Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)

Summary

Managing Infrastructure as Code across distributed repositories presents significant security and operational challenges. Pinterest developed the Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine, to securely deploy and manage AWS infrastructure across hundreds of workspaces. The pipeline utilizes centralized GitHub composite actions triggered by pull request events and enforces dual human approvals. To maintain least privilege, RPP uses GitHub OpenID Connect authentication to assume a central identity before validating repository paths and down-scoping to specific team execution roles. Automated checks include backend state validation, linting, plan generation, Semgrep static analysis, and optional LocalStack testing before deliberate comment-driven deployments execute.

Takeaways

1. 1

   RPP enforces least privilege using OIDC token validation to assume a central RPPActionsRole before down-scoping to localized team IAM roles mapped to explicit repository paths.

2. 2

   Workspace validation verifies that the execution path strictly matches mapped S3 state backend blocks and KMS keys, instantly failing the build on discrepancies.

3. 3

   Centralized composite GitHub Actions allow Pinterest to deploy instant systemic patches and enforce unified auditing across hundreds of workspaces without editing individual repositories.