--- title: How Pinterest Secures AWS Infrastructure at Scale with a... description: Pinterest has built the Resource Provisioner Pipeline (RPP), a centralized Terraform execution engine that enforces least-privilege access and dual-control... canonical: https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline | daily.dev og:description: Pinterest has built the Resource Provisioner Pipeline (RPP), a centralized Terraform execution engine that enforces least-privilege access and dual-control... og:url: https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx og:image: https://api.daily.dev/og/posts/F0j3PufkX.png og:image:alt: How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 0 upvotes · 0 comments ## Summary Pinterest has built the Resource Provisioner Pipeline (RPP), a centralized Terraform execution engine that enforces least-privilege access and dual-control reviews across its multi-repo AWS infrastructure. RPP activates on GitHub pull request events, runs as composite GitHub Actions, and uses a chained-role model with OIDC token validation. A source-of-truth config maps each Terraform workspace to its allowed repository, working directory, owning team, and IAM role. A key differentiator is backend-block validation — RPP checks that a workspace's code path matches its specific S3 backend and KMS key before assuming any role, preventing cross-workspace state corruption. The pipeline also integrates static analysis via custom Semgrep rules, AI-assisted scanning, and optional LocalStack dry runs. The post compares RPP to similar approaches at Mercari (GCP keyless credentials with plan/apply role separation) and Slack (decentralized state ownership with plan-then-apply gates), noting RPP's backend and KMS-key validation as a distinctive extra guardrail. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Pinterest's Resource Provisioner Pipeline prevent Terraform workspaces from corrupting each other's state files? It validates that a workspace's Terraform code path matches its specific S3 backend and KMS key before assuming any execution role, catching cases where a developer accidentally links one workspace's directory to another's state file. This backend-block validation happens before the pipeline down-scopes to the workspace-specific IAM role via a chained-role model authenticated through OIDC. _daily.dev surfaces engineering deep dives like this for teams hardening multi-repo Terraform pipelines._ ### What is the chained-role model Pinterest uses for GitHub Actions Terraform automation? A workflow first assumes a central RPPActionsRole, restricted to pre-authorized GitHub workflows via OIDC token validation, which reads a source-of-truth file mapping each workspace to its repository, directory, owning team, and execution IAM role. Only after backend and KMS key checks pass does the pipeline assume the workspace-specific team role to run terraform fmt, plan, and apply. _engineers comparing IAM role-chaining patterns for Terraform can track approaches like this via daily.dev._ ### How do Mercari and Slack secure centralized Terraform pipelines compared to Pinterest? Mercari replaced one broad GCP owner-level service account with keyless Cloud Build credentials, a read-only plan account, and per-service apply accounts using impersonation to limit blast radius. Slack instead decentralized state ownership to individual teams while enforcing a plan-then-apply gate through sandbox and development stages before production changes are applied. _daily.dev helps teams weighing centralized versus decentralized Terraform security models stay informed._ ## Similar posts on daily.dev - [Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline \(RPP\)](https://daily.dev/posts/securing-infrastructure-at-scale-introducing-pinterest-s-resource-provisioner-pipeline-rpp--xlmlpyudm) · Pinterest Engineering · 1 upvotes · 0 comments - [Managing Infrastructure: Everything Is a Pull Request](https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg) · Medium · 0 upvotes · 0 comments - [SCPs, RCPs, and a Kill Switch: A Real AWS Organization Setup](https://daily.dev/posts/scps-rcps-and-a-kill-switch-a-real-aws-organization-setup-hbiabc3ec) · AWS Fundamentals · 2 upvotes · 0 comments - [Why You Should Use AI-Powered Terraform Plan Reviews in Your CI/CD Pipeline](https://daily.dev/posts/why-you-should-use-ai-powered-terraform-plan-reviews-in-your-ci-cd-pipeline-dydofu0cb) · Thomas Thornton · 1 upvotes · 0 comments - [How to Run Terraform in Bitbucket Pipelines](https://daily.dev/posts/how-to-run-terraform-in-bitbucket-pipelines-4tlbvbqih) · Spacelift · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#terraform](https://daily.dev/tags/terraform), [#github-actions](https://daily.dev/tags/github-actions), [#iac](https://daily.dev/tags/iac) [View this post on daily.dev](https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline","url":"https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx"},"datePublished":"2026-08-10T10:06:27.222Z","dateModified":"2026-09-13T18:30:52.439Z","description":"Pinterest has built the Resource Provisioner Pipeline (RPP), a centralized Terraform execution engine that enforces least-privilege access and dual-control...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2be148802679ece91683a56d9a9768e7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2be148802679ece91683a56d9a9768e7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,terraform,github-actions,iac","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-pinterest-secures-aws-infrastructure-at-scale-with-a-centralized-terraform-pipeline-f0j3pufkx#faq","mainEntity":[{"@type":"Question","name":"How does Pinterest's Resource Provisioner Pipeline prevent Terraform workspaces from corrupting each other's state files?","acceptedAnswer":{"@type":"Answer","text":"It validates that a workspace's Terraform code path matches its specific S3 backend and KMS key before assuming any execution role, catching cases where a developer accidentally links one workspace's directory to another's state file. This backend-block validation happens before the pipeline down-scopes to the workspace-specific IAM role via a chained-role model authenticated through OIDC. daily.dev surfaces engineering deep dives like this for teams hardening multi-repo Terraform pipelines."}},{"@type":"Question","name":"What is the chained-role model Pinterest uses for GitHub Actions Terraform automation?","acceptedAnswer":{"@type":"Answer","text":"A workflow first assumes a central RPPActionsRole, restricted to pre-authorized GitHub workflows via OIDC token validation, which reads a source-of-truth file mapping each workspace to its repository, directory, owning team, and execution IAM role. Only after backend and KMS key checks pass does the pipeline assume the workspace-specific team role to run terraform fmt, plan, and apply. engineers comparing IAM role-chaining patterns for Terraform can track approaches like this via daily.dev."}},{"@type":"Question","name":"How do Mercari and Slack secure centralized Terraform pipelines compared to Pinterest?","acceptedAnswer":{"@type":"Answer","text":"Mercari replaced one broad GCP owner-level service account with keyless Cloud Build credentials, a read-only plan account, and per-service apply accounts using impersonation to limit blast radius. Slack instead decentralized state ownership to individual teams while enforcing a plan-then-apply gate through sandbox and development stages before production changes are applied. daily.dev helps teams weighing centralized versus decentralized Terraform security models stay informed."}}]} ```