How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Pinterest's Terraform pipeline for AWS security is directly actionable for cloud infrastructure engineers.
Pinterest built the Resource Provisioner Pipeline (RPP), a centralized Terraform execution engine that enforces least-privilege access and dual-control reviews across its multi-repo AWS infrastructure. RPP uses OIDC-based role chaining on GitHub Actions: a central RPPActionsRole reads a source-of-truth config mapping workspaces to repos, teams, and IAM roles, then validates that Terraform code paths match the correct S3 backend and KMS key before assuming a down-scoped team role for plan/apply. The pipeline also runs static analysis with Semgrep, AI-assisted scanning, and optional LocalStack dry runs, providing a single control point for fixes without requiring a full mono-repo migration.