Securing Infrastructure at Scale: Introducing Pinterest's Resource Provisioner Pipeline

Back to Devoured - July 27, 2026

DEVOURED

Securing Infrastructure at Scale: Introducing Pinterest's Resource Provisioner Pipeline

DevOps infrastructuresecurity Medium

Pinterest built a centralized Resource Provisioner Pipeline to manage thousands of AWS resources while maintaining team-level ownership and security standards.

What: Pinterest's pipeline centralizes Terraform execution across multiple repositories using GitHub OIDC and strict repository-to-workspace mapping, allowing for global auditing and security scanning while keeping teams in charge of their own infra definitions.

Why it matters: As organizations scale, managing infrastructure-as-code often results in either total chaos (decentralized) or total bottlenecking (centralized). This architecture provides a middle ground via automated orchestration.

Deep dive

Uses Terraform to manage tens of thousands of AWS resources.
Implements GitHub OIDC for secure identity management and least-privilege access.
Enforces mandatory peer reviews and explicit 'apply' commands via a centralized pipeline.
Centralization enables uniform security scanning across all team-managed infra code.
Provides a structured path for company-wide security updates without breaking individual team workflows.

Decoder

OIDC (OpenID Connect): An authentication layer on top of OAuth 2.0 that allows applications to verify the identity of an end-user or machine based on authentication performed by an authorization server.
Least Privilege: The security practice of granting users or machines only the minimum levels of access—or permissions—needed to perform their job functions.

Original article

Pinterest's Resource Provisioner Pipeline centralizes Terraform execution across hundreds of workspaces and tens of thousands of AWS resources while preserving team ownership in a multi-repository environment. It enforces least privilege through GitHub OIDC, strict repository-path-to-workspace mappings, backend validation, down-scoped IAM roles, mandatory review, and explicit apply commands, while centralization enables consistent auditing, security scanning, and company-wide fixes.

Explore all 65 articles in today's digest