Pinterest engineering shares the design of their Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine built to securely manage infrastructure changes at scale across a multi-repository architecture. RPP enforces least privilege through a secure AWS IAM role-chaining mechanism tied to specific workspace paths, uses GitHub OIDC for identity verification, and requires dual-control PR approvals before any apply. The pipeline includes strict backend state validation to prevent misconfiguration, workspace-scoped execution roles, automated Semgrep vulnerability scanning, and centralized composite GitHub Actions for unified auditing and instant patching across all infrastructure repositories. The system currently governs hundreds of Terraform workspaces managing tens of thousands of AWS resources including IAM policies, VPCs, S3 buckets, and Kubernetes clusters.
