Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)

This post details the first iteration of Pinterest's Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine. It introduces the centralized execution model using GitHub Actions, workspace splitting for PRs affecting multiple workspaces, and dual controls for code changes. A deep dive into enforcing least privilege via secure role-chaining is provided, explaining the workflow from assuming the RPPActionsRole (with OIDC validation) to workspace property determination using a source-of-truth configuration file, strict backend validation, and down-scoping to a team execution role. The plan, review, and apply execution process is outlined, including linting, planning with PR comments, and deliberate application via explicit comments. The benefits of centralization, such as unified auditing, instant systemic patches, path-to-workspace enforcement, resource metrics, and policy/tag enforcement, are highlighted. The post also mentions the integration of vulnerability scanning (Semgrep, Helix/AI) and pre-deployment local testing with LocalStack.