Security at Bulutistan Cloud
How Bulutistan Cloud protects access and data in its regions, such as Istanbul 1, and which security controls you use to protect your own workloads.
Bulutistan Cloud runs in the regions that your platform offers, such as Istanbul 1, which runs in Bulutistan data centers in Türkiye. The platform authenticates and authorizes every API request, keeps each tenant's resources and records apart, and gives you controls for access, data protection, and audit. Security is shared: Bulutistan secures the platform, and you secure what you build and keep on it.
Key features
- Resources in their project's region. Your resources run in the region of their project, for example Istanbul 1 in Türkiye. See Data residency.
- Authentication on every request. The API gateway identifies the caller and checks access to the project before a request reaches any service. See REST API overview.
- Two-factor authentication. Members sign in with an authenticator app, and an owner can require it for existing members with Enforce 2FA for all members. See Enforce two-factor authentication.
- Least-privilege access. Built-in and custom roles that you grant on a subscription or a project. See Users, roles, and scopes.
- Restricted API credentials. API tokens with scopes, expiry dates, and IP allowlists, and secrets that are shown once. See Authenticate with API tokens.
- Encrypted connections. HTTPS to the console and the API, signed webhook notifications, and IPsec tunnels to your own network. See Encryption.
- Activity records. The operations listed in Audit and activity records, such as creating and deleting resources in the console and through the REST API, are recorded with who started them, when, with what result, and, when it's known, the address the request came from.
- Protection against data loss. Deletion protection for instances and volumes, and scheduled backups with Backup Center. See Security best practices.
How it works
Every API request passes an API gateway that identifies the caller and checks the caller's access to the project before any service handles the request. Bulutistan secures the platform and keeps customers apart, and you secure what you run on it: the software inside your instances, your network rules, who has access, and how you protect your data. For what each side does, see Shared responsibility.
Use cases
- Run workloads in Türkiye. Use a subscription in a region in Türkiye, such as Istanbul 1. The resources of its projects, such as instances, volumes, and buckets, are in that region.
- Control access. Give each person and each automation the narrowest role it needs, and require two-factor authentication.
- Review operations. Find out who created or deleted a resource, when, and from which address.
- Recover from mistakes. Prevent accidental deletion, and restore volumes from backups.
Billing
Protecting data uses billed resources. Backup Center backups are billed per GB-month for the storage that they occupy, for as long as they exist, and volumes are billed while they exist, attached or not. For all billing dimensions, see How billing works.
Limits
- Encryption at rest for volumes and images is available only where the region supports it. See Encryption.
- Activity records are kept for a limited time, and only the operations listed in Audit and activity records are recorded.
- API tokens can't call some operations. See What an API token can't call.
Related services
- Identity & Access Management: members, roles, service accounts, two-factor authentication, and sessions.
- Activity Log: the record of operations in your projects.
- Security Groups: rules that filter the traffic of your instances.
- Backup Center: scheduled volume backups.