KOEN
Read Original
#DevOps

Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)

Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)
01

Summary

Securing Infrastructure at Scale: Inside Pinterest's Proprietary Terraform Execution Engine

How Pinterest utilizes GitHub Actions and AWS role-chaining to enforce strict least-privilege security guardrails.

This article explores Pinterest's Resource Provisioner Pipeline (RPP), an in-house Terraform engine designed to safely execute IaC changes across multiple decentralized repositories. By leveraging GitHub OIDC and dynamic role-chaining, the pipeline down-scopes permissions to the absolute minimum required for each specific workspace. Learn how Pinterest balances developer velocity with enterprise-grade cloud security.

  • 01Enforces strict authentication by validating GitHub OIDC tokens before assuming the centralized RPPActionsRole.
  • 02Validates configuration paths against S3 state backends to prevent developers from accidentally overwriting states.
  • 03Down-scopes active IAM permissions by mapping specific workspaces to localized, single-purpose team roles.
  • 04Integrates automated security scanning using Semgrep and local AWS behavior mocking with LocalStack in the pipeline.

RECOMMENDATION

Highly recommended for DevOps and Infrastructure Security engineers looking to add robust access controls, OIDC-based least-privilege architectures, and rigorous testing to GitHub-driven Terraform setups.

The Problem

Managing Infrastructure as Code (IaC) across a distributed, multi-repository architecture introduces high security risks, particularly when CI/CD pipelines hold overly broad administrative permissions.

The Solution

Pinterest built the Resource Provisioner Pipeline (RPP), a centralized GitHub Actions-based Terraform execution engine that secures deployments using OIDC, strict path-to-workspace mapping, and down-scoped role chaining.

The Result

The RPP successfully manages hundreds of workspaces and tens of thousands of cloud resources, establishing compliant guardrails, automated Semgrep security scans, and unified deployment auditing.

Trade-off

While serving as a critical bridge for legacy multi-repository architectures, the system requires continuous maintenance of a centralized mapping configuration until a full monorepo migration is completed.

03

Key Concepts

Concept · 01

Role Chaining

An IAM security practice where one identity assumes another role to sequentially transition or restrict its access rights. This pattern is essential for implementing least privilege by dynamically down-scoping permissions during execution.

  • Used to transition from a centralized RPPActionsRole to a specific, highly-restricted team execution role after path validation.
Concept · 02

OIDC Integration

A federation protocol allowing external workflows to authenticate with cloud providers without long-lived, static access keys. This significantly reduces credential leakage vectors in automated environments.

  • Utilized to validate the authenticity of calling GitHub workflows before allowing them to assume AWS IAM roles.
Concept · 03

Dual Controls

A security policy requiring multiple authorized parties to approve sensitive changes, mitigating risks associated with accidental errors or insider threats.

  • Enforced by demanding peer review approval on Pull Requests and explicit trigger comments before running terraform apply.