🔒Pinterest's RPP Ensures Least-Privilege Access in Terraform Workspaces
Pinterest's secret sauce for securing multi-repo Terraform
TL;DR
Pinterest unveiled the Resource Provisioner Pipeline, a Terraform execution engine ensuring least privilege and dual-control reviews. It handles thousands of cloud resources across many workspaces without waiting for consolidation.
Pinterest has developed the Resource Provisioner Pipeline (RPP), an internal Terraform execution engine that enforces least-privilege access and requires dual-control reviews. This system is crucial as it manages numerous Terraform workspaces controlling thousands of cloud resources, including IAM policies, VPCs, load balancers, S3 buckets, and Kubernetes clusters. RPP was built to secure the multi-repo reality without waiting for a consolidation into a mono-repo. It activates on GitHub pull request events and runs as central composite GitHub Actions, splitting PRs into separate plan/apply runs per workspace.
Key Points
RPP handles thousands of cloud resources across many Terraform workspaces, including IAM policies and VPCs.
It requires dual-control reviews with human code review approval and clear PR comments to trigger applies.
The pipeline uses standard OIDC-based role chaining and workspace-to-role mapping for security.
Before down-scoping, RPP checks that the Terraform code path matches specific S3 backend and KMS key.
RPP runs `terraform fmt`, `plan`, and apply changes after a clear human comment on the PR.
Why It Matters
If you're managing complex cloud infrastructure with Terraform across multiple repositories, Pinterest's RPP offers a robust solution for securing least-privilege access. It ensures dual-control reviews and centralizes execution without waiting for consolidation into a mono-repo.
Frequently Asked Questions
Why does this matter?
If you're managing complex cloud infrastructure with Terraform across multiple repositories, Pinterest's RPP offers a robust solution for securing least-privilege access. It ensures dual-control reviews and centralizes execution without waiting for consolidation into a mono-repo.
What happened?
Pinterest unveiled the Resource Provisioner Pipeline, a Terraform execution engine ensuring least privilege and dual-control reviews. It handles thousands of cloud resources across many workspaces without waiting for consolidation.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 2,764 builders reading daily.