How to setup Remote Support for Self Hosted Data Planes

Last updated: January 16, 2026

Prerequisites

Plans: Enterprise

Deployments: Hybrid

Use case

In order to allow the Braintrust team to assist with troubleshooting your self hosted Data Plane.

Features used

There are two optional debugging access methods available:

  • Log Sharing Access: allows the Braintrust team to view CloudWatch logs from your Braintrust deployment in your AWS account. It creates a restricted IAM Role in your account that you can share with Braintrust.

  • SSH Bastion Access: provides Braintrust staff with direct shell access to debug issues within your VPC. It uses EC2 Instance Connect and does not directly expose the Bastion to the public internet. Only the restricted Braintrust IAM Role will be able to connect.

Steps

How to Enable Log Sharing Access

Step 1: Set the parameter enable_braintrust_support_logs_access in your module to true

Step 2: Run terraform apply

Step 3: Share the new IAM Role ARN found in the terraform outputs (terraform output) with Braintrust

This creates a highly restricted IAM Role that:

  • Can be assumed by the Braintrust AWS account

  • Has limited permissions to only view logs under specific CloudWatch Log Groups:

    /braintrust/${AWS::StackName}/*

    /aws/lambda/${AWS::StackName}*

How to Enable SSH Bastion Access

Step 1: Set the parameter enable_braintrust_support_shell_access in your module to true

Step 2: Run terraform apply

Step 3: Share both the IAM Role ARN and EC2 Instance ID from the terraform outputs (terraform output) with Braintrust

This creates:

  • An IAM Role that allows Braintrust to use EC2 Instance Connect

  • An EC2 bastion host with a private IP and no SSH keys authorized by default.

  • An EC2 Instance Connect Endpoint that allows connectivity to the Bastion without making it public

Bastion Host Permissions

The bastion host has restricted access:

  • Can only connect to hosts within the Braintrust VPC.

  • Has an Instance profile that is limited to API calls to Braintrust resources only.

  • Can describe all EC2 instances and Auto Scaling Groups in the entire account. (This can’t be scoped down due to AWS IAM limitations on Describe calls)