de\u011fi\u015ftirilmesi i\u015flemidir. Geleneksel mimarilerde bu operasyon insan eliyle yap\u0131ld\u0131\u011f\u0131 i\u00e7in olduk\u00e7a sanc\u0131l\u0131d\u0131r. Bir\u00e7ok kurum, sistemlerin \u00e7\u00f6kmesinden korktu\u011fu i\u00e7in veritaban\u0131 \u015fifrelerini y\u0131llarca ayn\u0131 b\u0131rak\u0131r. AWS Secrets Manager ise bu s\u00fcreci AWS Lambda fonksiyonlar\u0131 kullanarak tamamen otomatik hale getirir.<\/p>\n

S\u00fcre\u00e7 d\u00f6rt a\u015famal\u0131 bir d\u00f6ng\u00fc halinde \u00e7al\u0131\u015f\u0131r. Secrets Manager, rotasyon zaman\u0131 geldi\u011finde \u00f6nce Lambda fonksiyonunu tetikler. Lambda, veritaban\u0131na ba\u011flanarak yeni ve g\u00fc\u00e7l\u00fc bir ge\u00e7ici parola olu\u015fturur. \u0130kinci ad\u0131mda bu parolay\u0131 test eder. \u00dc\u00e7\u00fcnc\u00fc ad\u0131mda yeni parolay\u0131 ge\u00e7erli ana \u015fifre yapar. Son ad\u0131mda ise ba\u015far\u0131l\u0131 oldu\u011funu do\u011frulay\u0131p Secrets Manager kayd\u0131n\u0131 g\u00fcnceller.<\/p>\n

\n
{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"secretsmanager:GetSecretValue\",\n        \"secretsmanager:DescribeSecret\"\n      ],\n      \"Resource\": \"arn:aws:secretsmanager:eu-central-1:123456789012:secret:prod\/db\/mysql-*\"\n    }\n  ]\n}<\/code><\/pre>\n<\/div>\n
Yukar\u0131daki IAM politikas\u0131 \u00f6rne\u011finde g\u00f6r\u00fcld\u00fc\u011f\u00fc gibi, sadece ihtiya\u00e7 duyulan belirli bir gizli bilgiye okuma yetkisi vermek en d\u00fc\u015f\u00fck yetki ilkesine (Principle of Least Privilege) sad\u0131k kalman\u0131z\u0131 sa\u011flar. Uygulaman\u0131z bu izin sayesinde veritaban\u0131 parolas\u0131n\u0131 \u00e7al\u0131\u015fma an\u0131nda \u00e7eker. B\u00f6ylece veritaban\u0131 \u015fifresi de\u011fi\u015fti\u011finde bile uygulaman\u0131z yeni \u015fifreyi haf\u0131zada g\u00fcncelleyerek kesinti ya\u015famadan \u00e7al\u0131\u015fmaya devam eder.<\/p>\n
Uygulama Kodundan AWS Secrets Manager Nas\u0131l Entegre Edilir?<\/h2>\n
\u00dcretim ortam\u0131ndaki bir Node.js veya Python uygulamas\u0131nda hassas verileri do\u011frudan ortam de\u011fi\u015fkenlerinden okumak ilk etapta cazip g\u00f6r\u00fcnebilir. Ancak ortam de\u011fi\u015fkenleri, i\u015fletim sisteminin \u00e7\u00f6kme raporlar\u0131nda (crash dump) veya alt s\u00fcre\u00e7lerinde (child process) istenmeyen \u015fekilde g\u00fcn y\u00fcz\u00fcne \u00e7\u0131kabilir. En sa\u011fl\u0131kl\u0131 y\u00f6ntem, uygulaman\u0131n aya\u011fa kalk\u0131\u015f (bootstrap) a\u015famas\u0131nda bu de\u011ferleri do\u011frudan AWS SDK yard\u0131m\u0131yla bellek i\u00e7erisine y\u00fcklemektir.<\/p>\n
Bununla birlikte, uygulaman\u0131z\u0131n gelen her HTTP iste\u011finde Secrets Manager servisine gitmesi ciddi bir gecikmeye (latency) ve y\u00fcksek AWS maliyetine yol a\u00e7ar. Bu engeli a\u015fmak i\u00e7in \u00f6nbellekleme (caching) mekanizmas\u0131 kurmal\u0131y\u0131z. \u015eimdi, Node.js kullanarak bu mimariyi nas\u0131l kuraca\u011f\u0131m\u0131za bakal\u0131m.<\/p>\n
\n
const { SecretsManagerClient, GetSecretValueCommand } = require(\"@aws-sdk\/client-secrets-manager\");\n\n\/\/ \u0130stemciyi b\u00f6lge bilgisi ile ilklendiriyoruz\nconst client = new SecretsManagerClient({ region: \"eu-central-1\" });\n\nlet cachedSecret = null;\nlet lastFetchTime = 0;\nconst CACHE_TTL_MS = 300000; \/\/ 5 dakika \u00f6nbellek s\u00fcresi\n\nasync function getDatabaseCredentials() {\n  const currentTime = Date.now();\n\n  \/\/ \u00d6nbellek ge\u00e7erliyse do\u011frudan oradan d\u00f6nd\u00fcr\n  if (cachedSecret && (currentTime - lastFetchTime < CACHE_TTL_MS)) {\n    return cachedSecret;\n  }\n\n  try {\n    const command = new GetSecretValueCommand({\n      SecretId: \"prod\/api\/payment-gateway\"\n    });\n\n    const response = await client.send(command);\n\n    if (response.SecretString) {\n      cachedSecret = JSON.parse(response.SecretString);\n      lastFetchTime = currentTime;\n      return cachedSecret;\n    }\n    \n    throw new Error(\"Gizli anahtar metin format\u0131nda bulunamad\u0131.\");\n  } catch (error) {\n    console.error(\"Kimlik bilgisi al\u0131n\u0131rken hata olu\u015ftu:\", error.message);\n    throw error;\n  }\n}\n\nmodule.exports = { getDatabaseCredentials };<\/code><\/pre>\n<\/div>\n
Yukar\u0131da sundu\u011fumuz kod blo\u011fu, hem a\u011f gecikmesini engeller hem de API \u00e7a\u011fr\u0131 maliyetlerini minimize eder. Uygulama, be\u015f dakikada bir anahtar\u0131 arka planda tazeler. E\u011fer rotasyon ger\u00e7ekle\u015fmi\u015fse, maksimum be\u015f dakika i\u00e7inde uygulaman\u0131z yeni anahtar\u0131 sorunsuz \u015fekilde devral\u0131r.<\/p>\n
Yerel Geli\u015ftirme Ortam\u0131 ile Canl\u0131 Sistemler Nas\u0131l Ayr\u0131\u015ft\u0131r\u0131l\u0131r?<\/h2>\n
Geli\u015ftiricilerin en s\u0131k kar\u015f\u0131la\u015ft\u0131\u011f\u0131 ikilem, yerel makinede (localhost) \u00e7al\u0131\u015f\u0131rken bu gizli bilgilere nas\u0131l eri\u015fecekleridir. Canl\u0131 ortam\u0131n (production) kimlik bilgilerini geli\u015ftiricilerin ki\u015fisel bilgisayarlar\u0131na indirmek b\u00fcy\u00fck bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olu\u015fturur. Bu nedenle yerel ortam, test ortam\u0131 ve canl\u0131 ortam kesin hatlarla birbirinden ayr\u0131lmal\u0131d\u0131r.<\/p>\n
Yerel geli\u015ftirme yaparken LocalStack gibi AWS servislerini sim\u00fcle eden ara\u00e7lar\u0131 kullanabilirsiniz. LocalStack, kendi bilgisayar\u0131n\u0131zda bir Docker konteyneri i\u00e7inde Secrets Manager servisi \u00e7al\u0131\u015ft\u0131rarak ger\u00e7ek AWS hesab\u0131n\u0131za ba\u011flanmadan test yapman\u0131za olanak tan\u0131r. B\u00f6ylece hem maliyet olu\u015fmaz hem de geli\u015ftiriciler canl\u0131 anahtarlara temas etmez.<\/p>\n
Ayr\u0131ca, geli\u015ftirici ortamlar\u0131nda .env<\/code> dosyalar\u0131 kullan\u0131lacaksa, bu dosyalar\u0131n kesinlikle .gitignore<\/code> listesinde yer ald\u0131\u011f\u0131ndan emin olunmal\u0131d\u0131r. Depoya sadece \u00f6rnek anahtarlar\u0131 i\u00e7eren ve ger\u00e7ek \u015fifre bar\u0131nd\u0131rmayan .env.example<\/code> dosyas\u0131 eklenmelidir. S\u00fcrekli entegrasyon (CI\/CD) hatlar\u0131nda ise GitHub Actions Secret Scanning veya GitGuardian gibi ara\u00e7lar kullanarak koda yanl\u0131\u015fl\u0131kla s\u0131zd\u0131r\u0131lan hassas verileri daha depoya girmeden engellemelisiniz.<\/p>\n
Ger\u00e7ek Bir Vaka: E-Ticaret Platformunda S\u0131zan API Anahtar\u0131<\/h2>\n
Konunun ciddiyetini anlamak ad\u0131na T\u00fcrkiye'de faaliyet g\u00f6steren orta \u00f6l\u00e7ekli bir e-ticaret \u015firketinin ba\u015f\u0131na gelen ger\u00e7ek bir olay\u0131 inceleyelim. \u015eirketin yaz\u0131l\u0131m ekibi, bir kargo entegrasyonu ve SMS bildirim sistemi \u00fczerinde \u00e7al\u0131\u015f\u0131rken h\u0131zl\u0131 hareket etmek ad\u0131na SMS sa\u011flay\u0131c\u0131s\u0131n\u0131n ve \u00f6deme ge\u00e7idinin API anahtarlar\u0131n\u0131 bir konfig\u00fcrasyon dosyas\u0131na do\u011frudan yazd\u0131.<\/p>\n
Bir stajyer geli\u015ftirici, hata ay\u0131klama yaparken bu konfig\u00fcrasyon dosyas\u0131n\u0131 yanl\u0131\u015fl\u0131kla \u015firketin genel eri\u015fime a\u00e7\u0131k (public) GitHub deposuna g\u00f6nderdi. Olay\u0131n vahameti yakla\u015f\u0131k \u00fc\u00e7 saat sonra anla\u015f\u0131ld\u0131. Botlar taraf\u0131ndan yakalanan SMS API anahtar\u0131 kullan\u0131larak, dakikalar i\u00e7inde y\u00fcz binlerce kullan\u0131c\u0131ya doland\u0131r\u0131c\u0131l\u0131k ba\u011flant\u0131lar\u0131 i\u00e7eren SMS'ler g\u00f6nderilmi\u015fti. \u015eirket, operat\u00f6rden gelen devasa fatura ile sars\u0131lmakla kalmad\u0131, ayn\u0131 zamanda KVKK nezdinde veri g\u00fcvenli\u011fi ihlali soru\u015fturmas\u0131yla kar\u015f\u0131 kar\u015f\u0131ya kald\u0131.<\/p>\n
Bu kriz sonras\u0131nda ekip, t\u00fcm altyap\u0131s\u0131n\u0131 h\u0131zla modernize etti. \u00d6ncelikle s\u0131zan t\u00fcm anahtarlar iptal edildi. Ard\u0131ndan AWS Parameter Store ve Secrets Manager entegre edilerek, IAM rolleri \u00fczerinden en d\u00fc\u015f\u00fck yetki ilkesi hayata ge\u00e7irildi. Kod depolar\u0131na \"pre-commit hook\" (g\u00f6nderim \u00f6ncesi kanca) eklentileri kurularak, geli\u015ftiricilerin makinelerinden d\u0131\u015far\u0131ya parola \u00e7\u0131k\u0131\u015f\u0131 tamamen engellendi. Bu ac\u0131 tecr\u00fcbe, g\u00fcvenlik \u00f6nlemlerinin bir l\u00fcks de\u011fil, \u015firketin varl\u0131\u011f\u0131n\u0131 s\u00fcrd\u00fcrmesi i\u00e7in zorunlu bir kural oldu\u011funu kan\u0131tlad\u0131.<\/p>\n
G\u00fcvenli Kimlik Y\u00f6netimi \u0130\u00e7in \u0130leri D\u00fczey \u0130pu\u00e7lar\u0131 Nelerdir?<\/h2>\n
AWS \u00fczerinde kimlik bilgisi y\u00f6netimini olgunla\u015ft\u0131rmak i\u00e7in temel servisleri kullanman\u0131n \u00f6tesine ge\u00e7melisiniz. \u0130lk olarak, hassas bilgilerinizi \u015fifrelerken AWS'nin varsay\u0131lan anahtarlar\u0131 yerine AWS KMS \u00fczerinde olu\u015fturdu\u011funuz M\u00fc\u015fteri Taraf\u0131ndan Y\u00f6netilen Anahtarlar\u0131 (Customer Managed Keys - CMK) tercih edin. Bu sayede verilerinizin \u015fifreleme anahtarlar\u0131n\u0131n rotasyonunu, eri\u015fim politikalar\u0131n\u0131 ve silinme s\u00fcre\u00e7lerini bizzat y\u00f6netebilirsiniz.<\/p>\n
\u0130kinci \u00f6nemli ad\u0131m, denetlenebilirliktir. AWS CloudTrail servisini etkinle\u015ftirerek, Secrets Manager veya SSM \u00fczerindeki gizli bilgilere kimin, ne zaman ve hangi IP adresinden eri\u015fti\u011fini kaydedin. CloudWatch Alarmlar\u0131 ile beklenmeyen saatlerde veya al\u0131\u015f\u0131lmad\u0131k konumlardan gelen eri\u015fim istekleri i\u00e7in acil durum uyar\u0131lar\u0131 kurun.<\/p>\n
Son olarak, ge\u00e7ici eri\u015fimler i\u00e7in AWS IAM Identity Center (eski ad\u0131yla AWS SSO) kullan\u0131n. M\u00fchendislerin \u00fcretim ortam\u0131na do\u011frudan eri\u015fmesi gereken acil durumlarda (break-glass senaryolar\u0131), saatlik ge\u00e7erlili\u011fi olan roller tan\u0131mlay\u0131n. Statik ve kal\u0131c\u0131 eri\u015fim yetkilerini hem geli\u015ftiricilerden hem de sunuculardan tamamen temizleyin.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular<\/h2>\n
Parameter Store ve Secrets Manager ayn\u0131 anda kullan\u0131labilir mi?<\/h3>\n
Evet, hibrit bir model kurmak sekt\u00f6rde olduk\u00e7a yayg\u0131nd\u0131r. Uygulaman\u0131z\u0131n kritik olmayan ayarlar\u0131n\u0131 (\u00f6rne\u011fin kuyruk URL adresleri, \u00f6zellik a\u00e7ma\/kapama bayraklar\u0131) maliyetsiz olan SSM Parameter Store \u00fczerinde tutabilir; veritaban\u0131 \u015fifreleri ve \u00f6deme anahtarlar\u0131n\u0131 ise Secrets Manager \u00fczerinde bar\u0131nd\u0131rabilirsiniz.<\/p>\n
\u00d6nbelle\u011fe (Cache) al\u0131nan \u015fifreler uygulama \u00e7al\u0131\u015f\u0131rken de\u011fi\u015firse ne olur?<\/h3>\n
E\u011fer uygulaman\u0131z \u015fifreleri s\u00fcresiz olarak bellekte tutarsa, \u015fifre de\u011fi\u015fti\u011finde veritaban\u0131 ba\u011flant\u0131s\u0131 kopar. Bu sorunu \u00f6nlemek i\u00e7in kodunuzda \u015fifreyi belirli aral\u0131klarla (\u00f6rne\u011fin 5-15 dakika) tazeleyen bir \u00f6nbellek mekanizmas\u0131 kurmal\u0131 veya veritaban\u0131 ba\u011flant\u0131 hatas\u0131 ald\u0131\u011f\u0131nda \u00f6nbelle\u011fi temizleyip s\u0131rr\u0131 AWS'den yeniden \u00e7eken bir hata yakalama (retry) mant\u0131\u011f\u0131 olu\u015fturmal\u0131s\u0131n\u0131z.<\/p>\n
Docker konteynerlerinde bu de\u011ferleri ortam de\u011fi\u015fkeni olarak vermek yanl\u0131\u015f m\u0131d\u0131r?<\/h3>\n
Konteyner aya\u011fa kalkarken s\u0131rlar\u0131 do\u011frudan docker run -e PASSWORD=...<\/code> \u015feklinde vermek bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r. Bunun yerine AWS ECS veya Kubernetes kullan\u0131yorsan\u0131z, orkestrasyon arac\u0131n\u0131n Secrets Manager entegrasyonlar\u0131n\u0131 kullanarak de\u011ferleri g\u00fcvenli bellek alanlar\u0131na enjekte etmesini sa\u011flamal\u0131s\u0131n\u0131z.<\/p>\n
AWS Secrets Manager \u00e7ok pahal\u0131 bir servis midir?<\/h3>\n
K\u00fc\u00e7\u00fck projeler i\u00e7in ayda birka\u00e7 dolar \u00f6nemsiz bir maliyettir. Ancak y\u00fczlerce mikroservisiniz ve binlerce gizli anahtar\u0131n\u0131z varsa maliyet katlanabilir. Bu t\u00fcr b\u00fcy\u00fck \u00f6l\u00e7ekli senaryolarda, birden fazla konfig\u00fcrasyonu tek bir JSON nesnesi i\u00e7inde birle\u015ftirerek saklamak, anahtar ba\u015f\u0131na \u00f6denen sabit \u00fccreti ciddi oranda azalt\u0131r.<\/p>\n
#AWS #DevOps #SiberGuvenlik #BulutBilisim #YazilimMimarisi<\/p>\n
\u00d6rnek kod:<\/strong> github.com\/fatihsoysalcom\/secure-credential-access-environment-variables<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"AWS \u00fczerinde kimlik bilgisi y\u00f6netimi ile hassas verilerinizi g\u00fcvenceye al\u0131n, kaynak kod i\u00e7erisine \u015fifre g\u00f6mme riskini profesyonel y\u00f6ntemlerle tamamen ortadan kald\u0131r\u0131n.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1406],"tags":[],"class_list":{"0":"post-45150","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-aws","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nAWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin\" \/>\n<meta property=\"og:description\" content=\"AWS \u00fczerinde kimlik bilgisi y\u00f6netimi ile hassas verilerinizi g\u00fcvenceye al\u0131n, kaynak kod i\u00e7erisine \u015fifre g\u00f6mme riskini profesyonel y\u00f6ntemlerle tamamen ortadan kald\u0131r\u0131n.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-12T06:07:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-12T06:08:16+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin\",\"datePublished\":\"2026-10-12T06:07:51+00:00\",\"dateModified\":\"2026-10-12T06:08:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\"},\"wordCount\":2399,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"AWS\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\",\"name\":\"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-10-12T06:07:51+00:00\",\"dateModified\":\"2026-10-12T06:08:16+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/","og_locale":"tr_TR","og_type":"article","og_title":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin","og_description":"AWS \u00fczerinde kimlik bilgisi y\u00f6netimi ile hassas verilerinizi g\u00fcvenceye al\u0131n, kaynak kod i\u00e7erisine \u015fifre g\u00f6mme riskini profesyonel y\u00f6ntemlerle tamamen ortadan kald\u0131r\u0131n.","og_url":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-10-12T06:07:51+00:00","article_modified_time":"2026-10-12T06:08:16+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"13 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin","datePublished":"2026-10-12T06:07:51+00:00","dateModified":"2026-10-12T06:08:16+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/"},"wordCount":2399,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["AWS"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/","url":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/","name":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding'e Son Verin - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-10-12T06:07:51+00:00","dateModified":"2026-10-12T06:08:16+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/aws-kimlik-bilgisi-yonetimi-hardcodinge-son-verin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS Kimlik Bilgisi Y\u00f6netimi: Hardcoding’e Son Verin"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/45150","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=45150"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/45150\/revisions"}],"predecessor-version":[{"id":45151,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/45150\/revisions\/45151"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=45150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=45150"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=45150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}