Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)

This post details the first iteration of Pinterest's Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine. It elaborates on RPP's architecture for managing infrastructure as code (IaC) in a multi-repository environment. Key technical contributions include: a centralized execution model using GitHub Actions and OIDC for secure role-chaining (RPPActionsRole to down-scoped team IAM roles); a workspace-path-role mapping process enforced by a source-of-truth configuration file; strict backend validation to ensure correct S3 state backend and KMS key usage; and a PR-driven workflow for plan, review, and apply execution with dual controls. It also highlights the integration of vulnerability scanning (Semgrep, Helix/AI) and pre-deployment local testing (LocalStack). The post emphasizes benefits like unified auditing, systemic patching, path-to-workspace enforcement, resource metrics tracking, and policy enforcement.