TechPrufer
Get started
Pinterest
Pinterest logoPinterest · Feature trail

Infrastructure as Code Security and Provisioning

2 posts · Jul 2026

What this trail covers

Pinterest introduced the Resource Provisioner Pipeline (RPP), a specialized Terraform execution engine designed to safely manage infrastructure changes across a distributed, multi-repository architecture. RPP enforces compliance and security guardrails for AWS operations through dual controls, centralized GitHub Actions execution, and secure role-chaining, managing hundreds of Terraform workspaces and tens of thousands of resources including security policies, networking infrastructure, and storage. The system uses OIDC token validation for secure role assumption, a central source-of-truth configuration file for workspace property determination, and strict backend validation to ensure integrity. It also incorporates vulnerability scanning and pre-deployment local testing. The RPP provides unified auditing, enables instant systemic patches for vulnerabilities, enforces path-to-workspace mapping, tracks resource metrics, and sets the stage for automated tag enforcement.

All Pinterest trails
  1. Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)This post details the first iteration of Pinterest's Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine. It elaborates on RPP's architecture for managing infrastructure as code (IaC) in a multi-repository environment. Key technical contributions include: a centralized execution model using GitHub Actions and OIDC for secure role-chaining (RPPActionsRole to down-scoped team IAM roles); a workspace-path-role mapping process enforced by a source-of-truth configuration file; strict backend validation to ensure correct S3 state backend and KMS key usage; and a PR-driven workflow for plan, review, and apply execution with dual controls. It also highlights the integration of vulnerability scanning (Semgrep, Helix/AI) and pre-deployment local testing (LocalStack). The post emphasizes benefits like unified auditing, systemic patching, path-to-workspace enforcement, resource metrics tracking, and policy enforcement.
  2. Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)This post details the first iteration of Pinterest's Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine. It introduces the centralized execution model using GitHub Actions, workspace splitting for PRs affecting multiple workspaces, and dual controls for code changes. A deep dive into enforcing least privilege via secure role-chaining is provided, explaining the workflow from assuming the RPPActionsRole (with OIDC validation) to workspace property determination using a source-of-truth configuration file, strict backend validation, and down-scoping to a team execution role. The plan, review, and apply execution process is outlined, including linting, planning with PR comments, and deliberate application via explicit comments. The benefits of centralization, such as unified auditing, instant systemic patches, path-to-workspace enforcement, resource metrics, and policy/tag enforcement, are highlighted. The post also mentions the integration of vulnerability scanning (Semgrep, Helix/AI) and pre-deployment local testing with LocalStack.