Upgrade to Terraform module v7

​

What changed

• Omitted variables mean ECS and the Gateway. On v6, omitted variables mean Lambda and no Gateway. On v7, the module routes API traffic to ECS, builds the Gateway, routes the API and Loop runtime through it, and points CloudFront /v1/proxy at it. The Gateway adds AWS charges.
• The API Lambda functions are removed in ECS mode. When enable_ecs_api is true, the module deletes the APIHandler and AI Proxy Lambda functions, the AI Proxy function URL, and API Gateway. The quarantine, database migration, catchup ETL, and cron Lambda functions stay. Setting enable_ecs_api back to false creates a new Lambda path with a new function URL hostname. It doesn’t restore the previous functions.
• Quarantine LLM calls use CloudFront when the AI Proxy function is gone. Without quarantine_proxy_url or use_private_gateway_quarantine_proxy, LLM calls from custom scorers and tools go to the deployment’s CloudFront /v1/proxy URL through the quarantine VPC’s NAT gateway. If you restrict CloudFront with a WAF or a source IP allowlist, allow that NAT gateway address. To keep these calls inside your VPCs instead, see Braintrust Gateway.

​

Before you upgrade

1. Build the API ECS services. This is the first apply of the v6 upgrade, with enable_ecs_api left at its v6 default of false, so customer traffic stays on Lambda.
2. Build the Gateway without moving traffic and apply:
   create_ai_gateway             = true
   enable_ai_gateway             = false
   use_private_ai_gateway_origin = false
   enable_ecs_api                = false
   
3. Cut over API traffic and the Gateway together and apply:
   enable_ecs_api                = true
   enable_ai_gateway             = true
   use_private_ai_gateway_origin = true
   
4. Run API requests, ingest traces, and run an eval to confirm traffic flows through ECS and the Gateway.

​

Choose your configuration

​

Private Gateway (default)

enable_ecs_api                = true
create_ai_gateway             = true
enable_ai_gateway             = true
use_private_ai_gateway_origin = true

​

Stay on Lambda

enable_ecs_api                = false
create_ai_gateway             = true
enable_ai_gateway             = false
use_private_ai_gateway_origin = false

enable_ecs_api                = false
create_ai_gateway             = false
enable_ai_gateway             = false
use_private_ai_gateway_origin = false

enable_ecs_api = false

​

Run without the Gateway

create_ai_gateway             = false
enable_ai_gateway             = false
use_private_ai_gateway_origin = false

​

Use the Braintrust-hosted Gateway

use_global_ai_gateway_origin         = true
use_private_ai_gateway_origin        = false
create_ai_gateway                    = false
enable_ai_gateway                    = false
use_private_gateway_quarantine_proxy = false

• create_ai_gateway and enable_ai_gateway: If you omit them, the apply still builds the private Gateway and points the API and Loop runtime at it, because both default to true.
• use_private_gateway_quarantine_proxy: Must be false, because it requires create_ai_gateway.

​

Upgrade steps

module "braintrust-data-plane" {
  source = "github.com/braintrustdata/terraform-aws-braintrust-data-plane?ref=v7.0.0"

  # Variables from "Choose your configuration"

  # ... other configuration ...
}

terraform init -upgrade
terraform plan

terraform apply

​

Roll back to v6

​

Next steps

• Self-hosting releases: review release notes and infrastructure requirements for each data plane version.
• Braintrust Gateway: size the Gateway and route quarantine LLM calls through it.
• Scaling and storage: size the API ECS services.