# Securing Infrastructure at Scale: Introducing Pinterest's Resource Provisioner Pipeline (RPP)

DevFeed: [Securing Infrastructure at Scale: Introducing Pinterest's Resource Provisioner Pipeline (RPP)](<https://devfeed.tech/articles/securing-infrastructure-at-scale-introducing-pinterest-s-resource-provisioner-pipeline-rpp-1234.md>)

Original publisher: [Read original article](<https://medium.com/pinterest-engineering/securing-infrastructure-at-scale-introducing-pinterests-resource-provisioner-pipeline-rpp-8283bb12cbe5?source=rss----4c5a5f6279b6---4>)

Author: Pinterest Engineering

Published: 2026-07-22T16:01:02Z

Content type: article

Language: en

Sources: [Pinterest Engineering Blog - Medium](<https://devfeed.tech/sources/pinterest-engineering-blog-medium.md>)

Topics: [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [Security](<https://devfeed.tech/topics/security.md>), [Provisioning](<https://devfeed.tech/topics/provisioning.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [networking](<https://devfeed.tech/topics/networking.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud-infrastructure](<https://devfeed.tech/tags/cloud-infrastructure.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [iam](<https://devfeed.tech/tags/iam.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [networking](<https://devfeed.tech/tags/networking.md>), [pinterest](<https://devfeed.tech/tags/pinterest.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security](<https://devfeed.tech/tags/security.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

## AI overview

Pinterest's Resource Provisioner Pipeline (RPP) is a proprietary Terraform execution engine for securely managing infrastructure changes across a distributed, multi-repository environment. The article describes its centralized GitHub Actions workflow, compliance controls, role chaining, and management of AWS infrastructure including IAM, networking, S3, compute, and Kubernetes resources.

## Source excerpt

Ammar Ekbote | Senior Software Engineer Chan Kim | Senior Software Engineer Managing Infrastructure as Code (IaC) across a massive organization comes with a unique set of security and logistical challenges, particularly when operating within a distributed, multi-repository architecture. At Pinterest, we designed the Resource Provisioner Pipeline (RPP), our specialized, proprietary Terraform execution engine to safely manage both critical and non-critical infrastructure changes. In this post, we will look under the hood of the first iteration of the RPP system. We will explore how it established compliance and provides robust security guardrails for our global AWS operations by utilizing dual controls, centralized GitHub Actions execution, and a secure role-chaining mechanism. If your engineering team is looking to add strict guardrails to a GitHub workflow-driven Terraform setup, our architecture might serve as a helpful blueprint. What is RPP? RPP delivers a secure, standardized CI/CD workflow for deploying and managing Pinterest's foundational AWS infrastructure. Today, the system manages hundreds of Terraform workspaces that collectively govern tens of thousands of resources. This includes: Security Policies: Managing critical IAM roles and access policies. Networking Infrastructure: Configuring VPCs, Security Groups, Load Balancers, and DNS. Storage & Compute: Provisioning S3 buckets (including access controls) and Kubernetes clusters. The RPP GitHub WorkflowThe Multi-Repo Challenge Pinterest's Terraform code is currently distributed across multiple repositories, each owned and maintained by a completely different team. While we have an ongoing initiative to consolidate these into a unified mono-repository, RPP acts as a vital bridge that securely supports this legacy multi-repo structure. Centralized Execution Model To maintain absolute control over infrastructure states, RPP enforces a centralized execution model for all code changes: Workflow Invocation: The