Pinterest Introduces Resource Provisioner Pipeline for Secure AWS Infrastructure Management

Pinterest's New Terraform Engine

Pinterest has introduced its Resource Provisioner Pipeline (RPP), a custom Terraform execution engine designed to manage its AWS infrastructure. This system is crucial for Pinterest's operations, as it handles numerous Terraform workspaces that control thousands of cloud resources, including IAM policies, VPCs, load balancers, S3 buckets, and Kubernetes clusters.

Addressing Security in a Multi-Repo Environment

Pinterest's Terraform code is distributed across many repositories, each owned by a different team. Granting broad permissions to a CI/CD system in such an environment poses significant risks, including accidental misconfigurations and malicious actions. RPP was developed to secure this multi-repository setup without waiting for a full consolidation into a mono-repo, acting as a bridge to manage current infrastructure securely.

How RPP Works

RPP activates on GitHub pull request events and runs as a central set of composite GitHub Actions. It splits a single pull request into separate plan and apply runs for each affected workspace. The execution uses a chained-role model, where a workflow first assumes a limited RPPActionsRole validated via OIDC. This role reads a configuration file that maps each workspace to its allowed repository, working directory, owning team, and execution IAM role. Before down-scoping, RPP verifies that the Terraform code path matches the specific S3 backend and KMS key for that workspace to prevent state file linking errors. After these checks, the pipeline assumes the workspace-specific team role to run `terraform fmt`, `plan`, and, after human approval on the PR, `apply`. All code changes require sign-off from an approved reviewer.

Benefits of Centralized Control

Pinterest states that this model provides a single control point for infrastructure fixes. This means systemic issues, such as a weak CI runner shell, can be addressed in one central location rather than across hundreds of individual repositories. The centralized composite actions also enable consistent PR-triggered checks, including static analysis with custom Semgrep rules, AI-assisted scanning, and optional LocalStack-based dry runs.