Securing Infrastructure at Scale: Pinterest’s Resource Provisioner Pipeline (RPP)
A model for secure and scalable infrastructure management in distributed systems.
1Introduction
Pinterest developed the Resource Provisioner Pipeline (RPP), a specialized Terraform engine to manage large-scale, distributed infrastructure securely. This system aims to handle both critical and non-critical infrastructure changes safely.
2Multi-Repository Structure
Pinterest's Terraform code is distributed across multiple repositories managed by different teams. RPP securely supports this multi-repo structure, acting as a bridge during the transition to a mono-repository.
3Centralized Execution Model
RPP manages all code changes centrally. Workflows triggered via GitHub Actions execute independent plans and applies for each workspace.
4Dual Control Mechanism
To prevent accidental or malicious configurations, RPP subjects all code changes to dual control. Each change must be approved by a code reviewer in the relevant repository.
5Principle of Least Privilege
RPP enforces the principle of least privilege through secure role chaining. Each workspace is mapped to a specific code path and role, ensuring changes are made in the correct environment.
6Strict Backend Validation
RPP validates S3 state backend blocks and KMS keys for each workspace, preventing misconfigurations. This step is crucial for maintaining infrastructure integrity.
7Conclusion and Importance
RPP provides secure and scalable infrastructure management for Pinterest's global AWS operations. This system can serve as a model for teams facing similar challenges.