Enable Full ECS mode for the Braintrust API service

[Mike Deeks (mdeeks)]

Note

This PR is primarily for internal Braintrust use in our Prod-EU environment and can be ignored for self-hosted customers. A follow up PR will be added later to full enable the transition for Lambda to ECS for self-hosted deployments.

Summary

This PR introduces a split ECS API architecture and a reversible cutover path from the legacy single api-ecs service to three dedicated services: braintrust-api (interactive traffic), braintrust-api-ingest (logs/OTel), and braintrust-api-background (evals, function invoke, proxy). The legacy service is preserved in legacy-api-ecs.tf so existing deployments can adopt the new infrastructure without changing traffic.

The new root variable enable_full_ecs_api (default false) is the cutover switch:

• false: New services are created and kept warm, but the ALB listener default action forwards 100% of traffic to legacy api-ecs. CloudFront continues using API Gateway + AI Proxy Lambda. No path rules are active.
• true: ALB default action moves to braintrust-api, ingest/background path rules are added, and CloudFront API/proxy origins switch to the ECS ALB via a pre-created VPC origin.

This enables a two-step Prod-EU migration: adopt the release with flags unchanged (additive, no traffic change), then flip enable_full_ecs_api = true for an instant warm cutover. Rollback is the same flag flipped back.

Key changes

API ECS module refactor

• Split monolithic main.tf into braintrust-api*.tf, legacy-api-ecs.tf, alb.tf, and alb-path-routes.tf
• ALB listener uses weighted target groups so all target groups are associated with the load balancer before cutover (required for ECS service creation)
• ALB path routing for ingest (/logs3, /otel/v1/traces) and background paths (evals, function invoke, proxy)
• Event loop utilization autoscaling (EventLoopUtilizationPercent custom metric) on all three new services, replacing memory-based scaling
• Optional HTTPS on the internal ALB via braintrust_api_alb_certificate_arn + braintrust_api_alb_custom_domain
• Independent sizing variables for legacy (api_ecs_*) and new services (braintrust_api_*, braintrust_api_ingest_*, braintrust_api_background_*)

Root module

• Renamed api_ecs_version_override → braintrust_api_version_override; new braintrust_api_* variables for service config
• Brainstore SSM parameter now version-pinned (<name>:<version>) so URL changes (e.g. HTTP → HTTPS) trigger a rolling instance refresh
• In full ECS mode, quarantine proxy URL points at the global AI gateway origin

Ingress

• CloudFront VPC origin for the ECS ALB is always created when the ALB exists; enable_full_ecs_api only changes which origin receives traffic
• API, proxy, and function origins switch from API Gateway/Lambda to the ECS ALB when cut over

Other

• EU-Migration-README.md: Migration runbook for Prod-EU with step-by-step cutover/rollback instructions and troubleshooting for partial-apply taint issues

Migration (Prod-EU)

Step	Action	Traffic impact
1	Apply with enable_full_ecs_api = false (flags unchanged)	None — legacy serves all traffic
2	Set enable_full_ecs_api = true and apply	Cutover to new services + CloudFront → ECS
Rollback	Set enable_full_ecs_api = false and apply	Restore legacy + Lambda routing
3 (future)	Delete legacy-api-ecs.tf	Decommission legacy service