Skip to content

[INF-178] Fetch Brainstore license and Datadog keys from Secrets Manager #307

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Erik Weathers (erikdw) wants to merge 7 commits into from
Open

[INF-178] Fetch Brainstore license and Datadog keys from Secrets Manager #307

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d5bdbda
[INF-178] Fetch Brainstore license and Datadog keys from Secrets Manager
erikdw Jul 30, 2026
cd858fa
[INF-178] Fix gateway license secret plan-time count and rotation
erikdw Jul 30, 2026
9e140ca
[INF-178] Version-pin ECS Datadog API key secret references
erikdw Jul 30, 2026
ddb2c1c
[INF-178] Fix null-safe license key detection and ECS secret ARN format
erikdw Jul 31, 2026
c58b1ae
[INF-178] Validate external-EKS example with license key unset in CI
erikdw Jul 31, 2026
0a03eeb
[INF-178] Order ECS/Brainstore secret IAM before task rollouts
erikdw Jul 31, 2026
4b933e3
[INF-178] Clarify that validate does not catch coalesce-on-null
erikdw Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion examples/braintrust-data-plane-external-eks-quarantine/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,12 @@ module "braintrust-data-plane" {
# for forward compatibility.
allowed_org_ids = ""

# Brainstore license key (required)
# Optional in external-EKS mode (Brainstore EC2 is not created). Defaults to
# null; only needed if you also enable create_ai_gateway (gateway telemetry).
# CI runs `validate` on this example with the key unset (null default),
# exercising null-default wiring for syntax/type/reference errors. Note:
# `validate` does NOT catch eval-time errors (e.g. coalesce-on-null) — a
# `terraform test` (command=plan) guard for that is tracked separately.
brainstore_license_key = var.brainstore_license_key

# Enable external EKS deployment mode
Expand Down
6 changes: 3 additions & 3 deletions examples/braintrust-data-plane-external-eks-quarantine/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
variable "brainstore_license_key" {
description = "The license key for the Brainstore instance. You can get this from the Braintrust UI in Settings > Data Plane."
description = "Optional. Only needed if you enable create_ai_gateway in external-EKS mode (Brainstore EC2 is not created)."
type = string
# Note: For actual deployments, set this via environment variable or terraform.tfvars
# For testing: TF_VAR_brainstore_license_key=dummy terraform validate
default = null
sensitive = true
}
1 change: 1 addition & 0 deletions examples/braintrust-data-plane-sandbox/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
variable "brainstore_license_key" {
description = "The license key for the Brainstore instance. You can get this from the Braintrust UI in Settings > Data Plane."
type = string
sensitive = true
validation {
condition = var.brainstore_license_key != null && var.brainstore_license_key != ""
error_message = "The brainstore_license_key must be set."
Expand Down
1 change: 1 addition & 0 deletions examples/braintrust-data-plane/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
variable "brainstore_license_key" {
description = "The license key for the Brainstore instance. You can get this from the Braintrust UI in Settings > Data Plane."
type = string
sensitive = true
validation {
condition = var.brainstore_license_key != null && var.brainstore_license_key != ""
error_message = "The brainstore_license_key must be set."
Expand Down
166 changes: 97 additions & 69 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,27 @@ locals {
local.main_vpc_private_subnet_3_id
]

create_ecs_api = !var.use_deployment_mode_external_eks
enable_ecs_api = local.create_ecs_api && var.enable_ecs_api
create_ai_gateway = var.create_ai_gateway
enable_ai_gateway = local.create_ai_gateway && var.enable_ai_gateway
enable_internal_observability = trimspace(nonsensitive(var.internal_observability_api_key)) != ""
create_internal_observability_secret = local.enable_internal_observability && (local.create_ecs_api || local.create_ai_gateway)
create_ecs_api = !var.use_deployment_mode_external_eks
enable_ecs_api = local.create_ecs_api && var.enable_ecs_api
create_ai_gateway = var.create_ai_gateway
enable_ai_gateway = local.create_ai_gateway && var.enable_ai_gateway
create_brainstore_ec2 = var.enable_brainstore && !var.use_deployment_mode_external_eks

enable_internal_observability = trimspace(nonsensitive(var.internal_observability_api_key)) != ""
# Secret is shared by API ECS, gateway ECS, and Brainstore EC2 (Datadog agent).
create_internal_observability_secret = local.enable_internal_observability && (
local.create_ecs_api || local.create_ai_gateway || local.create_brainstore_ec2
)
brainstore_license_key_provided = var.brainstore_license_key == null ? false : trimspace(nonsensitive(var.brainstore_license_key)) != ""
# Stored in Secrets Manager so Brainstore user_data / gateway task defs never embed the key.
create_brainstore_license_secret = local.brainstore_license_key_provided && (
local.create_brainstore_ec2 || local.create_ai_gateway
)
brainstore_license_key_secret_arn = local.create_brainstore_license_secret ? aws_secretsmanager_secret.brainstore_license_key[0].arn : ""
brainstore_license_key_secret_version = local.create_brainstore_license_secret ? aws_secretsmanager_secret_version.brainstore_license_key[0].version_id : ""
internal_observability_api_key_secret_arn = local.create_internal_observability_secret ? aws_secretsmanager_secret.internal_observability_api_key[0].arn : ""
internal_observability_api_key_secret_version = local.create_internal_observability_secret ? aws_secretsmanager_secret_version.internal_observability_api_key[0].version_id : ""

ai_proxy_url_ssm_parameter_name = "/braintrust/${var.deployment_name}/ai-proxy-url"
api_ecs_url_ssm_parameter_name = "/braintrust/${var.deployment_name}/ecs-api-url"
brainstore_ai_proxy_url_ssm_parameter_name = local.enable_ecs_api ? local.api_ecs_url_ssm_parameter_name : local.ai_proxy_url_ssm_parameter_name
Expand Down Expand Up @@ -351,34 +366,37 @@ module "gateway_ecs" {
"public.ecr.aws/braintrust/gateway:%s",
var.ai_gateway_version_override != null ? var.ai_gateway_version_override : jsondecode(file("${path.module}/modules/gateway-ecs/VERSIONS.json"))["gateway"]
)
cpu = var.ai_gateway_cpu
memory = var.ai_gateway_memory
cpu_architecture = var.ai_gateway_cpu_architecture
min_capacity = var.ai_gateway_min_capacity
max_capacity = var.ai_gateway_max_capacity
target_cpu_utilization = var.ai_gateway_target_cpu_utilization
target_memory_utilization = var.ai_gateway_target_memory_utilization
log_retention_days = var.ai_gateway_log_retention_days
permissions_boundary_arn = var.permissions_boundary_arn
use_redis_replication_group = var.use_redis_replication_group
redis_host = module.redis.redis_endpoint
redis_port = module.redis.redis_port
redis_security_group_id = module.redis.redis_security_group_id
target_group_arn = module.gateway_alb[0].gateway_target_group_arn
alb_security_group_id = module.gateway_alb[0].gateway_alb_security_group_id
gateway_http_listener_arn = module.gateway_alb[0].gateway_http_listener_arn
extra_env_vars = var.ai_gateway_extra_env_vars
custom_tags = local.all_custom_tags
brainstore_license_key = var.brainstore_license_key
enable_execute_command = var.ai_gateway_enable_execute_command
braintrust_app_url = var.ai_gateway_braintrust_app_url
braintrust_api_url = var.use_deployment_mode_external_eks ? var.braintrust_api_url : module.ingress[0].api_url
unsafe_url_request_mode = var.unsafe_url_request_mode
url_security_dns_servers = var.url_security_dns_servers
url_security_allow_cidrs = var.url_security_allow_cidrs
cpu = var.ai_gateway_cpu
memory = var.ai_gateway_memory
cpu_architecture = var.ai_gateway_cpu_architecture
min_capacity = var.ai_gateway_min_capacity
max_capacity = var.ai_gateway_max_capacity
target_cpu_utilization = var.ai_gateway_target_cpu_utilization
target_memory_utilization = var.ai_gateway_target_memory_utilization
log_retention_days = var.ai_gateway_log_retention_days
permissions_boundary_arn = var.permissions_boundary_arn
use_redis_replication_group = var.use_redis_replication_group
redis_host = module.redis.redis_endpoint
redis_port = module.redis.redis_port
redis_security_group_id = module.redis.redis_security_group_id
target_group_arn = module.gateway_alb[0].gateway_target_group_arn
alb_security_group_id = module.gateway_alb[0].gateway_alb_security_group_id
gateway_http_listener_arn = module.gateway_alb[0].gateway_http_listener_arn
extra_env_vars = var.ai_gateway_extra_env_vars
custom_tags = local.all_custom_tags
brainstore_license_key_enabled = local.create_brainstore_license_secret
brainstore_license_key_secret_arn = local.brainstore_license_key_secret_arn
brainstore_license_key_secret_version = local.brainstore_license_key_secret_version
enable_execute_command = var.ai_gateway_enable_execute_command
braintrust_app_url = var.ai_gateway_braintrust_app_url
braintrust_api_url = var.use_deployment_mode_external_eks ? var.braintrust_api_url : module.ingress[0].api_url
unsafe_url_request_mode = var.unsafe_url_request_mode
url_security_dns_servers = var.url_security_dns_servers
url_security_allow_cidrs = var.url_security_allow_cidrs

# Observability
internal_observability_api_key_secret_arn = local.create_internal_observability_secret ? aws_secretsmanager_secret.internal_observability_api_key[0].arn : ""
internal_observability_api_key_secret_arn = local.internal_observability_api_key_secret_arn
internal_observability_api_key_secret_version = local.internal_observability_api_key_secret_version
internal_observability_enabled = local.create_internal_observability_secret
internal_observability_env_name = var.internal_observability_env_name
internal_observability_region = var.internal_observability_region
Expand All @@ -394,7 +412,9 @@ module "api_ecs" {

# Telemetry
monitoring_telemetry = var.monitoring_telemetry
internal_observability_api_key_secret_arn = local.create_internal_observability_secret ? aws_secretsmanager_secret.internal_observability_api_key[0].arn : ""
internal_observability_api_key_secret_arn = local.internal_observability_api_key_secret_arn
internal_observability_api_key_secret_version = local.internal_observability_api_key_secret_version
internal_observability_enabled = local.create_internal_observability_secret
internal_observability_env_name = var.internal_observability_env_name
internal_observability_region = var.internal_observability_region
internal_observability_trace_disabled_plugins = var.internal_observability_trace_disabled_plugins
Expand Down Expand Up @@ -528,6 +548,8 @@ module "services_common" {
vpc_id = local.main_vpc_id
kms_key_arn = local.kms_key_arn
database_secret_arn = module.database.postgres_database_secret_arn
brainstore_license_key_secret_arn = local.brainstore_license_key_secret_arn
internal_observability_api_key_secret_arn = local.internal_observability_api_key_secret_arn
brainstore_s3_bucket_arn = module.storage.brainstore_bucket_arn
code_bundle_s3_bucket_arn = module.storage.code_bundle_bucket_arn
lambda_responses_s3_bucket_arn = module.storage.lambda_responses_bucket_arn
Expand All @@ -550,42 +572,44 @@ module "services_common" {

module "brainstore" {
source = "./modules/brainstore-ec2"
count = var.enable_brainstore && !var.use_deployment_mode_external_eks ? 1 : 0

deployment_name = var.deployment_name
instance_count = var.brainstore_instance_count
instance_type = var.brainstore_instance_type
instance_key_pair_name = var.brainstore_instance_key_pair_name
port = var.brainstore_port
license_key = var.brainstore_license_key
version_override = var.brainstore_version_override
skip_pg_for_brainstore_objects = var.skip_pg_for_brainstore_objects
brainstore_enable_export = var.brainstore_enable_export
extra_env_vars = var.brainstore_extra_env_vars
extra_env_vars_writer = var.brainstore_extra_env_vars_writer
writer_instance_count = var.brainstore_writer_instance_count
writer_instance_type = var.brainstore_writer_instance_type
fast_reader_instance_count = var.brainstore_fast_reader_instance_count
fast_reader_instance_type = var.brainstore_fast_reader_instance_type
extra_env_vars_fast_reader = var.brainstore_extra_env_vars_fast_reader
cache_file_size_fast_reader = var.brainstore_cache_file_size_fast_reader
ai_proxy_url_ssm_parameter = local.brainstore_ai_proxy_url_ssm_parameter
monitoring_telemetry = var.monitoring_telemetry
database_host = module.database.postgres_database_address
database_port = module.database.postgres_database_port
database_secret_arn = module.database.postgres_database_secret_arn
use_redis_replication_group = var.use_redis_replication_group
redis_host = module.redis.redis_endpoint
redis_port = module.redis.redis_port
service_token_secret_arn = module.services_common.function_tools_secret_arn
brainstore_s3_bucket_arn = module.storage.brainstore_bucket_arn
lambda_responses_s3_bucket_arn = module.storage.lambda_responses_bucket_arn
code_bundle_s3_bucket_arn = module.storage.code_bundle_bucket_arn
internal_observability_api_key = var.internal_observability_api_key
internal_observability_env_name = var.internal_observability_env_name
internal_observability_region = var.internal_observability_region
brainstore_instance_security_group_id = module.services_common.brainstore_instance_security_group_id
vpc_id = local.main_vpc_id
count = local.create_brainstore_ec2 ? 1 : 0

deployment_name = var.deployment_name
instance_count = var.brainstore_instance_count
instance_type = var.brainstore_instance_type
instance_key_pair_name = var.brainstore_instance_key_pair_name
port = var.brainstore_port
license_key_secret_arn = local.brainstore_license_key_secret_arn
license_key_secret_version = local.brainstore_license_key_secret_version
version_override = var.brainstore_version_override
skip_pg_for_brainstore_objects = var.skip_pg_for_brainstore_objects
brainstore_enable_export = var.brainstore_enable_export
extra_env_vars = var.brainstore_extra_env_vars
extra_env_vars_writer = var.brainstore_extra_env_vars_writer
writer_instance_count = var.brainstore_writer_instance_count
writer_instance_type = var.brainstore_writer_instance_type
fast_reader_instance_count = var.brainstore_fast_reader_instance_count
fast_reader_instance_type = var.brainstore_fast_reader_instance_type
extra_env_vars_fast_reader = var.brainstore_extra_env_vars_fast_reader
cache_file_size_fast_reader = var.brainstore_cache_file_size_fast_reader
ai_proxy_url_ssm_parameter = local.brainstore_ai_proxy_url_ssm_parameter
monitoring_telemetry = var.monitoring_telemetry
database_host = module.database.postgres_database_address
database_port = module.database.postgres_database_port
database_secret_arn = module.database.postgres_database_secret_arn
use_redis_replication_group = var.use_redis_replication_group
redis_host = module.redis.redis_endpoint
redis_port = module.redis.redis_port
service_token_secret_arn = module.services_common.function_tools_secret_arn
brainstore_s3_bucket_arn = module.storage.brainstore_bucket_arn
lambda_responses_s3_bucket_arn = module.storage.lambda_responses_bucket_arn
code_bundle_s3_bucket_arn = module.storage.code_bundle_bucket_arn
internal_observability_api_key_secret_arn = local.internal_observability_api_key_secret_arn
internal_observability_api_key_secret_version = local.internal_observability_api_key_secret_version
internal_observability_env_name = var.internal_observability_env_name
internal_observability_region = var.internal_observability_region
brainstore_instance_security_group_id = module.services_common.brainstore_instance_security_group_id
vpc_id = local.main_vpc_id
authorized_security_groups = merge(
merge(
{
Expand Down Expand Up @@ -614,4 +638,8 @@ module "brainstore" {
cache_file_size_reader = var.brainstore_cache_file_size_reader
cache_file_size_writer = var.brainstore_cache_file_size_writer
locks_s3_path = var.brainstore_locks_s3_path

# Ensure brainstore IAM GetSecretValue grants (license / observability / etc.)
# are applied before launch templates that fetch those secrets in user_data.
depends_on = [module.services_common]
}
Loading
Loading