Securing Infrastructure at Scale: Introducing Pinterest's Resource Provisioner Pipeline (RPP)

Pinterest built Resource Provisioner Pipeline (RPP) in-house to securely manage AWS infrastructure across a distributed multi-repository environment. It currently manages hundreds of Terraform workspaces and tens of thousands of resources (IAM policies, VPCs, S3, Kubernetes clusters, and more).

The core of RPP is a centralized execution model. Pipelines are automatically triggered on PR events, and when a single PR affects multiple workspaces, each workspace runs independently. Dual Controls, requiring code reviewer approval for every change, are applied to all changes.

The principle of least privilege is implemented through secure Role-Chaining.

• Step 1: GitHub OIDC token verification allows only pre-approved workflows to assume the RPPActionsRole
• Step 2: A central configuration file is consulted to look up the allowed repositories, directories, and execution roles mapped to each workspace
• Step 3: Terraform execution permission is granted only via the IAM role dedicated to that specific workspace

This structure eliminates the risk of the CI/CD system holding excessive cloud permissions and ensures consistent security governance even in a multi-repo environment.