# Securing Infrastructure at Scale: Pinterest’s Resource Provisioner Pipeline (RPP) A model for secure and scalable infrastructure management in distributed systems. - **Source:** [Pinterest Engineering](https://medium.com/pinterest-engineering) - **Published:** 2026-07-22 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3fa635fc-64b5-4891-b22a-7cc11dbc0180 ## Introduction Pinterest developed the Resource Provisioner Pipeline (RPP), a specialized Terraform engine to manage large-scale, distributed infrastructure securely. This system aims to handle both critical and non-critical infrastructure changes safely. ## Multi-Repository Structure Pinterest's Terraform code is distributed across multiple repositories managed by different teams. RPP securely supports this multi-repo structure, acting as a bridge during the transition to a mono-repository. ## Centralized Execution Model RPP manages all code changes centrally. Workflows triggered via GitHub Actions execute independent plans and applies for each workspace. ## Dual Control Mechanism To prevent accidental or malicious configurations, RPP subjects all code changes to dual control. Each change must be approved by a code reviewer in the relevant repository. ## Principle of Least Privilege RPP enforces the principle of least privilege through secure role chaining. Each workspace is mapped to a specific code path and role, ensuring changes are made in the correct environment. ## Strict Backend Validation RPP validates S3 state backend blocks and KMS keys for each workspace, preventing misconfigurations. This step is crucial for maintaining infrastructure integrity. ## Conclusion and Importance RPP provides secure and scalable infrastructure management for Pinterest's global AWS operations. This system can serve as a model for teams facing similar challenges. ## Sources covering this story - https://medium.com/pinterest-engineering/securing-infrastructure-at-scale-introducing-pinterests-resource-provisioner-pipeline-rpp-8283bb12cbe5?source=rss----4c5a5f6279b6---4 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._