diff --git a/get_sha.sh b/infra/get_sha.sh
similarity index 100%
rename from get_sha.sh
rename to infra/get_sha.sh
diff --git a/infra/ipa.tf b/infra/ipa.tf
new file mode 100644
index 00000000..c85fc471
--- /dev/null
+++ b/infra/ipa.tf
@@ -0,0 +1,38 @@
+data "aws_route53_zone" "aws-zone" {
+  name = lower("${var.aws_account}.indico.io")
+}
+
+output "ns" {
+  value = data.aws_route53_zone.aws-zone.name_servers
+}
+
+data "external" "git_information" {
+  program = ["sh", "${path.module}/get_sha.sh"]
+}
+
+output "git_sha" {
+  value = data.external.git_information.result.sha
+}
+
+output "git_branch" {
+  value = data.external.git_information.result.branch
+}
+
+
+
+output "smoketest_chart_version" {
+  value = "${path.module}/validate_chart.sh terraform-smoketests 0.1.0-${data.external.git_information.result.branch}-${substr(data.external.git_information.result.sha, 0, 8)}"
+}
+
+output "local_registry_password" {
+  value = htpasswd_password.hash.bcrypt
+}
+
+output "local_registry_username" {
+  value = "local-user"
+}
+
+#output "zerossl" {
+#  sensitive = true
+#  value     = data.vault_kv_secret_v2.zerossl_data.data_json
+#}
diff --git a/infra/locals.tf b/infra/locals.tf
new file mode 100644
index 00000000..7d3ab2a9
--- /dev/null
+++ b/infra/locals.tf
@@ -0,0 +1,5 @@
+# Generating all of our values from the variables
+
+locals {
+  dns_name = var.domain_host == "" ? lower("${var.label}.${var.region}.${var.aws_account}.${var.domain_suffix}") : var.domain_host
+}
diff --git a/infra/main.tf b/infra/main.tf
new file mode 100644
index 00000000..8f2ce1f1
--- /dev/null
+++ b/infra/main.tf
@@ -0,0 +1,375 @@
+module "infra" {
+  source = "../modules/aws/infra"
+
+  providers = {
+    aws             = aws
+    aws.dns-control = aws.dns-control
+    kubernetes      = kubernetes
+  }
+
+  aws_account                 = var.aws_account
+  region                      = var.region
+  label                       = var.label
+  name                        = var.name
+  additional_tags             = var.additional_tags
+  default_tags                = var.default_tags
+  dns_name                    = local.dns_name
+  is_alternate_account_domain = var.is_alternate_account_domain
+  domain_suffix               = var.domain_suffix
+  domain_host                 = var.domain_host
+
+  direct_connect       = var.direct_connect
+  vpc_cidr             = var.vpc_cidr
+  private_subnet_cidrs = var.private_subnet_cidrs
+  public_subnet_cidrs  = var.public_subnet_cidrs
+  subnet_az_zones      = var.subnet_az_zones
+
+  existing_kms_key = var.existing_kms_key
+
+  sqs_sns = var.sqs_sns
+
+  submission_expiry = var.submission_expiry
+  uploads_expiry    = var.uploads_expiry
+  include_rox       = var.include_rox
+  include_pgbackup  = var.include_pgbackup
+
+  include_efs                 = var.include_efs
+  include_fsx                 = var.include_fsx
+  local_registry_enabled      = var.local_registry_enabled
+  storage_capacity            = var.storage_capacity
+  per_unit_storage_throughput = var.per_unit_storage_throughput
+
+  k8s_version           = var.k8s_version
+  node_groups           = var.node_groups
+  az_count              = var.az_count
+  cluster_node_policies = var.cluster_node_policies
+  eks_cluster_iam_role  = var.eks_cluster_iam_role
+  snapshot_id           = var.snapshot_id
+  performance_bucket    = var.performance_bucket
+
+  oidc_enabled = var.oidc_enabled
+
+  enable_waf = var.enable_waf
+
+  eks_addon_version_guardduty = var.eks_addon_version_guardduty
+
+  aws_primary_dns_role_arn = var.aws_primary_dns_role_arn
+
+  monitoring_enabled = var.monitoring_enabled
+}
+
+resource "null_resource" "stage_one" {
+  depends_on = [module.infra]
+
+  provisioner "local-exec" {
+    command = "echo Infrastructure Creation complete, moving on to general charts"
+  }
+}
+
+module "aws_helm" {
+  source = "../modules/aws/helm"
+
+  depends_on = [null_resource.stage_one]
+
+  providers = {
+    kubernetes = kubernetes
+    helm       = helm
+  }
+
+  dns_name                    = local.dns_name
+  k8s_dashboard_chart_version = var.k8s_dashboard_chart_version
+  ipa_repo                    = var.ipa_repo
+  use_static_ssl_certificates = var.use_static_ssl_certificates
+  ssl_static_secret_name      = var.ssl_static_secret_name
+}
+
+module "common_helm" {
+  source = "../modules/common/infra"
+
+  depends_on = [null_resource.stage_one]
+
+  providers = {
+    github  = github
+    helm    = helm
+    kubectl = kubectl
+    vault   = vault
+  }
+
+  aws_account = var.aws_account
+  region      = var.region
+  label       = var.label
+  dns_name    = local.dns_name
+
+  argo_enabled = var.argo_enabled
+  argo_repo    = var.argo_repo
+  argo_branch  = var.argo_branch
+  argo_path    = var.argo_path
+  message      = var.message
+
+  harbor_pull_secret_b64 = var.harbor_pull_secret_b64
+  vault_mount_path       = var.vault_mount_path
+
+  ipa_repo                       = var.ipa_repo
+  infra_crds_version             = var.infra_crds_version
+  infra-crds-values-yaml-b64     = var.crds-values-yaml-b64
+  infra_pre_reqs_version         = var.infra_pre_reqs_version
+  infra-pre-reqs-values-yaml-b64 = var.pre-reqs-values-yaml-b64
+
+  include_efs                 = var.include_efs
+  efs_filesystem_id           = module.infra.efs_filesystem_id
+  include_fsx                 = var.include_fsx
+  security_group_id           = var.include_fsx == true ? tolist(module.infra.fsx-rwx.security_group_ids)[0] : ""
+  fsx_rwx_subnet_id           = module.infra.fsx_storage_fsx_rwx_subnet_id
+  local_registry_enabled      = var.local_registry_enabled
+  use_static_ssl_certificates = var.use_static_ssl_certificates
+  is_alternate_account_domain = var.is_alternate_account_domain
+  aws_primary_dns_role_arn    = var.aws_primary_dns_role_arn
+}
+
+module "local-registry" {
+  source = "../modules/common/local-registry"
+
+  count = var.local_registry_enabled ? 1 : 0
+
+  depends_on = [
+    null_resource.stage_one,
+    module.common_helm
+  ]
+
+  providers = {
+    kubernetes = kubernetes
+    helm       = helm
+  }
+
+  aws_account            = var.aws_account
+  argo_enabled           = var.argo_enabled
+  ipa_repo               = var.ipa_repo
+  local_registry_version = var.local_registry_version
+  dns_name               = local.dns_name
+  efs_filesystem_id      = module.infra.local_registry_efs_filesystem_id
+  htpasswd_bcrypt        = htpasswd_password.hash.bcrypt
+  general_password       = random_password.password.result
+}
+
+module "vault_secrets_operator" {
+  source = "../modules/common/vault-secrets-operator-setup"
+
+  depends_on = [
+    null_resource.stage_one,
+    module.common_helm
+  ]
+
+  providers = {
+    kubernetes = kubernetes
+    helm       = helm
+    vault      = vault
+  }
+
+  vault_address            = var.vault_address
+  account                  = var.aws_account
+  region                   = var.region
+  name                     = var.label
+  kubernetes_host          = module.infra.kube_host
+  external_secrets_version = var.external_secrets_version
+}
+
+module "monitoring" {
+  source = "../modules/common/monitoring"
+
+  count = var.monitoring_enabled ? 1 : 0
+
+  depends_on = [
+    null_resource.stage_one,
+    module.vault_secrets_operator
+  ]
+
+  providers = {
+    helm                   = helm
+    kubectl                = kubectl
+    kubectl.thanos-kubectl = kubectl.thanos-kubectl
+    random                 = random
+  }
+
+  aws_account = var.aws_account
+  region      = var.region
+  label       = var.label
+
+  ipa_repo                        = var.ipa_repo
+  monitoring_version              = var.monitoring_version
+  keda_version                    = var.keda_version
+  opentelemetry-collector_version = var.opentelemetry-collector_version
+
+  thanos_enabled = var.thanos_enabled
+  argo_enabled   = var.argo_enabled
+  vault_address  = var.vault_address
+
+  alerting_enabled                   = var.alerting_enabled
+  alerting_slack_enabled             = var.alerting_slack_enabled
+  alerting_pagerduty_enabled         = var.alerting_pagerduty_enabled
+  alerting_email_enabled             = var.alerting_email_enabled
+  alerting_slack_token               = var.alerting_slack_token
+  alerting_slack_channel             = var.alerting_slack_channel
+  alerting_pagerduty_integration_key = var.alerting_pagerduty_integration_key
+  alerting_email_from                = var.alerting_email_from
+  alerting_email_to                  = var.alerting_email_to
+  alerting_email_username            = var.alerting_email_username
+  alerting_email_password            = var.alerting_email_password
+
+  use_static_ssl_certificates = var.use_static_ssl_certificates
+  ssl_static_secret_name      = var.ssl_static_secret_name
+
+  dns_name = local.dns_name
+}
+
+resource "null_resource" "stage_two" {
+  depends_on = [
+    module.aws_helm,
+    module.common_helm,
+    module.local-registry,
+    module.vault_secrets_operator,
+    module.monitoring,
+  ]
+
+  provisioner "local-exec" {
+    command = "echo General Indico Cluster configuration complete, moving on to product deployment"
+  }
+}
+
+module "argo_registration" {
+  count = var.argo_enabled == true ? 1 : 0
+
+  depends_on = [
+    null_resource.stage_two,
+  ]
+
+  providers = {
+    kubernetes = kubernetes,
+    argocd     = argocd
+  }
+
+  source                       = "app.terraform.io/indico/indico-argo-registration/mod"
+  version                      = "1.2.1"
+  cluster_name                 = var.label
+  region                       = var.region
+  argo_password                = var.argo_password
+  argo_username                = var.argo_username
+  argo_namespace               = var.argo_namespace
+  argo_host                    = var.argo_host
+  account                      = var.aws_account
+  cloud_provider               = "aws"
+  argo_github_team_admin_group = var.argo_github_team_owner
+  endpoint                     = module.infra.kube_host
+  ca_data                      = base64decode(module.infra.kube_ca_certificate)
+  indico_dev_cluster           = var.aws_account == "Indico-Dev"
+}
+
+module "intake" {
+  source = "../modules/common/intake"
+
+  depends_on = [
+    null_resource.stage_two,
+    module.argo_registration
+  ]
+
+  providers = {
+    argocd  = argocd
+    github  = github
+    helm    = helm
+    kubectl = kubectl
+    time    = time
+  }
+
+  dns_name    = local.dns_name
+  aws_account = var.aws_account
+  region      = var.region
+  label       = var.label
+
+  use_static_ssl_certificates = var.use_static_ssl_certificates
+  ssl_static_secret_name      = var.ssl_static_secret_name
+  is_alternate_account_domain = var.is_alternate_account_domain
+  aws_primary_dns_role_arn    = var.aws_primary_dns_role_arn
+
+  ipa_repo                 = var.ipa_repo
+  argo_enabled             = var.argo_enabled
+  argo_namespace           = var.argo_namespace
+  argo_repo                = var.argo_repo
+  argo_branch              = var.argo_branch
+  argo_path                = var.argo_path
+  message                  = var.message
+  ipa_pre_reqs_version     = var.ipa_pre_reqs_version
+  pre-reqs-values-yaml-b64 = var.pre-reqs-values-yaml-b64
+  ipa_version              = var.ipa_version
+  k8s_version              = var.k8s_version
+  ipa_values               = var.ipa_values
+  az_count                 = var.az_count
+  key_arn                  = module.infra.kms_key_arn
+  s3_role_id               = module.infra.s3_role_id
+  pgbackup_s3_bucket_name  = module.infra.pgbackup_s3_bucket_name
+  enable_waf               = var.enable_waf
+  waf_arn                  = module.infra.wafv2_arn
+  use_acm                  = var.use_acm
+  acm_arn                  = module.infra.acm_arn
+  kubernetes_host          = module.infra.kube_host
+  indico_vpc_id            = module.infra.network.indico_vpc_id
+  public_subnet_ids        = module.infra.network.public_subnet_ids
+  argo_project_name        = module.argo_registration[0].argo_project_name
+  local_registry_enabled   = var.local_registry_enabled
+  on_prem_test             = var.on_prem_test
+  include_efs              = var.include_efs
+  efs_filesystem_id        = module.infra.efs_filesystem_id
+  include_fsx              = var.include_fsx
+  fsx_rwx                  = module.infra.fsx-rwx
+  monitoring_password      = module.monitoring[0].monitoring-password
+
+  ipa_smoketest_values  = var.ipa_smoketest_values
+  ipa_smoketest_repo    = var.ipa_smoketest_repo
+  ipa_smoketest_version = var.ipa_smoketest_version
+  ipa_smoketest_enabled = var.ipa_smoketest_enabled
+
+  restore_snapshot_enabled = var.restore_snapshot_enabled
+  restore_snapshot_name    = var.restore_snapshot_name
+}
+
+/*
+module "applications" {
+  source = "../modules/common/applications"
+
+  depends_on = [
+    null_resource.stage_two,
+  ]
+
+  providers = {
+    kubernetes = kubernetes
+    helm       = helm
+    vault      = vault
+  }
+
+  vault_address            = var.vault_address
+  account                  = var.aws_account
+  region                   = var.region
+  name                     = var.label
+  kubernetes_host          = module.infra.kube_host
+  external_secrets_version = var.external_secrets_version
+}
+
+module "terraform_smoketest" {
+  source = "../modules/common/terraform_smoketest"
+
+  depends_on = [
+    null_resource.stage_two,
+  ]
+
+  providers = {
+    kubernetes = kubernetes
+    helm       = helm
+    vault      = vault
+  }
+
+  vault_address            = var.vault_address
+  account                  = var.aws_account
+  region                   = var.region
+  name                     = var.label
+  kubernetes_host          = module.infra.kube_host
+  external_secrets_version = var.external_secrets_version
+}
+*/
diff --git a/infra/outputs.tf b/infra/outputs.tf
new file mode 100644
index 00000000..332891ee
--- /dev/null
+++ b/infra/outputs.tf
@@ -0,0 +1,113 @@
+
+output "api_models_s3_bucket_name" {
+  description = "Name of the api-models s3 bucket"
+  value       = module.infra.api_models_s3_bucket_name
+}
+
+output "data_s3_bucket_name" {
+  description = "Name of the data s3 bucket"
+  value       = module.infra.data_s3_bucket_name
+}
+
+output "s3_role_id" {
+  description = "ID of the S3 role"
+  value       = module.infra.s3_role_id
+}
+
+
+output "efs_filesystem_id" {
+  description = "ID of the EFS filesystem"
+  value       = module.infra.efs_filesystem_id
+}
+
+output "fsx-rwx" {
+  description = "Read write filesystem"
+  value       = module.infra.fsx-rwx
+}
+
+output "fsx-rox" {
+  description = "Read only filesystem"
+  value       = module.infra.fsx-rox
+}
+
+output "key_pem" {
+  value       = module.infra.key_pem
+  description = "Generated private key for key pair"
+  sensitive   = true
+}
+
+output "fsx_storage_fsx_rwx_dns_name" {
+  value = module.infra.fsx_storage_fsx_rwx_dns_name
+}
+
+output "fsx_storage_fsx_rwx_mount_name" {
+  value = module.infra.fsx_storage_fsx_rwx_mount_name
+}
+
+output "fsx_storage_fsx_rwx_volume_handle" {
+  value = module.infra.fsx_storage_fsx_rwx_volume_handle
+}
+
+output "fsx_storage_fsx_rwx_subnet_id" {
+  value = module.infra.fsx_storage_fsx_rwx_subnet_id
+}
+
+output "cluster_name" {
+  value = var.label
+}
+
+output "cluster_region" {
+  value = var.region
+}
+
+output "dns_name" {
+  value = local.dns_name
+}
+
+# output "kubeconfig" {
+#   value = module.cluster.kubectl_config
+# }
+
+
+output "kube_host" {
+  value = module.infra.kube_host
+}
+
+output "kube_ca_certificate" {
+  value = module.infra.kube_ca_certificate
+
+}
+output "kube_token" {
+  sensitive = true
+  value     = module.infra.kube_token
+}
+
+#output "harness_delegate_name" {
+#  value = var.harness_delegate == true && length(module.harness_delegate) > 0 ? module.harness_delegate[0].delegate_name : ""
+#}
+
+output "ipa_version" {
+  value = var.ipa_version
+}
+
+output "argo_branch" {
+  value = var.argo_branch
+}
+
+output "argo_path" {
+  value = var.argo_path
+}
+
+output "argo_repo" {
+  value = var.argo_repo
+}
+
+output "monitoring_enabled" {
+  value = var.monitoring_enabled
+}
+
+
+#output "harbor-api-token" {
+#  sensitive = true
+#  value     = var.argo_enabled == true ? jsondecode(data.vault_kv_secret_v2.harbor-api-token[0].data_json)["bearer_token"] : ""
+#}
diff --git a/infra/providers.tf b/infra/providers.tf
new file mode 100644
index 00000000..e7d1f314
--- /dev/null
+++ b/infra/providers.tf
@@ -0,0 +1,195 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.14.0"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "0.9.1"
+    }
+    keycloak = {
+      source  = "mrparkers/keycloak"
+      version = "4.0.1"
+    }
+    argocd = {
+      source  = "oboukili/argocd"
+      version = "6.0.2"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.23.0"
+    }
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = "1.14.0"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = ">= 2.11.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~>3.5.1"
+    }
+    github = {
+      source  = "integrations/github"
+      version = "5.34.0"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "3.22.0"
+    }
+    snowflake = {
+      source  = "Snowflake-Labs/snowflake"
+      version = "0.73.0"
+    }
+    htpasswd = {
+      source  = "loafoe/htpasswd"
+      version = "1.0.4"
+    }
+  }
+}
+
+provider "time" {}
+
+provider "keycloak" {
+  initial_login = false
+}
+
+provider "vault" {
+  address          = var.vault_address
+  skip_child_token = true
+  auth_login_userpass {
+    username = var.vault_username
+    password = var.vault_password
+  }
+}
+
+provider "github" {
+  token = var.git_pat
+  owner = "IndicoDataSolutions"
+}
+
+provider "random" {}
+
+provider "aws" {
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
+  region     = var.region
+  default_tags {
+    tags = var.default_tags
+  }
+}
+
+provider "aws" {
+  access_key = var.is_alternate_account_domain == "true" ? var.indico_aws_access_key_id : var.aws_access_key
+  secret_key = var.is_alternate_account_domain == "true" ? var.indico_aws_secret_access_key : var.aws_secret_key
+  region     = var.region
+  alias      = "dns-control"
+  default_tags {
+    tags = var.default_tags
+  }
+}
+
+provider "azurerm" {
+  features {}
+  alias           = "readapi"
+  client_id       = var.azure_readapi_client_id
+  client_secret   = var.azure_readapi_client_secret
+  subscription_id = var.azure_readapi_subscription_id
+  tenant_id       = var.azure_readapi_tenant_id
+}
+
+provider "azurerm" {
+  features {}
+  alias           = "indicoio"
+  client_id       = var.azure_indico_io_client_id
+  client_secret   = var.azure_indico_io_client_secret
+  subscription_id = var.azure_indico_io_subscription_id
+  tenant_id       = var.azure_indico_io_tenant_id
+}
+
+data "vault_kv_secret_v2" "terraform-snowflake" {
+  mount = var.terraform_vault_mount_path
+  name  = "snowflake"
+}
+
+provider "snowflake" {
+  role        = "ACCOUNTADMIN"
+  username    = var.snowflake_username
+  account     = var.snowflake_account
+  region      = var.snowflake_region
+  private_key = jsondecode(data.vault_kv_secret_v2.terraform-snowflake.data_json)["snowflake_private_key"]
+}
+
+provider "htpasswd" {}
+
+# argo
+provider "argocd" {
+  server_addr = var.argo_host
+  username    = var.argo_username
+  password    = var.argo_password
+}
+
+provider "kubernetes" {
+  host                   = module.infra.kube_host
+  cluster_ca_certificate = base64decode(module.infra.kube_ca_certificate)
+  exec {
+    api_version = "client.authentication.k8s.io/v1beta1"
+    args        = ["eks", "get-token", "--cluster-name", var.label]
+    command     = "aws"
+  }
+}
+
+provider "kubectl" {
+  host                   = module.infra.kube_host
+  cluster_ca_certificate = base64decode(module.infra.kube_ca_certificate)
+  load_config_file       = false
+  exec {
+    api_version = "client.authentication.k8s.io/v1beta1"
+    args        = ["eks", "get-token", "--cluster-name", var.label]
+    command     = "aws"
+  }
+}
+
+provider "helm" {
+  debug = true
+  kubernetes {
+    host                   = module.infra.kube_host
+    cluster_ca_certificate = base64decode(module.infra.kube_ca_certificate)
+    exec {
+      api_version = "client.authentication.k8s.io/v1beta1"
+      args        = ["eks", "get-token", "--cluster-name", var.label]
+      command     = "aws"
+    }
+  }
+}
+
+
+provider "aws" {
+  access_key = var.indico_devops_aws_access_key_id
+  secret_key = var.indico_devops_aws_secret_access_key
+  region     = var.indico_devops_aws_region
+  alias      = "aws-indico-devops"
+}
+
+data "aws_eks_cluster" "thanos" {
+  count    = var.thanos_enabled == true ? 1 : 0
+  name     = var.thanos_cluster_name
+  provider = aws.aws-indico-devops
+}
+
+data "aws_eks_cluster_auth" "thanos" {
+  count    = var.thanos_enabled == true ? 1 : 0
+  name     = var.thanos_cluster_name
+  provider = aws.aws-indico-devops
+}
+
+provider "kubectl" {
+  alias                  = "thanos-kubectl"
+  host                   = var.thanos_enabled == true ? data.aws_eks_cluster.thanos[0].endpoint : ""
+  cluster_ca_certificate = var.thanos_enabled == true ? base64decode(data.aws_eks_cluster.thanos[0].certificate_authority[0].data) : ""
+  token                  = var.thanos_enabled == true ? data.aws_eks_cluster_auth.thanos[0].token : ""
+  load_config_file       = false
+}
diff --git a/infra/secretgen.tf b/infra/secretgen.tf
new file mode 100644
index 00000000..d1376d82
--- /dev/null
+++ b/infra/secretgen.tf
@@ -0,0 +1,12 @@
+resource "random_password" "password" {
+  length = 12
+}
+
+resource "random_password" "salt" {
+  length = 8
+}
+
+resource "htpasswd_password" "hash" {
+  password = random_password.password.result
+  salt     = random_password.salt.result
+}
\ No newline at end of file
diff --git a/infra/tf-smoketest-variables.tf b/infra/tf-smoketest-variables.tf
new file mode 100644
index 00000000..df0e5520
--- /dev/null
+++ b/infra/tf-smoketest-variables.tf
@@ -0,0 +1,145 @@
+resource "kubernetes_config_map" "terraform-variables" {
+  # this file is generated via pre-commit, DO NOT EDIT !
+  #depends_on = [null_resource.wait-for-tf-cod-chart-build]
+  metadata {
+    name = "terraform-variables"
+  }
+  data = {
+    is_azure                           = "${jsonencode(var.is_azure)}"
+    is_aws                             = "${jsonencode(var.is_aws)}"
+    label                              = "${jsonencode(var.label)}"
+    environment                        = "${jsonencode(var.environment)}"
+    message                            = "${jsonencode(var.message)}"
+    applications                       = "${jsonencode(var.applications)}"
+    region                             = "${jsonencode(var.region)}"
+    direct_connect                     = "${jsonencode(var.direct_connect)}"
+    additional_tags                    = "${jsonencode(var.additional_tags)}"
+    default_tags                       = "${jsonencode(var.default_tags)}"
+    vpc_cidr                           = "${jsonencode(var.vpc_cidr)}"
+    public_ip                          = "${jsonencode(var.public_ip)}"
+    vpc_name                           = "${jsonencode(var.vpc_name)}"
+    private_subnet_cidrs               = "${jsonencode(var.private_subnet_cidrs)}"
+    public_subnet_cidrs                = "${jsonencode(var.public_subnet_cidrs)}"
+    subnet_az_zones                    = "${jsonencode(var.subnet_az_zones)}"
+    storage_gateway_size               = "${jsonencode(var.storage_gateway_size)}"
+    existing_kms_key                   = "${jsonencode(var.existing_kms_key)}"
+    bucket_versioning                  = "${jsonencode(var.bucket_versioning)}"
+    submission_expiry                  = "${jsonencode(var.submission_expiry)}"
+    uploads_expiry                     = "${jsonencode(var.uploads_expiry)}"
+    name                               = "${jsonencode(var.name)}"
+    cluster_name                       = "${jsonencode(var.cluster_name)}"
+    k8s_version                        = "${jsonencode(var.k8s_version)}"
+    node_groups                        = "${jsonencode(var.node_groups)}"
+    node_bootstrap_arguments           = "${jsonencode(var.node_bootstrap_arguments)}"
+    node_user_data                     = "${jsonencode(var.node_user_data)}"
+    node_disk_size                     = "${jsonencode(var.node_disk_size)}"
+    cluster_node_policies              = "${jsonencode(var.cluster_node_policies)}"
+    kms_encrypt_secrets                = "${jsonencode(var.kms_encrypt_secrets)}"
+    enable_readapi                     = "${jsonencode(var.enable_readapi)}"
+    azure_readapi_client_id            = "${jsonencode(var.azure_readapi_client_id)}"
+    azure_readapi_subscription_id      = "${jsonencode(var.azure_readapi_subscription_id)}"
+    azure_readapi_tenant_id            = "${jsonencode(var.azure_readapi_tenant_id)}"
+    azure_indico_io_client_id          = "${jsonencode(var.azure_indico_io_client_id)}"
+    azure_indico_io_subscription_id    = "${jsonencode(var.azure_indico_io_subscription_id)}"
+    azure_indico_io_tenant_id          = "${jsonencode(var.azure_indico_io_tenant_id)}"
+    eks_cluster_iam_role               = "${jsonencode(var.eks_cluster_iam_role)}"
+    eks_cluster_nodes_iam_role         = "${jsonencode(var.eks_cluster_nodes_iam_role)}"
+    storage_capacity                   = "${jsonencode(var.storage_capacity)}"
+    deletion_protection_enabled        = "${jsonencode(var.deletion_protection_enabled)}"
+    skip_final_snapshot                = "${jsonencode(var.skip_final_snapshot)}"
+    per_unit_storage_throughput        = "${jsonencode(var.per_unit_storage_throughput)}"
+    az_count                           = "${jsonencode(var.az_count)}"
+    snapshot_id                        = "${jsonencode(var.snapshot_id)}"
+    include_rox                        = "${jsonencode(var.include_rox)}"
+    aws_account                        = "${jsonencode(var.aws_account)}"
+    argo_enabled                       = "${jsonencode(var.argo_enabled)}"
+    argo_host                          = "${jsonencode(var.argo_host)}"
+    argo_repo                          = "${jsonencode(var.argo_repo)}"
+    argo_branch                        = "${jsonencode(var.argo_branch)}"
+    argo_namespace                     = "${jsonencode(var.argo_namespace)}"
+    argo_path                          = "${jsonencode(var.argo_path)}"
+    argo_github_team_owner             = "${jsonencode(var.argo_github_team_owner)}"
+    ipa_repo                           = "${jsonencode(var.ipa_repo)}"
+    ipa_version                        = "${jsonencode(var.ipa_version)}"
+    ipa_smoketest_values               = "${jsonencode(var.ipa_smoketest_values)}"
+    ipa_smoketest_repo                 = "${jsonencode(var.ipa_smoketest_repo)}"
+    ipa_smoketest_version              = "${jsonencode(var.ipa_smoketest_version)}"
+    ipa_smoketest_enabled              = "${jsonencode(var.ipa_smoketest_enabled)}"
+    monitoring_version                 = "${jsonencode(var.monitoring_version)}"
+    ipa_pre_reqs_version               = "${jsonencode(var.ipa_pre_reqs_version)}"
+    ipa_crds_version                   = "${jsonencode(var.ipa_crds_version)}"
+    ipa_enabled                        = "${jsonencode(var.ipa_enabled)}"
+    ipa_values                         = "${jsonencode(var.ipa_values)}"
+    vault_address                      = "${jsonencode(var.vault_address)}"
+    vault_username                     = "${jsonencode(var.vault_username)}"
+    sqs_sns                            = "${jsonencode(var.sqs_sns)}"
+    restore_snapshot_enabled           = "${jsonencode(var.restore_snapshot_enabled)}"
+    restore_snapshot_name              = "${jsonencode(var.restore_snapshot_name)}"
+    oidc_enabled                       = "${jsonencode(var.oidc_enabled)}"
+    oidc_client_id                     = "${jsonencode(var.oidc_client_id)}"
+    oidc_config_name                   = "${jsonencode(var.oidc_config_name)}"
+    oidc_issuer_url                    = "${jsonencode(var.oidc_issuer_url)}"
+    oidc_groups_prefix                 = "${jsonencode(var.oidc_groups_prefix)}"
+    oidc_groups_claim                  = "${jsonencode(var.oidc_groups_claim)}"
+    oidc_username_prefix               = "${jsonencode(var.oidc_username_prefix)}"
+    oidc_username_claim                = "${jsonencode(var.oidc_username_claim)}"
+    monitoring_enabled                 = "${jsonencode(var.monitoring_enabled)}"
+    hibernation_enabled                = "${jsonencode(var.hibernation_enabled)}"
+    keda_version                       = "${jsonencode(var.keda_version)}"
+    external_secrets_version           = "${jsonencode(var.external_secrets_version)}"
+    opentelemetry_collector_version    = "${jsonencode(var.opentelemetry-collector_version)}"
+    include_fsx                        = "${jsonencode(var.include_fsx)}"
+    include_pgbackup                   = "${jsonencode(var.include_pgbackup)}"
+    include_efs                        = "${jsonencode(var.include_efs)}"
+    performance_bucket                 = "${jsonencode(var.performance_bucket)}"
+    crds_values_yaml_b64               = "${jsonencode(var.crds-values-yaml-b64)}"
+    pre_reqs_values_yaml_b64           = "${jsonencode(var.pre-reqs-values-yaml-b64)}"
+    k8s_dashboard_chart_version        = "${jsonencode(var.k8s_dashboard_chart_version)}"
+    enable_k8s_dashboard               = "${jsonencode(var.enable_k8s_dashboard)}"
+    use_acm                            = "${jsonencode(var.use_acm)}"
+    enable_waf                         = "${jsonencode(var.enable_waf)}"
+    vault_mount_path                   = "${jsonencode(var.vault_mount_path)}"
+    terraform_vault_mount_path         = "${jsonencode(var.terraform_vault_mount_path)}"
+    snowflake_enabled                  = "${jsonencode(var.snowflake_enabled)}"
+    snowflake_region                   = "${jsonencode(var.snowflake_region)}"
+    snowflake_username                 = "${jsonencode(var.snowflake_username)}"
+    snowflake_account                  = "${jsonencode(var.snowflake_account)}"
+    snowflake_private_key              = "${jsonencode(var.snowflake_private_key)}"
+    snowflake_db_name                  = "${jsonencode(var.snowflake_db_name)}"
+    enable_weather_station             = "${jsonencode(var.enable_weather_station)}"
+    aws_primary_dns_role_arn           = "${jsonencode(var.aws_primary_dns_role_arn)}"
+    is_alternate_account_domain        = "${jsonencode(var.is_alternate_account_domain)}"
+    domain_suffix                      = "${jsonencode(var.domain_suffix)}"
+    domain_host                        = "${jsonencode(var.domain_host)}"
+    alerting_enabled                   = "${jsonencode(var.alerting_enabled)}"
+    alerting_slack_enabled             = "${jsonencode(var.alerting_slack_enabled)}"
+    alerting_pagerduty_enabled         = "${jsonencode(var.alerting_pagerduty_enabled)}"
+    alerting_email_enabled             = "${jsonencode(var.alerting_email_enabled)}"
+    alerting_slack_token               = "${jsonencode(var.alerting_slack_token)}"
+    alerting_slack_channel             = "${jsonencode(var.alerting_slack_channel)}"
+    alerting_pagerduty_integration_key = "${jsonencode(var.alerting_pagerduty_integration_key)}"
+    alerting_email_from                = "${jsonencode(var.alerting_email_from)}"
+    alerting_email_to                  = "${jsonencode(var.alerting_email_to)}"
+    alerting_email_host                = "${jsonencode(var.alerting_email_host)}"
+    alerting_email_username            = "${jsonencode(var.alerting_email_username)}"
+    alerting_email_password            = "${jsonencode(var.alerting_email_password)}"
+    eks_addon_version_guardduty        = "${jsonencode(var.eks_addon_version_guardduty)}"
+    use_static_ssl_certificates        = "${jsonencode(var.use_static_ssl_certificates)}"
+    ssl_static_secret_name             = "${jsonencode(var.ssl_static_secret_name)}"
+    local_registry_version             = "${jsonencode(var.local_registry_version)}"
+    local_registry_enabled             = "${jsonencode(var.local_registry_enabled)}"
+    devops_tools_cluster_host          = "${jsonencode(var.devops_tools_cluster_host)}"
+    thanos_grafana_admin_username      = "${jsonencode(var.thanos_grafana_admin_username)}"
+    thanos_cluster_host                = "${jsonencode(var.thanos_cluster_host)}"
+    thanos_cluster_name                = "${jsonencode(var.thanos_cluster_name)}"
+    indico_devops_aws_region           = "${jsonencode(var.indico_devops_aws_region)}"
+    thanos_enabled                     = "${jsonencode(var.thanos_enabled)}"
+    keycloak_enabled                   = "${jsonencode(var.keycloak_enabled)}"
+    terraform_smoketests_enabled       = "${jsonencode(var.terraform_smoketests_enabled)}"
+    on_prem_test                       = "${jsonencode(var.on_prem_test)}"
+    harness_delegate                   = "${jsonencode(var.harness_delegate)}"
+    harness_mount_path                 = "${jsonencode(var.harness_mount_path)}"
+
+  }
+}
+  
diff --git a/user_vars.auto.tfvars b/infra/user_vars.auto.tfvars
similarity index 100%
rename from user_vars.auto.tfvars
rename to infra/user_vars.auto.tfvars
diff --git a/variables.tf b/infra/variables.tf
similarity index 98%
rename from variables.tf
rename to infra/variables.tf
index 9c524a06..0589c12e 100644
--- a/variables.tf
+++ b/infra/variables.tf
@@ -1,3 +1,9 @@
+# Main flags for resource creation
+variable "create_infra" {
+  type        = bool
+  default     = true
+  description = "Flag to enable infrastructure creation"
+}
 
 variable "is_azure" {
   type    = bool
@@ -538,6 +544,7 @@ variable "performance_bucket" {
   default     = false
   description = "Add permission to connect to indico-locust-benchmark-test-results"
 }
+
 variable "crds-values-yaml-b64" {
   default = "Cg=="
 }
@@ -618,7 +625,7 @@ variable "enable_weather_station" {
 }
 
 variable "aws_primary_dns_role_arn" {
-  type        = string 
+  type        = string
   default     = ""
   description = "The AWS arn for the role needed to manage route53 DNS in a different account."
 }
@@ -828,3 +835,13 @@ variable "harness_mount_path" {
   type    = string
   default = "harness"
 }
+
+variable "infra_crds_version" {
+  type    = string
+  default = "1.2.2"
+}
+
+variable "infra_pre_reqs_version" {
+  type    = string
+  default = "2.1.2"
+}
diff --git a/modules/aws/helm/k8s_dashboard.tf b/modules/aws/helm/k8s_dashboard.tf
new file mode 100644
index 00000000..3b18625b
--- /dev/null
+++ b/modules/aws/helm/k8s_dashboard.tf
@@ -0,0 +1,172 @@
+locals {
+  #TODO: reduce this
+  ingress_values = var.use_static_ssl_certificates == false ? (<<EOT
+oauth2-proxy:
+  
+  extraArgs:
+    insecure-oidc-allow-unverified-email: true
+    email-domain: indico.io
+
+  redis:
+    enabled: true
+    replica:
+      replicaCount: 1
+    affinity:
+      podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: redis
+                    app.kubernetes.io/component: replica
+                namespaces:
+                  - "default"
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+
+  sessionStorage:
+    type: redis
+
+  # important
+  extraEnv:
+    - name: OAUTH2_PROXY_OIDC_ISSUER_URL
+      value: https://keycloak.devops.indico.io/auth/realms/GoogleAuth
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: https://k8s.${var.dns_name}/oauth2/callback
+    - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
+      value: 'true'
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: '*'
+    - name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON
+      value: 'true'
+    - name: OAUTH2_PROXY_PROVIDER
+      value: 'oidc'
+    - name: OAUTH2_PROXY_ALLOWED_GROUPS
+      value: DevOps,Engineering,QA,Customer Ops
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://k8s-kubernetes-dashboard:443
+    - name: OAUTH2_PROXY_SSL_UPSTREAM_INSECURE_SKIP_VERIFY
+      value: 'true'
+
+  config:
+    clientID: ${data.keycloak_openid_client.kube-oidc-proxy.client_id}
+    clientSecret: ${data.keycloak_openid_client.kube-oidc-proxy.client_secret}
+   
+  service:
+    annotations:
+      external-dns.alpha.kubernetes.io/hostname: k8s.${var.dns_name}  
+  ingress:
+    enabled: true
+    hosts:
+      - k8s.${var.dns_name}
+    annotations:
+      kubernetes.io/ingress.class: nginx
+      cert-manager.io/cluster-issuer: zerossl
+    tls:
+      - hosts:
+          - k8s.${var.dns_name}
+        secretName: k8s-proxy-tls
+  EOT
+    ) : (<<EOT
+oauth2-proxy:
+  
+  extraArgs:
+    insecure-oidc-allow-unverified-email: true
+    email-domain: indico.io
+
+  redis:
+    enabled: true
+    replica:
+      replicaCount: 1
+    affinity:
+      podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: redis
+                    app.kubernetes.io/component: replica
+                namespaces:
+                  - "default"
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+
+  sessionStorage:
+    type: redis
+
+  # important
+  extraEnv:
+    - name: OAUTH2_PROXY_OIDC_ISSUER_URL
+      value: https://keycloak.devops.indico.io/auth/realms/GoogleAuth
+    - name: OAUTH2_PROXY_REDIRECT_URL
+      value: https://k8s-${var.dns_name}/oauth2/callback
+    - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
+      value: 'true'
+    - name: OAUTH2_PROXY_EMAIL_DOMAINS
+      value: '*'
+    - name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON
+      value: 'true'
+    - name: OAUTH2_PROXY_PROVIDER
+      value: 'oidc'
+    - name: OAUTH2_PROXY_ALLOWED_GROUPS
+      value: DevOps,Engineering,QA,Customer Ops
+    - name: OAUTH2_PROXY_UPSTREAMS
+      value: http://k8s-kubernetes-dashboard:443
+    - name: OAUTH2_PROXY_SSL_UPSTREAM_INSECURE_SKIP_VERIFY
+      value: 'true'
+
+  config:
+    clientID: ${data.keycloak_openid_client.kube-oidc-proxy.client_id}
+    clientSecret: ${data.keycloak_openid_client.kube-oidc-proxy.client_secret}
+   
+  service:
+    annotations:
+      external-dns.alpha.kubernetes.io/hostname: k8s-${var.dns_name}
+  ingress:
+    enabled: true
+    hosts:
+      - k8s-${var.dns_name}
+    annotations:
+      kubernetes.io/ingress.class: nginx
+    tls:
+      - hosts:
+          - k8s-${var.dns_name}
+        secretName: ${var.ssl_static_secret_name}
+EOT
+  )
+}
+
+resource "helm_release" "k8s-dashboard" {
+  name             = "k8s"
+  create_namespace = true
+  namespace        = "default"
+  repository       = var.ipa_repo
+  chart            = "k8s-dashboard"
+  version          = var.k8s_dashboard_chart_version
+  timeout          = 600   # 10 minutes
+  wait             = false # don't bother to wait
+
+  values = [
+    <<EOF
+kubernetes-dashboard:
+  extraArgs:
+  - --enable-insecure-login
+  - --system-banner="Viewing ${var.dns_name}"
+  - --token-ttl=43200
+  - --enable-skip-login
+
+  # we are proxying
+  protocolHttp: true
+
+  settings:
+    clusterName: "${var.dns_name}"
+    itemsPerPage: 40
+    logsAutoRefreshTimeInterval: 5
+    resourceAutoRefreshTimeInterval: 5
+    disableAccessDeniedNotifications: false
+
+${local.ingress_values}
+
+   EOF
+  ]
+}
diff --git a/modules/aws/helm/keycloak.tf b/modules/aws/helm/keycloak.tf
new file mode 100644
index 00000000..2328b800
--- /dev/null
+++ b/modules/aws/helm/keycloak.tf
@@ -0,0 +1,28 @@
+data "keycloak_realm" "realm" {
+  realm = "GoogleAuth"
+}
+
+data "keycloak_openid_client" "kube-oidc-proxy" {
+  realm_id  = data.keycloak_realm.realm.id
+  client_id = "kube-oidc-proxy"
+}
+
+resource "null_resource" "register-callback" {
+  # Ensure this runs only if we change these.
+  triggers = {
+    dns_name      = var.dns_name
+    client_secret = data.keycloak_openid_client.kube-oidc-proxy.client_secret
+  }
+  # must use full resource def for the apply, but must use self.triggers for destroy
+  # annoying: https://stackoverflow.com/questions/72820832/self-triggers-is-null-when-trying-to-use-trigger-values-in-local-exec-provisio
+  provisioner "local-exec" {
+    command = "curl -XPOST -H 'Content-Type: application/json' -H \"Authorization: Bearer ${data.keycloak_openid_client.kube-oidc-proxy.client_secret}\" -v https://keycloak-service.devops.indico.io/add --data '{\"url\": \"https://k8s.${var.dns_name}/oauth2/callback\"}'"
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "curl -XDELETE -H 'Content-Type: application/json' -H \"Authorization: Bearer ${self.triggers.client_secret}\" -v https://keycloak-service.devops.indico.io/delete --data '{\"url\": \"https://k8s.${self.triggers.dns_name}/oauth2/callback\"}'"
+  }
+
+}
+
diff --git a/modules/aws/helm/outputs.tf b/modules/aws/helm/outputs.tf
new file mode 100644
index 00000000..b1d82ae1
--- /dev/null
+++ b/modules/aws/helm/outputs.tf
@@ -0,0 +1,8 @@
+output "client_id" {
+  value = data.keycloak_openid_client.kube-oidc-proxy.client_id
+}
+
+output "client_secret" {
+  value     = data.keycloak_openid_client.kube-oidc-proxy.client_secret
+  sensitive = true
+}
diff --git a/modules/aws/helm/providers.tf b/modules/aws/helm/providers.tf
new file mode 100644
index 00000000..193496c5
--- /dev/null
+++ b/modules/aws/helm/providers.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    keycloak = {
+      source = "mrparkers/keycloak"
+    }
+    helm = {
+      source = "hashicorp/helm"
+    }
+  }
+}
diff --git a/modules/aws/helm/variables.tf b/modules/aws/helm/variables.tf
new file mode 100644
index 00000000..59895221
--- /dev/null
+++ b/modules/aws/helm/variables.tf
@@ -0,0 +1,20 @@
+# locals.dns_name
+variable "dns_name" {}
+
+variable "k8s_dashboard_chart_version" {
+  default = "0.1.1"
+}
+
+variable "ipa_repo" {}
+
+variable "use_static_ssl_certificates" {
+  type        = bool
+  default     = false
+  description = "use static ssl certificates for clusters which cannot use certmanager and external dns."
+}
+
+variable "ssl_static_secret_name" {
+  type        = string
+  default     = "indico-ssl-static-cert"
+  description = "secret_name for static ssl certificate"
+}
diff --git a/modules/aws/infra/guardduty.tf b/modules/aws/infra/guardduty.tf
new file mode 100644
index 00000000..fc173d07
--- /dev/null
+++ b/modules/aws/infra/guardduty.tf
@@ -0,0 +1,95 @@
+
+data "aws_vpc_endpoint_service" "guardduty" {
+  service_type = "Interface"
+  filter {
+    name   = "service-name"
+    values = ["com.amazonaws.${var.region}.guardduty-data"]
+  }
+}
+
+resource "aws_vpc_endpoint" "eks_vpc_guardduty" {
+  vpc_id            = local.network[0].indico_vpc_id
+  service_name      = data.aws_vpc_endpoint_service.guardduty.service_name
+  vpc_endpoint_type = "Interface"
+
+  policy = data.aws_iam_policy_document.eks_vpc_guardduty.json
+
+  security_group_ids  = [aws_security_group.eks_vpc_endpoint_guardduty.id]
+  subnet_ids          = local.network[0].public_subnet_ids
+  private_dns_enabled = true
+}
+
+resource "aws_security_group" "eks_vpc_endpoint_guardduty" {
+  name_prefix = "${var.label}-vpc-endpoint-guardduty-sg-"
+  description = "Security Group used by VPC Endpoints."
+  vpc_id      = local.network[0].indico_vpc_id
+
+  tags = {
+    "Name"             = "${var.label}-vpc-endpoint-guardduty-sg-"
+    "GuardDutyManaged" = "false"
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+data "aws_iam_policy_document" "eks_vpc_guardduty" {
+  statement {
+    actions = ["*"]
+
+    effect = "Allow"
+
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+  }
+
+  statement {
+    actions = ["*"]
+
+    effect = "Deny"
+
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringNotEquals"
+      variable = "aws:PrincipalAccount"
+
+      values = [data.aws_caller_identity.current.account_id]
+    }
+  }
+}
+resource "aws_eks_addon" "guardduty" {
+  depends_on = [
+    module.cluster
+  ]
+  count = var.eks_addon_version_guardduty != null ? 1 : 0
+
+
+  cluster_name      = var.label
+  addon_name        = "aws-guardduty-agent"
+  addon_version     = "v1.2.0-eksbuild.1"
+  resolve_conflicts = "OVERWRITE"
+
+  preserve = true
+
+  tags = {
+    "eks_addon" = "guardduty"
+  }
+}
diff --git a/modules/aws/infra/locals.tf b/modules/aws/infra/locals.tf
new file mode 100644
index 00000000..ecea4035
--- /dev/null
+++ b/modules/aws/infra/locals.tf
@@ -0,0 +1,27 @@
+# define the networking module we're using locally
+locals {
+  network = var.direct_connect == true ? module.private_networking : module.public_networking
+
+  # TODO: Variablize this?
+  aws_usernames = [
+    "svc_jenkins",
+    "terraform-sa"
+  ]
+  eks_users = {
+    for user in local.aws_usernames : user => {
+      userarn  = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${user}"
+      username = user
+      groups   = ["system:masters"]
+    }
+  }
+
+  # DNS
+  the_splits            = local.dns_name != "" ? split(".", local.dns_name) : split(".", "test.domain.com")
+  the_length            = length(local.the_splits)
+  the_tld               = local.the_splits[local.the_length - 1]
+  the_domain            = local.the_splits[local.the_length - 2]
+  alternate_domain_root = join(".", [local.the_domain, local.the_tld])
+
+  dns_name = var.domain_host == "" ? lower("${var.label}.${var.region}.${var.aws_account}.${var.domain_suffix}") : var.domain_host
+  #dns_suffix        = lower("${var.region}.${var.aws_account}.indico.io")
+}
diff --git a/modules/aws/infra/main.tf b/modules/aws/infra/main.tf
new file mode 100644
index 00000000..56390e84
--- /dev/null
+++ b/modules/aws/infra/main.tf
@@ -0,0 +1,197 @@
+data "aws_caller_identity" "current" {}
+
+# Private Key for Cluster Manager (TODO:remove)
+resource "tls_private_key" "pk" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "aws_key_pair" "kp" {
+  key_name   = var.name
+  public_key = tls_private_key.pk.public_key_openssh
+}
+
+# Networking
+module "public_networking" {
+  count                = var.direct_connect == true ? 0 : 1
+  source               = "app.terraform.io/indico/indico-aws-network/mod"
+  version              = "1.2.0"
+  label                = var.label
+  vpc_cidr             = var.vpc_cidr
+  private_subnet_cidrs = var.private_subnet_cidrs
+  public_subnet_cidrs  = var.public_subnet_cidrs
+  subnet_az_zones      = var.subnet_az_zones
+}
+
+module "private_networking" {
+  count                = var.direct_connect == true ? 1 : 0
+  source               = "app.terraform.io/indico/indico-aws-dc-network/mod"
+  version              = "1.0.0"
+  vpc_cidr             = var.vpc_cidr
+  private_subnet_cidrs = var.private_subnet_cidrs
+  subnet_az_zones      = var.subnet_az_zones
+}
+
+module "security-group" {
+  source   = "app.terraform.io/indico/indico-aws-security-group/mod"
+  version  = "1.0.0"
+  label    = var.label
+  vpc_cidr = var.vpc_cidr
+  vpc_id   = local.network[0].indico_vpc_id
+}
+
+# KMS for Encryption
+module "kms_key" {
+  source           = "app.terraform.io/indico/indico-aws-kms/mod"
+  version          = "2.1.0"
+  label            = var.label
+  additional_tags  = var.additional_tags
+  existing_kms_key = var.existing_kms_key
+}
+
+# SQS/SNS
+module "sqs_sns" {
+  count             = var.sqs_sns == true ? 1 : 0
+  source            = "app.terraform.io/indico/indico-aws-sqs-sns/mod"
+  version           = "1.2.0"
+  region            = var.region
+  label             = var.label
+  kms_master_key_id = module.kms_key.key.id
+}
+
+# Storage
+module "s3-storage" {
+  source            = "app.terraform.io/indico/indico-aws-buckets/mod"
+  version           = "2.0.3"
+  force_destroy     = true # allows terraform to destroy non-empty buckets.
+  label             = var.label
+  kms_key_arn       = module.kms_key.key.arn
+  submission_expiry = var.submission_expiry
+  uploads_expiry    = var.uploads_expiry
+  include_rox       = var.include_rox
+}
+
+
+# This empties the buckets upon delete so terraform doesn't take forever.
+resource "null_resource" "s3-delete-data-bucket" {
+  depends_on = [
+    module.s3-storage
+  ]
+
+  triggers = {
+    data_bucket_name = module.s3-storage.data_s3_bucket_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "aws s3 rm \"s3://${self.triggers.data_bucket_name}/\" --recursive --only-show-errors || echo \"WARNING: S3 rm ${self.triggers.data_bucket_name} reported errors\" >&2"
+  }
+}
+
+resource "null_resource" "s3-delete-data-pgbackup-bucket" {
+  count = var.include_pgbackup == true ? 1 : 0
+
+  depends_on = [
+    module.s3-storage
+  ]
+
+  triggers = {
+    pg_backup_bucket_name = module.s3-storage.pgbackup_s3_bucket_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "aws s3 rm \"s3://${self.triggers.pg_backup_bucket_name}/\" --recursive --only-show-errors || echo \"WARNING: S3 rm ${self.triggers.pg_backup_bucket_name} reported errors\" >&2"
+  }
+}
+
+module "efs-storage" {
+  count              = var.include_efs == true ? 1 : 0
+  source             = "app.terraform.io/indico/indico-aws-efs/mod"
+  version            = "0.0.1"
+  label              = var.label
+  additional_tags    = merge(var.additional_tags, { "type" = "local-efs-storage" })
+  security_groups    = [module.security-group.all_subnets_sg_id]
+  private_subnet_ids = flatten([local.network[0].private_subnet_ids])
+  kms_key_arn        = module.kms_key.key_arn
+}
+
+module "efs-storage-local-registry" {
+  count              = var.local_registry_enabled == true ? 1 : 0
+  source             = "app.terraform.io/indico/indico-aws-efs/mod"
+  version            = "0.0.1"
+  label              = "${var.label}-local-registry"
+  additional_tags    = merge(var.additional_tags, { "type" = "local-efs-storage-local-registry" })
+  security_groups    = [module.security-group.all_subnets_sg_id]
+  private_subnet_ids = flatten([local.network[0].private_subnet_ids])
+  kms_key_arn        = module.kms_key.key_arn
+}
+
+module "fsx-storage" {
+  count                       = var.include_fsx == true ? 1 : 0
+  source                      = "app.terraform.io/indico/indico-aws-fsx/mod"
+  version                     = "1.4.2"
+  label                       = var.label
+  additional_tags             = var.additional_tags
+  region                      = var.region
+  storage_capacity            = var.storage_capacity
+  subnet_id                   = local.network[0].private_subnet_ids[0]
+  security_group_id           = module.security-group.all_subnets_sg_id
+  data_bucket                 = module.s3-storage.data_s3_bucket_name
+  api_models_bucket           = module.s3-storage.api_models_s3_bucket_name
+  kms_key                     = module.kms_key.key
+  per_unit_storage_throughput = var.per_unit_storage_throughput
+  include_rox                 = var.include_rox
+}
+
+module "cluster" {
+  cod_snapshots_enabled      = true
+  allow_dns_management       = true
+  aws_account_name           = var.aws_account
+  oidc_enabled               = false
+  source                     = "app.terraform.io/indico/indico-aws-eks-cluster/mod"
+  version                    = "8.1.7"
+  label                      = var.label
+  additional_tags            = var.additional_tags
+  region                     = var.region
+  map_users                  = values(local.eks_users)
+  vpc_id                     = local.network[0].indico_vpc_id
+  security_group_id          = module.security-group.all_subnets_sg_id
+  subnet_ids                 = flatten([local.network[0].private_subnet_ids])
+  node_groups                = var.node_groups
+  cluster_node_policies      = var.cluster_node_policies
+  eks_cluster_iam_role       = var.eks_cluster_iam_role
+  eks_cluster_nodes_iam_role = "${var.label}-${var.region}-node-role"
+  fsx_arns                   = [var.include_rox ? module.fsx-storage[0].fsx-rox.arn : "", var.include_fsx == true ? module.fsx-storage[0].fsx-rwx.arn : ""]
+  kms_key_arn                = module.kms_key.key_arn
+  az_count                   = var.az_count
+  key_pair                   = aws_key_pair.kp.key_name
+  snapshot_id                = var.snapshot_id
+  default_tags               = var.default_tags
+  s3_buckets                 = [module.s3-storage.data_s3_bucket_name, var.include_pgbackup ? module.s3-storage.pgbackup_s3_bucket_name : "", var.include_rox ? module.s3-storage.api_models_s3_bucket_name : "", lower("${var.aws_account}-aws-cod-snapshots"), var.performance_bucket ? "indico-locust-benchmark-test-results" : ""]
+  cluster_version            = var.k8s_version
+  efs_filesystem_id          = [var.include_efs == true ? module.efs-storage[0].efs_filesystem_id : ""]
+  aws_primary_dns_role_arn   = var.aws_primary_dns_role_arn
+}
+
+# Alternate Domain name
+data "aws_route53_zone" "primary" {
+  name     = var.is_alternate_account_domain == "false" ? lower("${var.aws_account}.${var.domain_suffix}") : lower(local.alternate_domain_root)
+  provider = aws.dns-control
+}
+
+resource "aws_route53_record" "ipa-app-caa" {
+  count   = var.is_alternate_account_domain == "true" ? 0 : 1
+  zone_id = data.aws_route53_zone.primary.zone_id
+  name    = local.dns_name
+  type    = "CAA"
+  ttl     = 300
+  records = [
+    "0 issue \"sectigo.com\"",
+    "0 issue \"amazontrust.com\"",
+    "0 issue \"amazon.com\"",
+    "0 issue \"amazonaws.com\"",
+    "0 issue \"awstrust.com\""
+  ]
+  provider = aws.dns-control
+}
diff --git a/modules/aws/infra/monitoring_routes.tf b/modules/aws/infra/monitoring_routes.tf
new file mode 100644
index 00000000..0b655288
--- /dev/null
+++ b/modules/aws/infra/monitoring_routes.tf
@@ -0,0 +1,39 @@
+
+resource "aws_route53_record" "grafana-caa" {
+  count = var.monitoring_enabled ? 1 : 0
+
+  zone_id = data.aws_route53_zone.primary.zone_id
+  name    = lower("grafana.${local.dns_name}")
+  type    = "CAA"
+  ttl     = 300
+  records = [
+    "0 issue \"sectigo.com\""
+  ]
+  provider = aws.dns-control
+}
+
+resource "aws_route53_record" "prometheus-caa" {
+  count = var.monitoring_enabled ? 1 : 0
+
+  zone_id = data.aws_route53_zone.primary.zone_id
+  name    = lower("prometheus.${local.dns_name}")
+  type    = "CAA"
+  ttl     = 300
+  records = [
+    "0 issue \"sectigo.com\""
+  ]
+  provider = aws.dns-control
+}
+
+resource "aws_route53_record" "alertmanager-caa" {
+  count = var.monitoring_enabled ? 1 : 0
+
+  zone_id = data.aws_route53_zone.primary.zone_id
+  name    = lower("alertmanager.${local.dns_name}")
+  type    = "CAA"
+  ttl     = 300
+  records = [
+    "0 issue \"sectigo.com\""
+  ]
+  provider = aws.dns-control
+}
diff --git a/oidc.tf b/modules/aws/infra/oidc.tf
similarity index 100%
rename from oidc.tf
rename to modules/aws/infra/oidc.tf
diff --git a/outputs.tf b/modules/aws/infra/outputs.tf
similarity index 66%
rename from outputs.tf
rename to modules/aws/infra/outputs.tf
index bc5bd026..29e8cffe 100644
--- a/outputs.tf
+++ b/modules/aws/infra/outputs.tf
@@ -1,24 +1,35 @@
-
-output "api_models_s3_bucket_name" {
-  description = "Name of the api-models s3 bucket"
-  value       = module.s3-storage.api_models_s3_bucket_name
+# Cluster connection 
+output "kube_host" {
+  value = module.cluster.kubernetes_host
 }
 
-output "data_s3_bucket_name" {
-  description = "Name of the data s3 bucket"
-  value       = module.s3-storage.data_s3_bucket_name
-}
+output "kube_ca_certificate" {
+  value = base64encode(module.cluster.kubernetes_cluster_ca_certificate)
 
-output "s3_role_id" {
-  description = "ID of the S3 role"
-  value       = module.cluster.s3_role_id
+}
+output "kube_token" {
+  sensitive = true
+  value     = module.cluster.kubernetes_token
 }
 
+# KMS outputs
+output "kms_key_arn" {
+  value       = module.kms_key.key_arn
+  description = "KMS key arn"
+}
 
+# EFS outputs
 output "efs_filesystem_id" {
-  description = "ID of the EFS filesystem"
   value       = var.include_efs == true ? module.efs-storage[0].efs_filesystem_id : ""
+  description = "ID of the EFS filesystem"
 }
+
+output "local_registry_efs_filesystem_id" {
+  value       = var.local_registry_enabled ? module.efs-storage-local-registry[0].efs_filesystem_id : null
+  description = "ID of the EFS filesystem for local-registry"
+}
+
+# FSX outputs
 output "fsx-rwx" {
   description = "Read write filesystem"
   value       = var.include_fsx == true ? module.fsx-storage[0].fsx-rwx : null
@@ -29,12 +40,6 @@ output "fsx-rox" {
   value       = var.include_rox ? module.fsx-storage[0].fsx-rox : ""
 }
 
-output "key_pem" {
-  value       = tls_private_key.pk.private_key_pem
-  description = "Generated private key for key pair"
-  sensitive   = true
-}
-
 output "fsx_storage_fsx_rwx_dns_name" {
   value = var.include_fsx == true ? module.fsx-storage[0].fsx-rwx.dns_name : ""
 }
@@ -51,56 +56,44 @@ output "fsx_storage_fsx_rwx_subnet_id" {
   value = var.include_fsx == true ? module.fsx-storage[0].fsx-rwx.subnet_ids[0] : ""
 }
 
-output "cluster_name" {
-  value = var.label
-}
-
-output "cluster_region" {
-  value = var.region
-}
-
-output "dns_name" {
-  value = local.dns_name
+# S3 outputs
+output "api_models_s3_bucket_name" {
+  description = "Name of the api-models s3 bucket"
+  value       = module.s3-storage.api_models_s3_bucket_name
 }
 
-# output "kubeconfig" {
-#   value = module.cluster.kubectl_config
-# }
-
-
-output "kube_host" {
-  value = module.cluster.kubernetes_host
+output "data_s3_bucket_name" {
+  description = "Name of the data s3 bucket"
+  value       = module.s3-storage.data_s3_bucket_name
 }
 
-output "kube_ca_certificate" {
-  value = base64encode(module.cluster.kubernetes_cluster_ca_certificate)
-
-}
-output "kube_token" {
-  sensitive = true
-  value     = module.cluster.kubernetes_token
+output "s3_role_id" {
+  description = "ID of the S3 role"
+  value       = module.cluster.s3_role_id
 }
 
-output "harness_delegate_name" {
-  value = var.harness_delegate == true && length(module.harness_delegate) > 0 ? module.harness_delegate[0].delegate_name : ""
+output "pgbackup_s3_bucket_name" {
+  description = "S3 pgbackup bucket name"
+  value       = module.s3-storage.pgbackup_s3_bucket_name
 }
 
-output "ipa_version" {
-  value = var.ipa_version
+# Misc
+output "acm_arn" {
+  description = "arn of the acm"
+  value       = var.enable_waf == true ? aws_acm_certificate_validation.alb[0].certificate_arn : ""
 }
 
-output "argo_branch" {
-  value = var.argo_branch
+output "wafv2_arn" {
+  description = "arn of the wafv2 acl"
+  value       = var.enable_waf == true ? aws_wafv2_web_acl.wafv2-acl[0].arn : ""
 }
 
-output "argo_path" {
-  value = var.argo_path
+output "key_pem" {
+  value       = tls_private_key.pk.private_key_pem
+  description = "Generated private key for key pair"
+  sensitive   = true
 }
 
-output "argo_repo" {
-  value = var.argo_repo
+output "network" {
+  value = local.network[0]
 }
-
-output "monitoring_enabled" {
-  value = var.monitoring_enabled
-}
\ No newline at end of file
diff --git a/modules/aws/infra/providers.tf b/modules/aws/infra/providers.tf
new file mode 100644
index 00000000..656e2050
--- /dev/null
+++ b/modules/aws/infra/providers.tf
@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    aws = {
+      source                = "hashicorp/aws"
+      configuration_aliases = [aws.dns-control]
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+  }
+}
\ No newline at end of file
diff --git a/modules/aws/infra/variables.tf b/modules/aws/infra/variables.tf
new file mode 100644
index 00000000..e267d910
--- /dev/null
+++ b/modules/aws/infra/variables.tf
@@ -0,0 +1,234 @@
+# General
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+variable "name" {
+  type        = string
+  default     = "indico"
+  description = "Name to use in all cluster resources names (TODO: deprecate (redundant))"
+}
+
+variable "additional_tags" {
+  type        = map(string)
+  default     = null
+  description = "Additonal tags to add to each resource"
+}
+
+variable "default_tags" {
+  type        = map(string)
+  default     = null
+  description = "Default tags to add to each resource (redundant?)"
+}
+
+variable "dns_name" {
+  type        = string
+  default     = ".indico.io"
+  description = "DNS name"
+}
+
+variable "domain_suffix" {
+  type        = string
+  default     = "indico.io"
+  description = "Domain suffix"
+}
+
+variable "domain_host" {
+  type        = string
+  default     = ""
+  description = "domain host name."
+}
+
+# Network
+variable "direct_connect" {
+  type        = bool
+  default     = false
+  description = "Sets up the direct connect configuration if true; else use public subnets"
+}
+
+variable "vpc_cidr" {
+  type        = string
+  description = "The VPC for the entire indico stack"
+}
+
+variable "private_subnet_cidrs" {
+  type        = list(string)
+  description = "CIDR ranges for the private subnets"
+}
+
+variable "public_subnet_cidrs" {
+  type        = list(string)
+  description = "CIDR ranges for the public subnets"
+}
+
+variable "subnet_az_zones" {
+  type        = list(string)
+  description = "Availability zones for the subnets"
+}
+
+# KMS
+variable "existing_kms_key" {
+  type        = string
+  default     = ""
+  description = "Name of kms key if it exists in the account (eg. 'alias/<name>')"
+}
+
+# SQS/SNS
+variable "sqs_sns" {
+  type        = bool
+  default     = true
+  description = "Flag for enabling SQS/SNS"
+}
+
+# Blob Storage
+variable "submission_expiry" {
+  type        = number
+  description = "The number of days to retain submissions"
+  default     = 30
+}
+
+variable "uploads_expiry" {
+  type        = number
+  description = "The number of days to retain uploads"
+  default     = 30
+}
+
+variable "include_rox" {
+  type        = bool
+  default     = false
+  description = "Create a read only FSx file system (TODO: remove (deprecated))"
+}
+
+variable "include_pgbackup" {
+  type        = bool
+  default     = true
+  description = "Create a read only FSx file system"
+}
+
+# File Storage
+variable "include_efs" {
+  type        = bool
+  default     = true
+  description = "Create efs"
+}
+
+variable "include_fsx" {
+  type        = bool
+  default     = false
+  description = "Create a fsx file system(s)"
+}
+
+variable "local_registry_enabled" {
+  type    = bool
+  default = false
+}
+
+variable "storage_capacity" {
+  type        = number
+  default     = 1200
+  description = "Storage capacity in GiB for RWX FSx"
+}
+
+variable "per_unit_storage_throughput" {
+  type        = number
+  default     = 100
+  description = "Throughput for each 1 TiB or storage (max 200) for RWX FSx"
+}
+
+# Cluster
+variable "k8s_version" {
+  type        = string
+  default     = "1.27"
+  description = "The EKS version to use"
+}
+
+variable "node_groups" {
+}
+
+variable "az_count" {
+  type        = number
+  default     = 2
+  description = "Number of availability zones for nodes"
+
+  validation {
+    condition     = var.az_count > 0 && var.az_count <= 3
+    error_message = "The az_count must be in the range 1-3"
+  }
+}
+
+variable "cluster_node_policies" {
+  type        = list(any)
+  default     = ["IAMReadOnlyAccess"]
+  description = "Additonal IAM policies to add to the cluster IAM role"
+}
+
+variable "eks_cluster_iam_role" {
+  type        = string
+  default     = null
+  description = "Name of the IAM role to assign to the EKS cluster; will be created if not supplied"
+}
+
+variable "snapshot_id" {
+  type        = string
+  default     = ""
+  description = "The ebs snapshot of read-only data to use (TODO:?)"
+}
+
+variable "performance_bucket" {
+  type        = bool
+  default     = false
+  description = "Add permission to connect to indico-locust-benchmark-test-results (TODO:?)"
+}
+
+# OIDC configuration (TODO: add other variables)
+variable "oidc_enabled" {
+  type        = bool
+  default     = true
+  description = "Enable OIDC Auhentication"
+}
+
+# WAF
+variable "enable_waf" {
+  type        = bool
+  default     = false
+  description = "enables aws alb controller for app-edge, also creates waf rules."
+}
+
+# Guardduty
+variable "eks_addon_version_guardduty" {
+  type        = bool
+  default     = true
+  description = "enable guardduty"
+}
+
+# DNS
+variable "aws_primary_dns_role_arn" {
+  type        = string
+  default     = ""
+  description = "The AWS arn for the role needed to manage route53 DNS in a different account."
+}
+
+variable "is_alternate_account_domain" {
+  type        = string
+  default     = "false"
+  description = "domain name is controlled by a different aws account"
+}
+
+# Set up routes for monitoring
+variable "monitoring_enabled" {
+  type    = bool
+  default = true
+}
diff --git a/modules/aws/infra/waf.tf b/modules/aws/infra/waf.tf
new file mode 100644
index 00000000..8d6f6344
--- /dev/null
+++ b/modules/aws/infra/waf.tf
@@ -0,0 +1,120 @@
+resource "aws_wafv2_web_acl" "wafv2-acl" {
+  count    = var.enable_waf == true ? 1 : 0
+  name        = "${var.label}-wafv2"
+  description = "${var.label}-wafv2 managed rules."
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesUnixRuleSet"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesUnixRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesUnixRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+  
+  rule {
+    name     = "AWS-AWSManagedRulesAmazonIpReputationList"
+    priority = 2
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesAmazonIpReputationList"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesAmazonIpReputationList"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.label}-wafv2"
+    sampled_requests_enabled   = true
+  }
+}
+
+resource "aws_acm_certificate" "alb" {
+  count    = var.enable_waf == true ? 1 : 0
+  domain_name       = local.dns_name
+  validation_method = "DNS"
+  depends_on = [
+    aws_route53_record.ipa-app-caa
+  ]
+}
+
+
+resource "aws_route53_record" "alb" {
+  for_each = var.enable_waf ? {
+    for dvo in aws_acm_certificate.alb[0].domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  } : {}
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = data.aws_route53_zone.primary.zone_id
+  provider = aws.dns-control
+}
+
+
+resource "aws_acm_certificate_validation" "alb" {
+  count    = var.enable_waf == true ? 1 : 0
+  certificate_arn         = aws_acm_certificate.alb[0].arn
+  validation_record_fqdns = [for record in aws_route53_record.alb : record.fqdn]
+  depends_on = [
+    aws_acm_certificate.alb[0]
+  ]
+}
\ No newline at end of file
diff --git a/modules/common/applications/applications.tf b/modules/common/applications/applications.tf
new file mode 100644
index 00000000..14116d1d
--- /dev/null
+++ b/modules/common/applications/applications.tf
@@ -0,0 +1,59 @@
+# Create Argo Application YAML for each user supplied application
+resource "github_repository_file" "custom-application-yaml" {
+  for_each = var.argo_enabled == true ? var.applications : {}
+
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/${each.value.name}_application.yaml"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  #TODO:
+  # this allows people to make edits to the file so we don't overwrite it.
+  #lifecycle {
+  #  ignore_changes = [
+  #    content
+  #  ]
+  #}
+
+  content = <<EOT
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ${lower("${var.aws_account}-${var.region}-${var.label}-${each.value.name}")} 
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+     avp.kubernetes.io/path: ${each.value.vaultPath}
+  labels:
+    app: ${each.value.name}
+    region: ${var.region}
+    account: ${var.aws_account}
+    name: ${var.label}
+spec:
+  destination:
+    server: ${module.cluster.kubernetes_host}
+    namespace: ${each.value.namespace}
+  project: ${module.argo-registration[0].argo_project_name}
+  syncPolicy:
+    automated:
+      prune: true
+    syncOptions:
+      - CreateNamespace=${each.value.createNamespace}
+  source:
+    chart: ${each.value.chart}
+    repoURL: ${each.value.repo}
+    targetRevision: ${each.value.version}
+    plugin:
+      name: argocd-vault-plugin-helm-values-expand-no-build
+      env:
+        - name: KUBE_VERSION
+          value: "${var.k8s_version}"
+        - name: RELEASE_NAME
+          value: ${each.value.name}
+        - name: HELM_VALUES
+          value: |
+            ${indent(12, base64decode(each.value.values))}
+EOT
+}
+
diff --git a/modules/common/applications/outputs.tf b/modules/common/applications/outputs.tf
new file mode 100644
index 00000000..e69de29b
diff --git a/modules/common/applications/providers.tf b/modules/common/applications/providers.tf
new file mode 100644
index 00000000..e69de29b
diff --git a/modules/common/applications/variables.tf b/modules/common/applications/variables.tf
new file mode 100644
index 00000000..5a51866d
--- /dev/null
+++ b/modules/common/applications/variables.tf
@@ -0,0 +1,61 @@
+# Cluster variables
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+variable "k8s_version" {
+  type        = string
+  default     = "1.27"
+  description = "The EKS version to use"
+}
+
+# Applications
+variable "applications" {
+  type = map(object({
+    name            = string
+    repo            = string
+    chart           = string
+    version         = string
+    values          = string,
+    namespace       = string,
+    createNamespace = bool,
+    vaultPath       = string
+  }))
+  default = {}
+}
+
+# GitHub repo vars
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "argo_branch" {
+  description = "Branch to use on argo_repo"
+  default     = ""
+}
+
+variable "argo_path" {
+  description = "Path within the argo_repo containing yaml"
+  default     = "."
+}
+
+variable "message" {
+  type        = string
+  default     = "Managed by Terraform"
+  description = "The commit message for updates"
+}
+
diff --git a/modules/harness/main.tf b/modules/common/harness/main.tf
similarity index 100%
rename from modules/harness/main.tf
rename to modules/common/harness/main.tf
diff --git a/modules/harness/outputs.tf b/modules/common/harness/outputs.tf
similarity index 100%
rename from modules/harness/outputs.tf
rename to modules/common/harness/outputs.tf
diff --git a/modules/common/harness/providers.tf b/modules/common/harness/providers.tf
new file mode 100644
index 00000000..9561d595
--- /dev/null
+++ b/modules/common/harness/providers.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    helm = {
+      source = "hashicorp/helm"
+    }
+    utils = {
+      source = "cloudposse/utils"
+    }
+  }
+}
diff --git a/modules/harness/variables.tf b/modules/common/harness/variables.tf
similarity index 100%
rename from modules/harness/variables.tf
rename to modules/common/harness/variables.tf
diff --git a/modules/common/infra/infra.tf b/modules/common/infra/infra.tf
new file mode 100644
index 00000000..04e0e6ca
--- /dev/null
+++ b/modules/common/infra/infra.tf
@@ -0,0 +1,287 @@
+data "github_repository" "argo-github-repo" {
+  count     = var.argo_enabled == true ? 1 : 0
+  full_name = "IndicoDataSolutions/${var.argo_repo}"
+}
+
+## CRDs install
+# TODO: move to helm chart
+resource "kubernetes_secret" "harbor-pull-secret" {
+  metadata {
+    name      = "harbor-pull-secret"
+    namespace = "default"
+    annotations = {
+      "reflector.v1.k8s.emberstack.com/reflection-allowed"      = true
+      "reflector.v1.k8s.emberstack.com/reflection-auto-enabled" = true
+    }
+  }
+
+  type = "kubernetes.io/dockerconfigjson"
+
+  data = {
+    ".dockerconfigjson" = "${base64decode(var.harbor_pull_secret_b64)}"
+  }
+}
+
+resource "github_repository_file" "crds-values-yaml" {
+  count               = var.argo_enabled == true ? 1 : 0
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/helm/infra-crds-values.values"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+  content = base64decode(var.infra-crds-values-yaml-b64)
+}
+
+data "github_repository_file" "data-crds-values" {
+  count = var.argo_enabled == true ? 1 : 0
+  depends_on = [
+    github_repository_file.crds-values-yaml
+  ]
+  repository = data.github_repository.argo-github-repo[0].name
+  branch     = var.argo_branch
+  file       = var.argo_path == "." ? "helm/infra-crds-values.values" : "${var.argo_path}/helm/infra-crds-values.values"
+}
+
+resource "helm_release" "infra-crds" {
+  verify           = false
+  name             = "infra-crds"
+  create_namespace = true
+  namespace        = "default"
+  repository       = var.ipa_repo
+  chart            = "infra-crds"
+  version          = var.infra_crds_version
+  wait             = true
+  timeout          = "1800" # 30 minutes
+
+  values = [
+    <<EOF
+  crunchy-pgo:
+    enabled: true
+    updateCRDs: 
+      enabled: true
+
+  
+  cert-manager:
+    nodeSelector:
+      kubernetes.io/os: linux
+    webhook:
+      nodeSelector:
+        kubernetes.io/os: linux
+    cainjector:
+      nodeSelector:
+        kubernetes.io/os: linux
+    enabled: true
+    installCRDs: true
+EOF
+    ,
+    <<EOT
+${var.argo_enabled == true ? data.github_repository_file.data-crds-values[0].content : base64decode(var.infra-crds-values-yaml-b64)}
+EOT
+  ]
+}
+
+## Pre-reqs install - cert-manager, reflector, etc.
+data "vault_kv_secret_v2" "zerossl_data" {
+  mount = var.vault_mount_path
+  name  = "zerossl"
+}
+
+resource "github_repository_file" "infra-pre-reqs-values-yaml" {
+  count               = var.argo_enabled == true ? 1 : 0
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/helm/infra-pre-reqs-values.values"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+  content = base64decode(var.infra-pre-reqs-values-yaml-b64)
+}
+
+data "github_repository_file" "data-infra-pre-reqs-values" {
+  count = var.argo_enabled == true ? 1 : 0
+
+  depends_on = [
+    github_repository_file.infra-pre-reqs-values-yaml
+  ]
+  repository = data.github_repository.argo-github-repo[0].name
+  branch     = var.argo_branch
+  file       = var.argo_path == "." ? "helm/infra-pre-reqs-values.values" : "${var.argo_path}/helm/infra-pre-reqs-values.values"
+}
+
+resource "time_sleep" "wait_1_minutes_after_crds" {
+  depends_on = [helm_release.infra-crds]
+
+  create_duration = "1m"
+}
+
+locals {
+  efs_values = var.include_efs == true ? [<<EOF
+  aws-fsx-csi-driver:
+    enabled: false
+  aws-efs-csi-driver:
+    enabled: true
+  storage:
+    indicoStorageClass:
+      enabled: true
+      name: indico-sc
+      provisioner: efs.csi.aws.com
+      parameters:
+        provisioningMode: efs-ap
+        fileSystemId: ${var.efs_filesystem_id}
+        directoryPerms: "700"
+        gidRangeStart: "1000" # optional
+        gidRangeEnd: "2000" # optional
+        basePath: "/dynamic_provisioning" # optional
+ EOF
+  ] : []
+  fsx_values = var.include_fsx == true ? [<<EOF
+  aws-fsx-csi-driver:
+    enabled: true
+  aws-efs-csi-driver:
+    enabled: ${var.local_registry_enabled} 
+  storage:
+    indicoStorageClass:
+      enabled: true
+      name: indico-sc
+      provisioner: fsx.csi.aws.com
+      parameters:
+        securityGroupIds: ${var.security_group_id}
+        subnetId: ${var.fsx_rwx_subnet_id}
+ EOF
+  ] : []
+  storage_spec = var.include_fsx == true ? local.fsx_values : local.efs_values
+
+
+  the_splits            = var.dns_name != "" ? split(".", var.dns_name) : split(".", "test.domain.com")
+  the_length            = length(local.the_splits)
+  the_tld               = local.the_splits[local.the_length - 1]
+  the_domain            = local.the_splits[local.the_length - 2]
+  alternate_domain_root = join(".", [local.the_domain, local.the_tld])
+  enable_external_dns   = var.use_static_ssl_certificates == false ? true : false
+  dns_configuration_values = var.is_alternate_account_domain == "false" ? (<<EOT
+clusterIssuer:
+  additionalSolvers:
+    - dns01:
+        route53:
+          region: ${var.region}
+      selector:
+        matchLabels:
+          "acme.cert-manager.io/dns01-solver": "true"
+  EOT
+    ) : (<<EOT
+clusterIssuer:
+  additionalSolvers:
+    - dns01:
+        route53:
+          region: ${var.region}
+          role: ${var.aws_primary_dns_role_arn}
+      selector:
+        matchLabels:
+          "acme.cert-manager.io/dns01-solver": "true"
+external-dns:
+  enabled: ${local.enable_external_dns}
+alternate-external-dns:
+  enabled: true
+  logLevel: debug
+  policy: sync
+  txtOwnerId: "${var.dns_name}-${var.label}-${var.region}"
+  domainFilters:
+    - ${local.alternate_domain_root}
+  extraArgs:
+    - "--exclude-domains=${var.aws_account}.indico.io"
+    - "--aws-assume-role=${var.aws_primary_dns_role_arn}"
+
+  provider: aws
+  aws:
+    zoneType: public
+    region: ${var.region}
+
+  policy: sync
+  sources:
+    - ingress
+EOT
+  )
+}
+
+resource "helm_release" "ipa-pre-requisites" {
+  depends_on = [
+    time_sleep.wait_1_minutes_after_crds,
+    null_resource.update_storage_class
+  ]
+
+  verify           = false
+  name             = "infra-pre-reqs"
+  create_namespace = true
+  namespace        = "default"
+  repository       = var.ipa_repo
+  chart            = "infra-pre-reqs"
+  version          = var.infra_pre_reqs_version
+  wait             = false
+  timeout          = "1800" # 30 minutes
+  disable_webhooks = false
+
+  values = concat(local.storage_spec, [<<EOF
+cluster:
+  cloudProvider: aws
+  name: ${var.label}
+  region: ${var.region}
+  domain: indico.io
+  account: ${var.aws_account}
+
+secrets:
+  clusterIssuer:
+    zerossl:
+      create: true
+      eabEmail: devops-sa@indico.io
+      eabKid: "${jsondecode(data.vault_kv_secret_v2.zerossl_data.data_json)["EAB_KID"]}"
+      eabHmacKey: "${jsondecode(data.vault_kv_secret_v2.zerossl_data.data_json)["EAB_HMAC_KEY"]}"
+
+${local.dns_configuration_values}
+external-dns:
+  enabled: ${local.enable_external_dns}
+  logLevel: debug
+  policy: sync
+  txtOwnerId: "${var.label}-${var.region}"
+  domainFilters:
+    - ${lower(var.aws_account)}.indico.io.
+
+  provider: aws
+  aws:
+    zoneType: public
+    region: ${var.region}
+
+  policy: sync
+  sources:
+    - service
+    - ingress
+aws-for-fluent-bit:
+  enabled: true
+  cloudWatchLogs:
+    region: ${var.region}
+    logGroupName: "/aws/eks/fluentbit-cloudwatch/${var.label}/logs"
+    logGroupTemplate: "/aws/eks/fluentbit-cloudwatch/${var.label}/workload/$kubernetes['namespace_name']"
+cluster-autoscaler:
+  cluster-autoscaler:
+    awsRegion: ${var.region}
+    image:
+      tag: "v1.20.0"
+    autoDiscovery:
+      clusterName: "${var.label}"
+EOF
+    ,
+    <<EOT
+${var.argo_enabled == true ? data.github_repository_file.data-infra-pre-reqs-values[0].content : base64decode(var.infra-pre-reqs-values-yaml-b64)}
+EOT
+  ])
+}
diff --git a/modules/common/infra/on_prem.tf b/modules/common/infra/on_prem.tf
new file mode 100644
index 00000000..16049486
--- /dev/null
+++ b/modules/common/infra/on_prem.tf
@@ -0,0 +1,166 @@
+#To DO:
+# Install nfs server
+# get ip of service
+# install nfs driver with IP
+# make nfs sc the default
+# install pre-reqs etc.
+
+resource "kubectl_manifest" "nfs_volume" {
+  count     = var.on_prem_test == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1000Gi
+YAML
+}
+
+resource "kubectl_manifest" "nfs_server" {
+  depends_on = [
+    kubectl_manifest.nfs_volume
+  ]
+  count     = var.on_prem_test == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nfs-server
+spec:
+  selector:
+    matchLabels:
+      app: nfs-server
+  template:
+    metadata:
+      labels:
+        app: nfs-server
+    spec:
+      containers:
+      - name: nfs-server
+        image: k8s.gcr.io/volume-nfs:0.8
+        ports:
+        - name: nfs
+          containerPort: 2049
+        - name: mountd
+          containerPort: 20048
+        - name: rpcbind
+          containerPort: 111
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: storage
+          mountPath: /nfs-storage
+        resources:
+          requests:
+            cpu: 450m
+            memory: 2Gi
+      volumes:
+      - name: storage
+        persistentVolumeClaim:
+            claimName: nfs-pvc
+YAML
+}
+resource "kubectl_manifest" "nfs_server_service" {
+  depends_on = [
+    kubectl_manifest.nfs_server
+  ]
+  count     = var.on_prem_test == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: v1
+kind: Service
+metadata:
+  name: nfs-service
+spec:
+  ports:
+  - name: nfs
+    port: 2049
+  - name: mountd
+    port: 20048
+  - name: rpcbind
+    port: 111
+  selector:
+    app: nfs-server # must match with the label of NFS pod
+YAML
+}
+
+
+data "local_file" "nfs_ip" {
+  count      = var.on_prem_test == true ? 1 : 0
+  filename   = "${path.module}/nfs_server_ip.txt"
+  depends_on = ["null_resource.get_nfs_server_ip"]
+}
+
+
+resource "null_resource" "get_nfs_server_ip" {
+  count = var.on_prem_test == true ? 1 : 0
+  depends_on = [
+    kubectl_manifest.nfs_server_service
+  ]
+
+  triggers = {
+    always_run = "${timestamp()}"
+  }
+  provisioner "local-exec" {
+    command = "curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && chmod +x kubectl"
+  }
+
+  provisioner "local-exec" {
+    command = "aws eks update-kubeconfig --name ${var.label} --region ${var.region}"
+  }
+
+  provisioner "local-exec" {
+    command = "pwd && ls -lah"
+  }
+
+  provisioner "local-exec" {
+    command = "./kubectl get service nfs-service -o jsonpath='{.spec.clusterIP}' > ${path.module}/nfs_server_ip.txt"
+  }
+
+  provisioner "local-exec" {
+    command = "./kubectl get pods --no-headers | grep nfs-server | awk '{print $1}'| xargs -I {} sh -c './kubectl exec {} -- sh -c \"mkdir -p /exports/nfs-storage\"'"
+  }
+
+}
+
+resource "helm_release" "nfs-provider" {
+  count      = var.on_prem_test == true ? 1 : 0
+  name       = "nfs-subdir-external-provisioner"
+  repository = "https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner"
+  chart      = "nfs-subdir-external-provisioner"
+  version    = "4.0.18"
+  namespace  = "default"
+  depends_on = [
+    kubectl_manifest.nfs_server_service,
+    data.local_file.nfs_ip
+  ]
+
+  // prometheus URL
+  set {
+    name  = "nfs.server"
+    value = data.local_file.nfs_ip[0].content
+  }
+}
+
+resource "null_resource" "update_storage_class" {
+  count = var.on_prem_test == true ? 1 : 0
+  depends_on = [
+    helm_release.nfs-provider
+  ]
+
+  triggers = {
+    always_run = "${timestamp()}"
+  }
+
+  provisioner "local-exec" {
+    command = "./kubectl patch storageclass gp2 -p '{\"metadata\": {\"annotations\":{\"storageclass.kubernetes.io/is-default-class\":\"false\"}}}'"
+  }
+
+  provisioner "local-exec" {
+    command = "./kubectl patch storageclass nfs-client -p '{\"metadata\": {\"annotations\":{\"storageclass.kubernetes.io/is-default-class\":\"true\"}}}'"
+  }
+}
diff --git a/modules/common/infra/providers.tf b/modules/common/infra/providers.tf
new file mode 100644
index 00000000..8602abd0
--- /dev/null
+++ b/modules/common/infra/providers.tf
@@ -0,0 +1,16 @@
+terraform {
+  required_providers {
+    github = {
+      source = "integrations/github"
+    }
+    helm = {
+      source = "hashicorp/helm"
+    }
+    kubectl = {
+      source = "gavinbunney/kubectl"
+    }
+    vault = {
+      source = "hashicorp/vault"
+    }
+  }
+}
diff --git a/modules/common/infra/variables.tf b/modules/common/infra/variables.tf
new file mode 100644
index 00000000..ce8bc450
--- /dev/null
+++ b/modules/common/infra/variables.tf
@@ -0,0 +1,143 @@
+variable "harbor_pull_secret_b64" {
+  sensitive   = true
+  type        = string
+  description = "Harbor pull secret from Vault"
+}
+
+variable "vault_mount_path" {
+  type    = string
+  default = "terraform"
+}
+
+# GitHub repo vars
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "argo_branch" {
+  description = "Branch to use on argo_repo"
+  default     = ""
+}
+
+variable "argo_repo" {
+  description = "Branch to use on argo_repo"
+  default     = ""
+}
+
+variable "argo_path" {
+  description = "Path within the argo_repo containing yaml"
+  default     = "."
+}
+
+variable "message" {
+  type        = string
+  default     = "Managed by Terraform"
+  description = "The commit message for updates"
+}
+
+# Helm variables
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+variable "dns_name" {
+  type        = string
+  default     = ".indico.io"
+  description = "DNS name"
+}
+
+variable "ipa_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "infra_crds_version" {
+  type    = string
+  default = "0.2.1"
+}
+
+variable "infra-crds-values-yaml-b64" {
+  default = "Cg=="
+}
+
+variable "infra_pre_reqs_version" {
+  type    = string
+  default = "0.2.1"
+}
+
+variable "infra-pre-reqs-values-yaml-b64" {
+  default = "Cg=="
+}
+
+variable "include_efs" {
+  type        = bool
+  default     = true
+  description = "Create efs"
+}
+
+variable "efs_filesystem_id" {
+  type        = string
+  default     = ""
+  description = "EFS id if EFS is enabled"
+}
+
+variable "include_fsx" {
+  type        = bool
+  default     = false
+  description = "Create a fsx file system(s)"
+}
+
+variable "security_group_id" {
+  type        = string
+  default     = ""
+  description = "FSX security group id if FSX is enabled"
+}
+
+variable "fsx_rwx_subnet_id" {
+  type        = string
+  default     = ""
+  description = "FSX subnet id if FSX is enabled"
+}
+
+variable "local_registry_enabled" {
+  type    = bool
+  default = false
+}
+
+variable "use_static_ssl_certificates" {
+  type        = bool
+  default     = false
+  description = "use static ssl certificates for clusters which cannot use certmanager and external dns."
+}
+
+variable "is_alternate_account_domain" {
+  type        = string
+  default     = "false"
+  description = "domain name is controlled by a different aws account"
+}
+
+variable "aws_primary_dns_role_arn" {
+  type        = string
+  default     = ""
+  description = "The AWS arn for the role needed to manage route53 DNS in a different account."
+}
+
+# Storage class change
+variable "on_prem_test" {
+  type    = bool
+  default = false
+}
diff --git a/modules/common/intake/intake.tf b/modules/common/intake/intake.tf
new file mode 100644
index 00000000..e8008287
--- /dev/null
+++ b/modules/common/intake/intake.tf
@@ -0,0 +1,504 @@
+locals {
+  storage_class = var.on_prem_test == false ? "encrypted-gp2" : "nfs-client"
+
+  alb_ipa_values = var.enable_waf == true ? (<<EOT
+app-edge:
+  alternateDomain: ""
+  service:
+    type: "NodePort"
+    ports:
+      http_port: 31755
+      http_api_port: 31270
+  nginx:
+    httpPort: 8080
+  aws-load-balancer-controller:
+    enabled: true
+    aws-load-balancer-controller:
+      enabled: true
+      clusterName: ${var.label}
+    ingress:
+      enabled: true
+      useStaticCertificate: ${var.use_static_ssl_certificates}
+      labels:
+        indico.io/cluster: ${var.label}
+      tls:
+        - secretName: ${var.ssl_static_secret_name}
+          hosts:
+            - ${var.dns_name}
+      alb:
+        publicSubnets: ${join(",", var.public_subnet_ids)}
+        wafArn: ${var.waf_arn}
+        acmArn: ${var.acm_arn}
+      service:
+        name: app-edge
+        port: 8080
+      hosts:
+        - host: ${var.dns_name}
+          paths:
+            - path: /
+              pathType: Prefix
+  EOT
+    ) : (<<EOT
+app-edge:
+  alternateDomain: ""
+  image:
+    registry: ${var.local_registry_enabled ? "local-registry.${var.dns_name}" : "harbor.devops.indico.io"}/indico
+EOT 
+  )
+
+  efs_values = var.include_efs == true ? [<<EOF
+  storage:
+    pvcSpec:
+      volumeMode: Filesystem
+      mountOptions: []
+      csi:
+        driver: efs.csi.aws.com
+        volumeHandle: ${var.efs_filesystem_id}
+ EOF
+  ] : []
+  fsx_values = var.include_fsx == true ? [<<EOF
+  storage:
+    pvcSpec:
+      csi:
+        driver: fsx.csi.aws.com
+        volumeAttributes:
+          dnsname: ${var.fsx_rwx.dns_name}
+          mountname: ${var.fsx_rwx.mount_name}
+        volumeHandle: ${var.fsx_rwx.id}
+ EOF
+  ] : []
+  storage_spec = var.include_fsx == true ? local.fsx_values : local.efs_values
+
+  local_registry_tf_cod_values = var.local_registry_enabled == true ? (<<EOT
+global:
+  imagePullSecrets: 
+    - name: local-pull-secret
+    - name: harbor-pull-secret
+  image:
+    registry: local-registry.${var.dns_name}/indico
+
+app-edge:
+  image:
+    registry: local-registry.${var.dns_name}/indico
+  EOT
+    ) : (<<EOT
+# not using local_registry
+  EOT
+  )
+
+  runtime_scanner_ingress_values = var.use_static_ssl_certificates == true ? (<<EOT
+ingress:
+  enabled: true
+  useStaticCertificate: true
+  className: "nginx"
+  annotations:
+    nginx.ingress.kubernetes.io/auth-type: basic
+    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - alternate'
+    nginx.ingress.kubernetes.io/auth-secret: runtime-scanner-auth
+  
+  useDefaultResolver: true
+  labels: {}
+  hosts:
+    - host: scan
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: 
+    - secretName: ${var.ssl_static_secret_name}
+      hosts:
+        - scan
+  EOT
+    ) : (<<EOT
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: zerossl
+EOT
+  )
+}
+
+data "github_repository" "argo-github-repo" {
+  count     = var.argo_enabled == true ? 1 : 0
+  full_name = "IndicoDataSolutions/${var.argo_repo}"
+}
+
+resource "github_repository_file" "pre-reqs-values-yaml" {
+  count               = var.argo_enabled == true ? 1 : 0
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/helm/pre-reqs-values.values"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+  content = base64decode(var.pre-reqs-values-yaml-b64)
+}
+
+data "github_repository_file" "data-pre-reqs-values" {
+  count = var.argo_enabled == true ? 1 : 0
+
+  depends_on = [
+    github_repository_file.pre-reqs-values-yaml
+  ]
+  repository = data.github_repository.argo-github-repo[0].name
+  branch     = var.argo_branch
+  file       = var.argo_path == "." ? "helm/pre-reqs-values.values" : "${var.argo_path}/helm/pre-reqs-values.values"
+}
+
+resource "helm_release" "ipa-pre-requisites" {
+  verify           = false
+  name             = "ipa-pre-reqs"
+  create_namespace = true
+  namespace        = "default"
+  repository       = var.ipa_repo
+  chart            = "ipa-pre-requisites"
+  version          = var.ipa_pre_reqs_version
+  wait             = false
+  timeout          = "1800" # 30 minutes
+  disable_webhooks = false
+
+  values = concat(local.storage_spec, [<<EOF
+
+cluster:
+  cloudProvider: aws
+  name: ${var.label}
+  region: ${var.region}
+  domain: indico.io
+  account: ${var.aws_account}
+  argoRepo: ${var.argo_repo}
+  argoBranch: ${var.argo_branch}
+  argoPath: ${var.argo_path}
+  ipaVersion: ${var.ipa_version}
+  ipaPreReqsVersion: ${var.ipa_pre_reqs_version}
+
+secrets:
+  rabbitmq:
+    create: true
+  general:
+    create: true
+
+crunchy-postgres:
+  enabled: true
+  postgres-data:
+    enabled: true
+    metadata:
+      annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+    instances:
+    - affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node_group
+                operator: In
+                values:
+                - pgo-workers
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: postgres-operator.crunchydata.com/cluster
+                operator: In
+                values:
+                - postgres-data
+              - key: postgres-operator.crunchydata.com/instance-set
+                operator: In
+                values:
+                - pgha1
+            topologyKey: kubernetes.io/hostname
+      metadata:
+        annotations:
+          reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+          reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      dataVolumeClaimSpec:
+        storageClassName: ${local.storage_class}
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 200Gi
+      name: pgha1
+      replicas: ${var.az_count}
+      resources:
+        requests:
+          cpu: 1000m
+          memory: 3000Mi
+      tolerations:
+        - effect: NoSchedule
+          key: indico.io/crunchy
+          operator: Exists
+    pgBackRestConfig:
+      global:
+        archive-timeout: '10000'
+        repo1-path: /pgbackrest/postgres-data/repo1
+        repo1-retention-full: '5'
+        repo1-s3-key-type: auto
+        repo1-s3-kms-key-id: "${var.key_arn}"
+        repo1-s3-role: ${var.s3_role_id}
+      repos:
+      - name: repo1
+        s3:
+          bucket: ${var.pgbackup_s3_bucket_name}
+          endpoint: s3.${var.region}.amazonaws.com
+          region: ${var.region}
+        schedules:
+          full: 30 4 * * 0 # Full backup weekly at 4:30am Sunday
+          differential: 0 0 * * * # Diff backup daily at midnight
+      jobs:
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 3000Mi
+    imagePullSecrets:
+      - name: harbor-pull-secret
+  postgres-metrics:
+    enabled: false
+    metadata:
+      annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+    instances:
+    - affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node_group
+                operator: In
+                values:
+                - pgo-workers
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: postgres-operator.crunchydata.com/cluster
+                operator: In
+                values:
+                - postgres-metrics
+              - key: postgres-operator.crunchydata.com/instance-set
+                operator: In
+                values:
+                - pgha1
+            topologyKey: kubernetes.io/hostname
+      metadata:
+        annotations:
+          reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+          reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      dataVolumeClaimSpec:
+        storageClassName: ${local.storage_class}
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 100Gi
+      name: pgha1
+      replicas: 2
+      resources:
+        requests:
+          cpu: 500m
+          memory: 3000Mi
+      tolerations:
+        - effect: NoSchedule
+          key: indico.io/crunchy
+          operator: Exists
+    pgBackRestConfig:
+      global:
+        archive-timeout: '10000'
+        repo1-path: /pgbackrest/postgres-metrics/repo1
+        repo1-retention-full: '5'
+        repo1-s3-key-type: auto
+        repo1-s3-kms-key-id: "${var.key_arn}"
+        repo1-s3-role: ${var.s3_role_id}
+      repos:
+      - name: repo1
+        s3:
+          bucket: ${var.pgbackup_s3_bucket_name}
+          endpoint: s3.${var.region}.amazonaws.com
+          region: ${var.region}
+        schedules:
+          full: 30 4 * * 0 # Full backup weekly at 4:30am Sunday
+          differential: 0 0 * * * # Diff backup daily at midnight
+      jobs:
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 3000Mi
+    imagePullSecrets:
+      - name: harbor-pull-secret
+aws-load-balancer-controller:
+  enabled: ${var.use_acm}
+  aws-load-balancer-controller:
+    clusterName: ${var.label}
+    vpcId: ${var.indico_vpc_id}
+    region: ${var.region}
+EOF
+    ,
+    <<EOT
+${var.argo_enabled == true ? data.github_repository_file.data-pre-reqs-values[0].content : ""}
+EOT
+  ])
+}
+
+resource "time_sleep" "wait_1_minutes_after_pre_reqs" {
+  depends_on = [helm_release.ipa-pre-requisites]
+
+  create_duration = "1m"
+}
+
+
+
+resource "github_repository_file" "alb-values-yaml" {
+  count               = var.argo_enabled == true ? 1 : 0
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/helm/alb.values"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+
+  content = local.alb_ipa_values
+}
+
+resource "github_repository_file" "argocd-application-yaml" {
+  count               = var.argo_enabled == true ? 1 : 0
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/ipa_application.yaml"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+  content = <<EOT
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ${lower("${var.aws_account}.${var.region}.${var.label}-ipa")}
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  labels:
+    app: cod
+    region: ${var.region}
+    account: ${var.aws_account}
+    name: ${var.label}
+  annotations:
+    avp.kubernetes.io/path: tools/argo/data/ipa-deploy
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  ignoreDifferences:
+    - group: apps
+      jsonPointers:
+        - /spec/replicas
+      kind: Deployment
+  destination:
+    server: ${var.kubernetes_host}
+    namespace: default
+  project: ${var.argo_project_name}
+  syncPolicy:
+    automated:
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+  source:
+    chart: ipa
+    repoURL: ${var.ipa_repo}
+    targetRevision: ${var.ipa_version}
+    plugin:
+      name: argocd-vault-plugin-helm-values-expand-no-build
+      env:
+        - name: KUBE_VERSION
+          value: "${var.k8s_version}"
+
+        - name: RELEASE_NAME
+          value: ipa
+        
+        - name: HELM_TF_COD_VALUES
+          value: |
+            global:
+              image:
+                registry: ${var.local_registry_enabled ? "local-registry.${var.dns_name}" : "harbor.devops.indico.io"}/indico
+            ${indent(12, local.local_registry_tf_cod_values)}
+            runtime-scanner:
+              enabled: ${replace(lower(var.aws_account), "indico", "") == lower(var.aws_account) ? "false" : "true"}
+              authentication:
+                ingressUser: monitoring
+                ingressPassword: ${var.monitoring_password}
+                ${indent(14, local.runtime_scanner_ingress_values)} 
+            ${indent(12, local.alb_ipa_values)}         
+
+        - name: HELM_VALUES
+          value: |
+            ${base64decode(var.ipa_values)}    
+EOT
+}
+
+
+resource "argocd_application" "ipa" {
+  depends_on = [
+    time_sleep.wait_1_minutes_after_pre_reqs,
+    kubernetes_job.snapshot-restore-job,
+    github_repository_file.argocd-application-yaml,
+  ]
+
+  count = var.argo_enabled == true ? 1 : 0
+
+  wait = true
+
+  metadata {
+    name      = lower("${var.aws_account}-${var.region}-${var.label}-deploy-ipa")
+    namespace = var.argo_namespace
+    labels = {
+      test = "true"
+    }
+  }
+
+  spec {
+    project = var.argo_project_name
+
+    source {
+      repo_url        = "https://github.com/IndicoDataSolutions/${var.argo_repo}.git"
+      path            = var.argo_path
+      target_revision = var.argo_branch
+      directory {
+        exclude = "cod.yaml"
+        recurse = false
+        jsonnet {
+        }
+      }
+    }
+    sync_policy {
+      automated {
+        prune       = true
+        self_heal   = false
+        allow_empty = false
+      }
+    }
+
+    destination {
+      #server    = "https://kubernetes.default.svc"
+      name      = "in-cluster"
+      namespace = var.argo_namespace
+    }
+  }
+
+  timeouts {
+    create = "30m"
+    delete = "30m"
+  }
+}
+
diff --git a/modules/common/intake/providers.tf b/modules/common/intake/providers.tf
new file mode 100644
index 00000000..10651343
--- /dev/null
+++ b/modules/common/intake/providers.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    argocd = {
+      source = "oboukili/argocd"
+    }
+    github = {
+      source = "integrations/github"
+    }
+    helm = {
+      source = "hashicorp/helm"
+    }
+    kubectl = {
+      source = "gavinbunney/kubectl"
+    }
+    time = {
+      source = "hashicorp/time"
+    }
+  }
+}
diff --git a/modules/common/intake/smoketest.tf b/modules/common/intake/smoketest.tf
new file mode 100644
index 00000000..2eba1085
--- /dev/null
+++ b/modules/common/intake/smoketest.tf
@@ -0,0 +1,65 @@
+
+resource "github_repository_file" "smoketest-application-yaml" {
+  count = var.ipa_smoketest_enabled == true && var.argo_enabled == true ? 1 : 0
+
+  repository          = data.github_repository.argo-github-repo[0].name
+  branch              = var.argo_branch
+  file                = "${var.argo_path}/ipa_smoketest.yaml"
+  commit_message      = var.message
+  overwrite_on_create = true
+
+  lifecycle {
+    ignore_changes = [
+      content
+    ]
+  }
+
+  content = <<EOT
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ${lower("${var.aws_account}.${var.region}.${var.label}-smoketest")}
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  labels:
+    app: cod
+    region: ${var.region}
+    account: ${var.aws_account}
+    name: ${var.label}
+  annotations:
+    avp.kubernetes.io/path: tools/argo/data/ipa-deploy
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    server: ${var.kubernetes_host}
+    namespace: default
+  project: ${var.argo_project_name}
+  syncPolicy:
+    automated:
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
+  source:
+    chart: cod-smoketests
+    repoURL: ${var.ipa_smoketest_repo}
+    targetRevision: ${var.ipa_smoketest_version}
+    plugin:
+      name: argocd-vault-plugin-helm-values-expand-no-build
+      env:
+        - name: KUBE_VERSION
+          value: "${var.k8s_version}"
+
+        - name: RELEASE_NAME
+          value: run
+      
+        - name: HELM_VALUES
+          value: |
+            cluster:
+              name: ${var.label}
+              region: ${var.region}
+              account: ${var.aws_account}
+            host: ${var.dns_name}
+            ${indent(12, base64decode(var.ipa_smoketest_values))}    
+EOT
+}
diff --git a/snapshot.tf b/modules/common/intake/snapshot.tf
similarity index 100%
rename from snapshot.tf
rename to modules/common/intake/snapshot.tf
diff --git a/modules/common/intake/variables.tf b/modules/common/intake/variables.tf
new file mode 100644
index 00000000..8097c974
--- /dev/null
+++ b/modules/common/intake/variables.tf
@@ -0,0 +1,254 @@
+# Cluster metadata
+variable "dns_name" {
+  type        = string
+  default     = ".indico.io"
+  description = "DNS name"
+}
+
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+# DNS
+variable "use_static_ssl_certificates" {
+  type        = bool
+  default     = false
+  description = "use static ssl certificates for clusters which cannot use certmanager and external dns."
+}
+
+variable "ssl_static_secret_name" {
+  type        = string
+  default     = "indico-ssl-static-cert"
+  description = "secret_name for static ssl certificate"
+}
+
+variable "is_alternate_account_domain" {
+  type        = string
+  default     = "false"
+  description = "domain name is controlled by a different aws account"
+}
+
+variable "aws_primary_dns_role_arn" {
+  type        = string
+  default     = ""
+  description = "The AWS arn for the role needed to manage route53 DNS in a different account."
+}
+
+# Helm
+variable "ipa_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "argo_namespace" {
+  type    = string
+  default = ""
+}
+
+variable "argo_repo" {
+  description = "Argo Github Repository containing the IPA Application"
+  default     = ""
+}
+
+variable "argo_branch" {
+  description = "Branch to use on argo_repo"
+  default     = ""
+}
+
+variable "argo_path" {
+  description = "Path within the argo_repo containing yaml"
+  default     = "."
+}
+
+variable "message" {
+  type        = string
+  default     = "Managed by Terraform"
+  description = "The commit message for updates"
+}
+
+variable "ipa_pre_reqs_version" {
+  type    = string
+  default = "0.4.0"
+}
+
+variable "pre-reqs-values-yaml-b64" {
+  default = "Cg=="
+}
+
+variable "ipa_version" {
+  type    = string
+  default = "0.12.1"
+}
+
+variable "ipa_values" {
+  type    = string
+  default = ""
+}
+
+variable "az_count" {
+  type        = number
+  default     = 2
+  description = "Number of availability zones for nodes"
+
+  validation {
+    condition     = var.az_count > 0 && var.az_count <= 3
+    error_message = "The az_count must be in the range 1-3"
+  }
+}
+
+variable "key_arn" {
+  type        = string
+  description = ""
+}
+
+variable "s3_role_id" {
+  type        = string
+  description = ""
+}
+
+variable "pgbackup_s3_bucket_name" {
+  type        = string
+  description = ""
+}
+
+variable "use_acm" {
+  type        = bool
+  default     = false
+  description = "create cluster that will use acm"
+}
+
+variable "kubernetes_host" {
+  type        = string
+  description = ""
+}
+
+variable "indico_vpc_id" {
+  type        = string
+  description = ""
+}
+
+variable "public_subnet_ids" {
+  description = "Public subnet ids of the cluster"
+  default     = []
+}
+
+variable "argo_project_name" {
+  type        = string
+  description = ""
+}
+
+variable "k8s_version" {
+  type        = string
+  default     = "1.27"
+  description = "The EKS version to use"
+}
+
+variable "local_registry_enabled" {
+  type    = bool
+  default = false
+}
+
+variable "on_prem_test" {
+  type    = bool
+  default = false
+}
+
+variable "enable_waf" {
+  type        = bool
+  default     = false
+  description = "enables aws alb controller for app-edge, also creates waf rules."
+}
+
+variable "waf_arn" {
+  type        = string
+  description = "waf acl web arn"
+  default     = ""
+}
+
+variable "acm_arn" {
+  type        = string
+  description = "acm cert validation arn"
+  default     = ""
+}
+
+variable "include_efs" {
+  type        = bool
+  default     = true
+  description = "Create efs"
+}
+
+variable "efs_filesystem_id" {
+  type        = string
+  description = "EFS filesystem id"
+  default     = ""
+}
+
+variable "include_fsx" {
+  type        = bool
+  default     = false
+  description = "Create a fsx file system(s)"
+}
+
+variable "fsx_rwx" {
+  description = "fsx_rwx object from infra module output"
+  default     = {}
+}
+
+variable "monitoring_password" {
+  type        = string
+  description = "Generated password for monitoring"
+  sensitive   = true
+  default     = ""
+}
+
+# Smoketest
+variable "ipa_smoketest_values" {
+  type    = string
+  default = "Cg==" # empty newline string
+}
+
+variable "ipa_smoketest_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "ipa_smoketest_version" {
+  type    = string
+  default = "0.1.8"
+}
+
+variable "ipa_smoketest_enabled" {
+  type    = bool
+  default = true
+}
+
+# Snapshot 
+variable "restore_snapshot_enabled" {
+  default     = false
+  type        = bool
+  description = "Flag for restoring cluster from snapshot"
+}
+
+variable "restore_snapshot_name" {
+  type        = string
+  default     = ""
+  description = "Name of snapshot in account's s3 bucket"
+}
diff --git a/modules/common/local-registry/local-registry.tf b/modules/common/local-registry/local-registry.tf
new file mode 100644
index 00000000..111f3726
--- /dev/null
+++ b/modules/common/local-registry/local-registry.tf
@@ -0,0 +1,196 @@
+data "vault_kv_secret_v2" "account-robot-credentials" {
+  mount = "customer-${var.aws_account}"
+  name  = "harbor-registry"
+}
+
+resource "aws_efs_access_point" "local-registry" {
+  root_directory {
+    path = "/registry"
+    creation_info {
+      owner_gid   = 1000
+      owner_uid   = 1000
+      permissions = "0777"
+    }
+  }
+
+  posix_user {
+    gid = 1000
+    uid = 1000
+  }
+  file_system_id = var.efs_filesystem_id
+}
+
+
+# TODO: move all kubernetes resources here to the helm chart
+resource "kubernetes_persistent_volume_claim" "local-registry" {
+  depends_on = [
+    kubernetes_namespace.local-registry,
+    kubernetes_persistent_volume.local-registry
+  ]
+
+  metadata {
+    name      = "local-registry"
+    namespace = "local-registry"
+  }
+  spec {
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = "local-registry"
+    resources {
+      requests = {
+        storage = "100Gi"
+      }
+    }
+    volume_name = "local-registry"
+  }
+}
+
+resource "kubernetes_persistent_volume" "local-registry" {
+  metadata {
+    name = "local-registry"
+  }
+
+  spec {
+    capacity = {
+      storage = "100Gi"
+    }
+
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = "local-registry"
+
+    persistent_volume_source {
+      csi {
+        driver        = "efs.csi.aws.com"
+        volume_handle = "${var.efs_filesystem_id}::${aws_efs_access_point.local-registry.id}"
+      }
+    }
+  }
+}
+
+resource "kubernetes_namespace" "local-registry" { #TODO: set create_namespace = true for local-registry
+  metadata {
+    name = "local-registry"
+  }
+}
+
+resource "kubernetes_storage_class_v1" "local-registry" { #TODO: add to local-registry helm chart
+  metadata {
+    name = "local-registry"
+  }
+
+  storage_provisioner = "efs.csi.aws.com"
+  reclaim_policy      = "Retain"
+}
+
+resource "helm_release" "local-registry" {
+  depends_on = [
+    kubernetes_namespace.local-registry,
+    kubernetes_persistent_volume_claim.local-registry
+  ]
+
+  verify           = false
+  name             = "local-registry"
+  create_namespace = true
+  namespace        = "local-registry"
+  repository       = var.ipa_repo
+  chart            = "local-registry"
+  version          = var.local_registry_version
+  wait             = false
+  timeout          = "1800" # 30 minutes
+  disable_webhooks = false
+
+  values = [<<EOF
+cert-manager:
+  enabled: false
+
+ingress-nginx:
+  enabled: true
+  
+  controller:
+    ingressClass: nginx-internal
+    ingressClassResource:
+      controllerValue: "k8s.io/ingress-nginx-internal"
+      name: nginx-internal
+    admissionWebhooks:
+      enabled: false
+    autoscaling:
+      enabled: true
+      maxReplicas: 12
+      minReplicas: 6
+      targetCPUUtilizationPercentage: 50
+      targetMemoryUtilizationPercentage: 50
+    resources:
+      requests:
+        cpu: 1
+        memory: 2Gi
+    service:
+      external:
+        enabled: false
+      internal:
+        annotations:
+          service.beta.kubernetes.io/aws-load-balancer-internal: "true"
+        enabled: true
+
+docker-registry:
+  service:
+    annotations: 
+      external-dns.alpha.kubernetes.io/hostname: "local-registry.${var.dns_name}"
+  extraEnvVars:
+  - name: GOGC
+    value: "50"
+  ingress:
+    className: nginx-internal
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: zerossl
+      kubernetes.io/ingress.class: nginx-internal
+      service.beta.kubernetes.io/aws-load-balancer-internal: "true"
+
+    labels: 
+      acme.cert-manager.io/dns01-solver: "true"
+    hosts:
+    - local-registry.${var.dns_name}
+    tls:
+    - hosts:
+      - local-registry.${var.dns_name}
+      secretName: registry-tls
+  
+  persistence:
+    deleteEnabled: true
+    enabled: true
+    size: 100Gi
+    existingClaim: local-registry
+    storageClass: local-registry
+
+  proxy:
+    enabled: true
+    remoteurl: https://harbor.devops.indico.io
+    secretRef: remote-access
+  replicaCount: 3
+  
+  secrets:
+    htpasswd: local-user:${var.htpasswd_bcrypt}
+
+localPullSecret:
+  password: ${var.general_password}
+  secretName: local-pull-secret
+  username: local-user
+
+metrics-server:
+  apiService:
+    create: true
+  enabled: false
+
+proxyRegistryAccess:
+  proxyPassword: ${jsondecode(data.vault_kv_secret_v2.account-robot-credentials.data_json)["harbor_password"]}
+  proxyPullSecretName: remote-access
+  proxyUrl: https://harbor.devops.indico.io
+  proxyUsername: ${jsondecode(data.vault_kv_secret_v2.account-robot-credentials.data_json)["harbor_username"]}
+  
+registryUrl: local-registry.${var.dns_name}
+restartCronjob:
+  cronSchedule: 0 0 */3 * *
+  disabled: false
+  image: bitnami/kubectl:1.20.13
+  EOF
+  ]
+}
diff --git a/modules/common/local-registry/providers.tf b/modules/common/local-registry/providers.tf
new file mode 100644
index 00000000..3cc6ab0d
--- /dev/null
+++ b/modules/common/local-registry/providers.tf
@@ -0,0 +1,16 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    helm = {
+      source = "hashicorp/helm"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+    vault = {
+      source = "hashicorp/vault"
+    }
+  }
+}
diff --git a/modules/common/local-registry/variables.tf b/modules/common/local-registry/variables.tf
new file mode 100644
index 00000000..9f4725f9
--- /dev/null
+++ b/modules/common/local-registry/variables.tf
@@ -0,0 +1,41 @@
+# Cluster info
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+# Helm variables
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "ipa_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "local_registry_version" {
+  type    = string
+  default = "unused"
+}
+
+variable "dns_name" {
+  type        = string
+  description = "dns name for the cluster"
+}
+
+variable "efs_filesystem_id" {
+  type        = string
+  description = "id for local-registry efs filesystem"
+}
+
+variable "htpasswd_bcrypt" {
+  description = "Generated htpasswd"
+  sensitive   = true
+}
+
+variable "general_password" {
+  description = "Generated general password"
+  sensitive   = true
+}
diff --git a/modules/common/monitoring/monitoring.tf b/modules/common/monitoring/monitoring.tf
new file mode 100644
index 00000000..c0215da0
--- /dev/null
+++ b/modules/common/monitoring/monitoring.tf
@@ -0,0 +1,312 @@
+locals {
+  thanos_config = var.thanos_enabled == true ? (<<EOT
+      thanos: # this is the one being used
+        blockSize: 5m
+        objectStorageConfig:
+          existingSecret:
+            name: thanos-storage
+            key: thanos_storage.yaml
+  EOT
+    ) : (<<EOT
+      thanos: {}
+  EOT
+  )
+
+  alerting_configuration_values = var.alerting_enabled == false ? (<<EOT
+noExtraConfigs: true
+  EOT
+    ) : (<<EOT
+alerting:
+  enabled: true
+  email:
+    enabled: ${var.alerting_email_enabled}
+    smarthost: '${var.alerting_email_host}'
+    from: '${var.alerting_email_from}'
+    auth_username: '${var.alerting_email_username}'
+    auth_password: '${var.alerting_email_password}'
+    targetEmail: "${var.alerting_email_to}"
+  slack:
+    enabled: ${var.alerting_slack_enabled}
+    apiUrl: ${var.alerting_slack_token}
+    channel: ${var.alerting_slack_channel}
+  pagerDuty:
+    enabled: ${var.alerting_pagerduty_enabled}
+    integrationKey: ${var.alerting_pagerduty_integration_key}
+    integrationUrl: "https://events.pagerduty.com/generic/2010-04-15/create_event.json"
+EOT
+  )
+  kube_prometheus_stack_values = var.use_static_ssl_certificates == true ? (<<EOT
+  alertmanager:
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+      enabled: true
+      ingressClassName: nginx
+      hosts:
+        - alertmanager-${var.dns_name}
+      paths:
+        - /
+      tls:
+        - secretName: ${var.ssl_static_secret_name}
+          hosts:
+            - alertmanager-${var.dns_name}
+  prometheus:
+    annotations:
+      reloader.stakater.com/auto: "true"
+
+    thanosServiceMonitor:
+      enabled: ${var.thanos_enabled}
+
+    thanosService:
+      enabled:  ${var.thanos_enabled}
+
+    prometheusSpec:
+      disableCompaction: ${var.thanos_enabled}
+      externalLabels:
+        clusterAccount: ${var.aws_account}
+        clusterRegion: ${var.region}
+        clusterName: ${var.label}
+        clusterFullName: ${lower("${var.aws_account}-${var.region}-${var.label}")}
+${local.thanos_config}
+      nodeSelector:
+        node_group: static-workers
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+      ingressClassName: nginx
+      hosts:
+        - prometheus-${var.dns_name}
+      paths:
+        - /
+      tls:
+        - secretName: ${var.ssl_static_secret_name}
+          hosts:
+            - prometheus-${var.dns_name}
+  grafana:
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+      enabled: true
+      ingressClassName: nginx
+      hosts:
+        - grafana-${var.dns_name}
+      path: /
+      tls:
+        - secretName: ${var.ssl_static_secret_name}
+          hosts:
+            - grafana-${var.dns_name}
+  EOT
+    ) : (<<EOT
+  alertmanager:
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+
+  prometheus:
+    annotations:
+      reloader.stakater.com/auto: "true"
+
+    thanosServiceMonitor:
+      enabled: ${var.thanos_enabled}
+
+    thanosService:
+      enabled: ${var.thanos_enabled}
+    
+    prometheusSpec:
+      disableCompaction: ${var.thanos_enabled}
+      externalLabels:
+        clusterAccount: ${var.aws_account}
+        clusterRegion: ${var.region}
+        clusterName: ${var.label}
+        clusterFullName: ${lower("${var.aws_account}-${var.region}-${var.label}")}
+${local.thanos_config}
+      nodeSelector:
+        node_group: static-workers
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+  grafana:
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: zerossl
+      labels:
+        acme.cert-manager.io/dns01-solver: "true"
+EOT
+  )
+}
+
+resource "random_password" "monitoring-password" {
+  length  = 16
+  special = false
+}
+
+resource "helm_release" "monitoring" {
+
+  verify           = false
+  name             = "monitoring"
+  create_namespace = true
+  namespace        = "monitoring"
+  repository       = var.ipa_repo
+  chart            = "monitoring"
+  version          = var.monitoring_version
+  wait             = false
+  timeout          = "900" # 15 minutes
+  skip_crds        = true
+
+  values = [<<EOF
+global:
+  host: "${var.dns_name}"
+
+ingress-nginx:
+  enabled: true
+
+  rbac:
+    create: true
+
+  admissionWebhooks:
+    patch:
+      nodeSelector.beta.kubernetes.io/os: linux
+
+  defaultBackend:
+    nodeSelector.beta.kubernetes.io/os: linux
+
+authentication:
+  ingressUsername: monitoring
+  ingressPassword: ${random_password.monitoring-password.result}
+
+${local.alerting_configuration_values}
+kube-prometheus-stack:
+${local.kube_prometheus_stack_values}
+EOF
+  ]
+}
+
+resource "helm_release" "keda-monitoring" {
+  depends_on = [
+    helm_release.monitoring
+  ]
+
+  name             = "keda"
+  create_namespace = true
+  namespace        = "default"
+  repository       = "https://kedacore.github.io/charts"
+  chart            = "keda"
+  version          = var.keda_version
+
+
+  values = [<<EOF
+    image:
+      metricsApiServer:
+        repository: harbor.devops.indico.io/ghcr.io/kedacore/keda-metrics-apiserver
+      webhooks:
+        repository: harbor.devops.indico.io/ghcr.io/kedacore/keda-admission-webhooks
+      keda:
+        repository: harbor.devops.indico.io/ghcr.io/kedacore/keda
+    imagePullSecrets:
+      - name: harbor-pull-secret
+    resources:
+      operator:
+        requests:
+          memory: 512Mi
+        limits:
+          memory: 2Gi
+        
+    crds:
+      install: true
+    
+    podAnnotations:
+      keda:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+      metricsAdapter: 
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "9022"
+
+    prometheus:
+      metricServer:
+        enabled: true
+        podMonitor:
+          enabled: true
+      operator:
+        enabled: true
+        podMonitor:
+          enabled: true
+ EOF
+  ]
+}
+
+resource "helm_release" "opentelemetry-collector" {
+  depends_on = [
+    helm_release.monitoring
+  ]
+
+  name             = "opentelemetry-collector"
+  create_namespace = true
+  namespace        = "default"
+  repository       = "https://open-telemetry.github.io/opentelemetry-helm-charts"
+  chart            = "opentelemetry-collector"
+  version          = var.opentelemetry-collector_version
+
+
+  values = [<<EOF
+    enabled: true
+    imagePullSecrets:
+      - name: harbor-pull-secret
+    image:
+      repository: harbor.devops.indico.io/docker.io/otel/opentelemetry-collector-contrib
+    fullnameOverride: "collector-collector"
+    mode: deployment
+    tolerations:
+    - effect: NoSchedule
+      key: indico.io/monitoring
+      operator: Exists
+    nodeSelector:
+      node_group: monitoring-workers
+    ports:
+      jaeger-compact:
+        enabled: false
+      jaeger-thrift:
+        enabled: false
+      jaeger-grpc:
+        enabled: false
+      zipkin:
+        enabled: false
+
+    config:
+      receivers:
+        jaeger: null
+        prometheus: null
+        zipkin: null
+      exporters:
+        otlp:
+          endpoint: monitoring-tempo.monitoring.svc:4317
+          tls:
+            insecure: true
+      service:
+        pipelines:
+          traces:
+            receivers:
+              - otlp
+            processors:
+              - batch
+            exporters:
+              - otlp
+          metrics: null
+          logs: null
+ EOF
+  ]
+}
+
diff --git a/modules/common/monitoring/outputs.tf b/modules/common/monitoring/outputs.tf
new file mode 100644
index 00000000..f5192f59
--- /dev/null
+++ b/modules/common/monitoring/outputs.tf
@@ -0,0 +1,8 @@
+output "monitoring-username" {
+  value = "monitoring"
+}
+
+output "monitoring-password" {
+  sensitive = true
+  value     = random_password.monitoring-password.result
+}
diff --git a/modules/common/monitoring/providers.tf b/modules/common/monitoring/providers.tf
new file mode 100644
index 00000000..30545f0e
--- /dev/null
+++ b/modules/common/monitoring/providers.tf
@@ -0,0 +1,15 @@
+terraform {
+  required_providers {
+    helm = {
+      source = "hashicorp/helm"
+    }
+    kubectl = {
+      source                = "gavinbunney/kubectl"
+      configuration_aliases = [kubectl.thanos-kubectl]
+    }
+    random = {
+      source = "hashicorp/random"
+    }
+  }
+}
+
diff --git a/modules/common/monitoring/thanos.tf b/modules/common/monitoring/thanos.tf
new file mode 100644
index 00000000..a898a571
--- /dev/null
+++ b/modules/common/monitoring/thanos.tf
@@ -0,0 +1,79 @@
+
+resource "kubectl_manifest" "thanos-datasource-credentials" {
+  count     = var.thanos_enabled ? 1 : 0
+  provider  = kubectl.thanos-kubectl
+  yaml_body = <<YAML
+apiVersion: v1
+stringData:
+  admin-password: ${random_password.monitoring-password.result}
+kind: Secret
+metadata:
+  name: ${replace(var.dns_name, ".", "-")}
+  namespace: default
+type: Opaque
+  YAML
+}
+
+resource "kubectl_manifest" "thanos-datasource" {
+  count      = var.thanos_enabled ? 1 : 0
+  depends_on = [kubectl_manifest.thanos-datasource-credentials]
+  provider   = kubectl.thanos-kubectl
+  yaml_body  = <<YAML
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: ${replace(var.dns_name, ".", "-")}
+  namespace: default
+spec:
+  valuesFrom:
+    - targetPath: "secureJsonData.basicAuthPassword"
+      valueFrom:
+        secretKeyRef:
+          name: ${replace(var.dns_name, ".", "-")}
+          key: admin-password
+  datasource:
+    basicAuth: true
+    basicAuthUser: monitoring
+    editable: false
+    access: proxy
+    editable: true
+    jsonData:
+      timeInterval: 5s
+      tlsSkipVerify: true
+    name: ${var.dns_name}
+    secureJsonData:
+      basicAuthPassword: $${admin-password}
+    type: prometheus
+    url: https://prometheus.${var.dns_name}/prometheus
+  instanceSelector:
+    matchLabels:
+      dashboards: external-grafana
+  YAML
+}
+
+resource "kubectl_manifest" "thanos-storage-secret" {
+  count     = var.thanos_enabled ? 1 : 0
+  yaml_body = <<YAML
+    apiVersion: "secrets.hashicorp.com/v1beta1"
+    kind: "VaultStaticSecret"
+    metadata:
+      name:  vault-thanos-storage
+      namespace: default
+    spec:
+      type: "kv-v2"
+      namespace: default
+      mount: customer-Indico-Devops
+      path: thanos-storage
+      refreshAfter: 60s
+      rolloutRestartTargets:
+        - name: prometheus-monitoring-kube-prometheus-prometheus
+          kind: StatefulSet
+      destination:
+        annotations:
+          reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+          reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+        create: true
+        name: thanos-storage
+      vaultAuthRef: default
+  YAML
+}
diff --git a/modules/common/monitoring/variables.tf b/modules/common/monitoring/variables.tf
new file mode 100644
index 00000000..74b24bc3
--- /dev/null
+++ b/modules/common/monitoring/variables.tf
@@ -0,0 +1,144 @@
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+# Install
+variable "ipa_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "monitoring_version" {
+  type    = string
+  default = "0.3.3"
+}
+
+variable "keda_version" {
+  default = "2.11.2"
+}
+
+variable "opentelemetry-collector_version" {
+  default = "0.30.0"
+}
+
+# Thanos
+variable "thanos_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
+
+variable "vault_address" {
+  type    = string
+  default = "https://vault.devops.indico.io"
+}
+
+# Alerting
+variable "alerting_enabled" {
+  type        = bool
+  default     = false
+  description = "enable alerts"
+}
+
+variable "alerting_slack_enabled" {
+  type        = bool
+  default     = false
+  description = "enable alerts via slack"
+}
+
+variable "alerting_pagerduty_enabled" {
+  type        = bool
+  default     = false
+  description = "enable alerts via pagerduty"
+}
+
+variable "alerting_email_enabled" {
+  type        = bool
+  default     = false
+  description = "enable alerts via email"
+}
+
+variable "alerting_slack_token" {
+  type        = string
+  default     = "blank"
+  description = "Secret url with embedded token needed for slack webhook delivery."
+}
+
+variable "alerting_slack_channel" {
+  type        = string
+  default     = "blank"
+  description = "Slack channel for sending notifications from alertmanager."
+}
+
+variable "alerting_pagerduty_integration_key" {
+  type        = string
+  default     = "blank"
+  description = "Secret pagerduty_integration_key."
+}
+
+variable "alerting_email_from" {
+  type        = string
+  default     = "blank"
+  description = "alerting_email_from."
+}
+
+variable "alerting_email_to" {
+  type        = string
+  default     = "blank"
+  description = "alerting_email_to"
+}
+
+variable "alerting_email_host" {
+  type        = string
+  default     = "blank"
+  description = "alerting_email_host"
+}
+
+variable "alerting_email_username" {
+  type        = string
+  default     = "blank"
+  description = "alerting_email_username"
+}
+
+variable "alerting_email_password" {
+  type        = string
+  default     = "blank"
+  description = "alerting_email_password"
+}
+
+# Static SSL
+variable "use_static_ssl_certificates" {
+  type        = bool
+  default     = false
+  description = "use static ssl certificates for clusters which cannot use certmanager and external dns."
+}
+
+variable "ssl_static_secret_name" {
+  type        = string
+  default     = "indico-ssl-static-cert"
+  description = "secret_name for static ssl certificate"
+}
+
+# DNS
+variable "dns_name" {
+  type        = string
+  description = "dns name for the cluster"
+}
+
diff --git a/modules/common/terraform-smoketest/smoketest.tf b/modules/common/terraform-smoketest/smoketest.tf
new file mode 100644
index 00000000..95bb0479
--- /dev/null
+++ b/modules/common/terraform-smoketest/smoketest.tf
@@ -0,0 +1,59 @@
+data "vault_kv_secret_v2" "harbor-api-token" {
+  count = var.argo_enabled == true ? 1 : 0
+  mount = "tools/argo"
+  name  = "harbor-api"
+}
+
+resource "null_resource" "wait-for-tf-cod-chart-build" {
+  count = var.argo_enabled == true ? 1 : 0
+
+  depends_on = [
+    time_sleep.wait_1_minutes_after_pre_reqs
+  ]
+
+  triggers = {
+    always_run = "${timestamp()}"
+  }
+
+  provisioner "local-exec" {
+    environment = {
+      HARBOR_API_TOKEN = jsondecode(data.vault_kv_secret_v2.harbor-api-token[0].data_json)["bearer_token"]
+    }
+    command = "${path.module}/validate_chart.sh terraform-smoketests 0.1.0-${data.external.git_information.result.branch}-${substr(data.external.git_information.result.sha, 0, 8)}"
+  }
+}
+
+data "external" "git_information" {
+  program = ["sh", "${path.module}/get_sha.sh"]
+}
+
+resource "helm_release" "terraform-smoketests" {
+
+  depends_on = [
+    null_resource.wait-for-tf-cod-chart-build,
+    #null_resource.sleep-5-minutes-wait-for-charts-smoketest-build,
+    kubernetes_config_map.terraform-variables,
+    helm_release.monitoring
+  ]
+
+  verify           = false
+  name             = "terraform-smoketests-${substr(data.external.git_information.result.sha, 0, 8)}"
+  namespace        = "default"
+  repository       = var.ipa_repo
+  chart            = "terraform-smoketests"
+  version          = "0.1.0-${data.external.git_information.result.branch}-${substr(data.external.git_information.result.sha, 0, 8)}"
+  wait             = true
+  wait_for_jobs    = true
+  timeout          = "300" # 5 minutes
+  disable_webhooks = false
+  values = [<<EOF
+  cluster:
+    cloudProvider: aws
+    account: ${var.aws_account}
+    region: ${var.region}
+    name: ${var.label}
+  image:
+    tag: "${substr(data.external.git_information.result.sha, 0, 8)}"
+  EOF
+  ]
+}
diff --git a/modules/common/terraform-smoketest/variables.tf b/modules/common/terraform-smoketest/variables.tf
new file mode 100644
index 00000000..91daa553
--- /dev/null
+++ b/modules/common/terraform-smoketest/variables.tf
@@ -0,0 +1,28 @@
+# Cluster info
+variable "aws_account" {
+  type        = string
+  description = "The Name of the AWS Acccount this cluster lives in"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-east-1"
+  description = "The AWS region in which to launch the indico stack"
+}
+
+variable "label" {
+  type        = string
+  default     = "indico"
+  description = "The unique string to be prepended to resources names"
+}
+
+# Helm variables
+variable "ipa_repo" {
+  type    = string
+  default = "https://harbor.devops.indico.io/chartrepo/indico-charts"
+}
+
+variable "argo_enabled" {
+  type    = bool
+  default = true
+}
\ No newline at end of file
diff --git a/modules/common/vault-secrets-operator-setup/operator-setup.tf b/modules/common/vault-secrets-operator-setup/operator-setup.tf
index dedf8e65..e39a6439 100644
--- a/modules/common/vault-secrets-operator-setup/operator-setup.tf
+++ b/modules/common/vault-secrets-operator-setup/operator-setup.tf
@@ -1,3 +1,6 @@
+locals {
+  account_region_name = lower("${var.account}-${var.region}-${var.name}")
+}
 
 resource "kubernetes_service_account_v1" "vault-auth-default" {
   metadata {
@@ -84,3 +87,91 @@ resource "vault_kubernetes_auth_backend_role" "vault-auth-role" {
   token_policies                   = [vault_policy.vault-auth-policy.name]
   audience                         = var.audience
 }
+
+resource "helm_release" "ipa-vso" {
+  depends_on       = [vault_kubernetes_auth_backend_role.vault-auth-role]
+  verify           = false
+  name             = "ipa-vso"
+  create_namespace = true
+  namespace        = "default"
+  repository       = "https://helm.releases.hashicorp.com"
+  chart            = "vault-secrets-operator"
+  version          = "0.4.2"
+  wait             = true
+  values = [
+    <<EOF
+  controller: 
+    imagePullSecrets:
+      - name: harbor-pull-secret
+    kubeRbacProxy:
+      image:
+        repository: harbor.devops.indico.io/gcr.io/kubebuilder/kube-rbac-proxy
+      resources:
+        limits:
+          cpu: 500m
+          memory: 1024Mi
+        requests:
+          cpu: 500m
+          memory: 512Mi
+    manager:
+      image:
+        repository: harbor.devops.indico.io/docker.io/hashicorp/vault-secrets-operator
+      resources:
+        limits:
+          cpu: 500m
+          memory: 1024Mi
+        requests:
+          cpu: 500m
+          memory: 512Mi
+
+  defaultAuthMethod:
+    enabled: true
+    namespace: default
+    method: kubernetes
+    mount: ${local.account_region_name}
+    kubernetes:
+      role: ${vault_kubernetes_auth_backend_role.vault-auth-role.role_name}
+      tokenAudiences: ["vault"]
+      serviceAccount: ${kubernetes_service_account_v1.vault-auth-default.metadata.0.name}
+
+  defaultVaultConnection:
+    enabled: true
+    address: ${var.vault_address}
+    skipTLSVerify: false
+    spec:
+    template:
+      spec:
+        containers:
+        - name: manager
+          args:
+          - "--client-cache-persistence-model=direct-encrypted"
+EOF
+  ]
+}
+
+
+resource "helm_release" "external-secrets" {
+  depends_on       = [vault_kubernetes_auth_backend_role.vault-auth-role]
+  verify           = false
+  name             = "external-secrets"
+  create_namespace = true
+  namespace        = "default"
+  repository       = "https://charts.external-secrets.io/"
+  chart            = "external-secrets"
+  version          = var.external_secrets_version
+  wait             = true
+
+  values = [<<EOF
+    image:
+      repository: harbor.devops.indico.io/ghcr.io/external-secrets/external-secrets
+    webhook:
+     image:
+        repository: harbor.devops.indico.io/ghcr.io/external-secrets/external-secrets
+    certController:
+      image:
+        repository: harbor.devops.indico.io/ghcr.io/external-secrets/external-secrets
+
+  EOF
+  ]
+
+}
diff --git a/modules/common/vault-secrets-operator-setup/providers.tf b/modules/common/vault-secrets-operator-setup/providers.tf
new file mode 100644
index 00000000..cf21ddfa
--- /dev/null
+++ b/modules/common/vault-secrets-operator-setup/providers.tf
@@ -0,0 +1,14 @@
+terraform {
+  required_providers {
+    helm = {
+      source = "hashicorp/helm"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+    vault = {
+      source = "hashicorp/vault"
+    }
+  }
+}
+
diff --git a/modules/common/vault-secrets-operator-setup/variables.tf b/modules/common/vault-secrets-operator-setup/variables.tf
index ba5ea492..3858aaaf 100644
--- a/modules/common/vault-secrets-operator-setup/variables.tf
+++ b/modules/common/vault-secrets-operator-setup/variables.tf
@@ -8,6 +8,4 @@ variable "audience" {
   default = "vault"
 }
 
-locals {
-  account_region_name = lower("${var.account}-${var.region}-${var.name}")
-}
+variable "external_secrets_version" {}
diff --git a/modules/harness/versions.tf b/modules/harness/versions.tf
deleted file mode 100644
index 69722c55..00000000
--- a/modules/harness/versions.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-terraform {
-  required_providers {
-    helm = {
-      source  = "hashicorp/helm"
-      version = "2.11.0"
-    }
-    utils = {
-      source  = "cloudposse/utils"
-      version = ">= 0.14.0"
-    }
-  }
-}
\ No newline at end of file
diff --git a/old-terraform/main.tf b/old-terraform/main.tf
new file mode 100644
index 00000000..02b83abb
--- /dev/null
+++ b/old-terraform/main.tf
@@ -0,0 +1,92 @@
+
+locals {
+  argo_app_name           = lower("${var.aws_account}.${var.region}.${var.label}-ipa")
+  argo_smoketest_app_name = lower("${var.aws_account}.${var.region}.${var.label}-smoketest")
+  argo_cluster_name       = "${var.aws_account}.${var.region}.${var.label}"
+}
+
+module "readapi_queue" {
+  count = var.enable_readapi ? 1 : 0
+  providers = {
+    azurerm = azurerm.readapi
+  }
+  source       = "app.terraform.io/indico/indico-azure-readapi-queue/mod"
+  version      = "1.0.0"
+  readapi_name = lower("${var.aws_account}-${var.label}-s")
+}
+
+locals {
+  readapi_secret_path = var.environment == "production" ? "prod-readapi" : "dev-readapi"
+}
+
+data "vault_kv_secret_v2" "readapi_secret" {
+  mount = "customer-${var.aws_account}"
+  name  = local.readapi_secret_path
+}
+
+resource "kubernetes_secret" "readapi" {
+  count      = var.enable_readapi ? 1 : 0
+  depends_on = [module.cluster]
+  metadata {
+    name = "readapi-secret"
+  }
+
+  data = {
+    billing                       = data.vault_kv_secret_v2.readapi_secret.data["computer_vision_api_url"]
+    apikey                        = data.vault_kv_secret_v2.readapi_secret.data["computer_vision_api_key"]
+    READAPI_COMPUTER_VISION_HOST  = data.vault_kv_secret_v2.readapi_secret.data["computer_vision_api_url"]
+    READAPI_COMPUTER_VISION_KEY   = data.vault_kv_secret_v2.readapi_secret.data["computer_vision_api_key"]
+    READAPI_FORM_RECOGNITION_HOST = data.vault_kv_secret_v2.readapi_secret.data["form_recognizer_api_url"]
+    READAPI_FORM_RECOGNITION_KEY  = data.vault_kv_secret_v2.readapi_secret.data["form_recognizer_api_key"]
+    storage_account_name          = module.readapi_queue[0].storage_account_name
+    storage_account_id            = module.readapi_queue[0].storage_account_id
+    storage_account_access_key    = module.readapi_queue[0].storage_account_access_key
+    storage_queue_name            = module.readapi_queue[0].storage_queue_name
+    QUEUE_CONNECTION_STRING       = module.readapi_queue[0].storage_connection_string
+  }
+}
+
+module "snowflake" {
+  count                 = var.enable_weather_station == true ? 1 : 0
+  version               = "2.2.0"
+  source                = "app.terraform.io/indico/indico-aws-snowflake/mod"
+  label                 = var.label
+  additional_tags       = var.additional_tags
+  snowflake_db_name     = var.snowflake_db_name
+  kms_key_arn           = module.kms_key.key_arn
+  s3_bucket_name        = module.s3-storage.data_s3_bucket_name
+  snowflake_private_key = jsondecode(data.vault_kv_secret_v2.terraform-snowflake.data_json)["snowflake_private_key"]
+  snowflake_account     = var.snowflake_account
+  snowflake_username    = var.snowflake_username
+  region                = var.region
+  aws_account_name      = var.aws_account
+}
+
+
+module "argo-registration" {
+  count = var.argo_enabled == true ? 1 : 0
+
+  depends_on = [
+    module.cluster
+  ]
+
+  providers = {
+    kubernetes = kubernetes,
+    argocd     = argocd
+  }
+
+  source                       = "app.terraform.io/indico/indico-argo-registration/mod"
+  version                      = "1.2.1"
+  cluster_name                 = var.label
+  region                       = var.region
+  argo_password                = var.argo_password
+  argo_username                = var.argo_username
+  argo_namespace               = var.argo_namespace
+  argo_host                    = var.argo_host
+  account                      = var.aws_account
+  cloud_provider               = "aws"
+  argo_github_team_admin_group = var.argo_github_team_owner
+  endpoint                     = module.cluster.kubernetes_host
+  ca_data                      = module.cluster.kubernetes_cluster_ca_certificate
+  indico_dev_cluster           = var.aws_account == "Indico-Dev"
+}
diff --git a/acm.tf b/old-terraform/xacm.tf
similarity index 77%
rename from acm.tf
rename to old-terraform/xacm.tf
index fe511782..50a69f88 100644
--- a/acm.tf
+++ b/old-terraform/xacm.tf
@@ -1,10 +1,10 @@
 output "acm_arn" {
-    description = "arn of the acm"
-    value       = var.enable_waf == true ? aws_acm_certificate_validation.alb[0].certificate_arn : ""
+  description = "arn of the acm"
+  value       = var.enable_waf == true ? aws_acm_certificate_validation.alb[0].certificate_arn : ""
 }
 
 resource "aws_acm_certificate" "alb" {
-  count    = var.enable_waf == true ? 1 : 0
+  count             = var.enable_waf == true ? 1 : 0
   domain_name       = local.dns_name
   validation_method = "DNS"
   depends_on = [
@@ -28,15 +28,15 @@ resource "aws_route53_record" "alb" {
   ttl             = 60
   type            = each.value.type
   zone_id         = data.aws_route53_zone.primary.zone_id
-  provider = aws.dns-control
+  provider        = aws.dns-control
 }
 
 
 resource "aws_acm_certificate_validation" "alb" {
-  count    = var.enable_waf == true ? 1 : 0
+  count                   = var.enable_waf == true ? 1 : 0
   certificate_arn         = aws_acm_certificate.alb[0].arn
   validation_record_fqdns = [for record in aws_route53_record.alb : record.fqdn]
   depends_on = [
     aws_acm_certificate.alb[0]
   ]
-}
\ No newline at end of file
+}
diff --git a/aws_specific_modules.tf b/old-terraform/xaws_specific_modules.tf
similarity index 100%
rename from aws_specific_modules.tf
rename to old-terraform/xaws_specific_modules.tf
diff --git a/harness.tf b/old-terraform/xharness.tf
similarity index 100%
rename from harness.tf
rename to old-terraform/xharness.tf
diff --git a/ipa.tf b/old-terraform/xipa.tf
similarity index 100%
rename from ipa.tf
rename to old-terraform/xipa.tf
diff --git a/main.tf b/old-terraform/xmain.tf
similarity index 100%
rename from main.tf
rename to old-terraform/xmain.tf
diff --git a/monitoring.tf b/old-terraform/xmonitoring.tf
similarity index 99%
rename from monitoring.tf
rename to old-terraform/xmonitoring.tf
index 2964e8ee..69efface 100644
--- a/monitoring.tf
+++ b/old-terraform/xmonitoring.tf
@@ -146,8 +146,6 @@ EOT
   )
 }
 
-
-
 resource "aws_route53_record" "grafana-caa" {
   count   = var.monitoring_enabled == true ? 1 : 0
   zone_id = data.aws_route53_zone.primary.zone_id
@@ -160,7 +158,6 @@ resource "aws_route53_record" "grafana-caa" {
   provider = aws.dns-control
 }
 
-
 resource "aws_route53_record" "prometheus-caa" {
   count   = var.monitoring_enabled == true ? 1 : 0
   zone_id = data.aws_route53_zone.primary.zone_id
diff --git a/old-terraform/xoidc.tf b/old-terraform/xoidc.tf
new file mode 100644
index 00000000..f5169c6f
--- /dev/null
+++ b/old-terraform/xoidc.tf
@@ -0,0 +1,103 @@
+resource "null_resource" "enable-oidc" {
+  depends_on = [
+    module.cluster,
+    module.fsx-storage
+  ]
+
+  provisioner "local-exec" {
+    command = "aws --region ${var.region} eks associate-identity-provider-config --cluster-name ${var.label} --oidc identityProviderConfigName=google-ws,issuerUrl=https://keycloak.devops.indico.io/auth/realms/GoogleAuth,clientId=kube-oidc-proxy,usernameClaim=sub,usernamePrefix=oidcuser:,groupsClaim=groups,groupsPrefix=oidcgroup:"
+  }
+
+}
+
+resource "kubernetes_cluster_role_binding" "cod-role-bindings" {
+  depends_on = [
+    module.cluster
+  ]
+
+  count = var.oidc_enabled == true && strcontains(lower(var.aws_account), "indico-") ? 1 : 0
+
+  metadata {
+    name = "oidc-cod-admins"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-admin"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:Engineering"
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:QA"
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:DevOps"
+    api_group = "rbac.authorization.k8s.io"
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "eng-qa-rbac-bindings" {
+  depends_on = [
+    module.cluster
+  ]
+
+  count = var.oidc_enabled == true && strcontains(lower(var.aws_account), "indico-") ? 1 : 0
+
+  metadata {
+    name = "oidc-cod-eng-qa-admins"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-admin"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:Engineering"
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:QA"
+    api_group = "rbac.authorization.k8s.io"
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "devops-rbac-bindings" {
+  depends_on = [
+    module.cluster
+  ]
+
+  count = var.oidc_enabled == true ? 1 : 0
+
+  metadata {
+    name = "oidc-cod-devops-admins"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-admin"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = "oidcgroup:DevOps"
+    api_group = "rbac.authorization.k8s.io"
+  }
+}
+
+
diff --git a/on_prem_test.tf b/old-terraform/xon_prem_test.tf
similarity index 100%
rename from on_prem_test.tf
rename to old-terraform/xon_prem_test.tf
diff --git a/old-terraform/xsnapshot.tf b/old-terraform/xsnapshot.tf
new file mode 100644
index 00000000..b2652e86
--- /dev/null
+++ b/old-terraform/xsnapshot.tf
@@ -0,0 +1,156 @@
+resource "kubectl_manifest" "snapshot-service-account" {
+  depends_on = [
+    helm_release.ipa-pre-requisites
+  ]
+  count     = var.restore_snapshot_enabled == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: snapshots
+  namespace: default
+
+YAML
+}
+
+resource "kubectl_manifest" "snapshot-cluster-role" {
+  depends_on = [
+    helm_release.ipa-pre-requisites
+  ]
+  count     = var.restore_snapshot_enabled == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: snapshot-role
+ 
+rules:
+  - apiGroups: ["*"]
+    resources: [
+      "namespaces",
+      "secrets"
+    ]
+    verbs:  ["get", "list", "watch", "create", "patch"]
+YAML
+}
+
+resource "kubectl_manifest" "snapshot-cluster-role-binding" {
+  depends_on = [
+    helm_release.ipa-pre-requisites
+  ]
+  count     = var.restore_snapshot_enabled == true ? 1 : 0
+  yaml_body = <<YAML
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: snapshots
+ 
+subjects:
+  - kind: ServiceAccount
+    name: snapshots
+    namespace: default
+roleRef:
+  kind: ClusterRole
+  name: snapshot-role
+  apiGroup: rbac.authorization.k8s.io
+YAML
+}
+
+
+resource "kubernetes_job" "snapshot-restore-job" {
+  depends_on = [
+    helm_release.ipa-pre-requisites,
+    kubectl_manifest.snapshot-cluster-role-binding,
+    kubectl_manifest.snapshot-cluster-role,
+    kubectl_manifest.snapshot-service-account
+  ]
+
+  count = var.restore_snapshot_enabled == true ? 1 : 0
+  metadata {
+    name      = "cod-restore-snapshot"
+    namespace = "default"
+  }
+  spec {
+    completions = 1
+    template {
+      metadata {}
+      spec {
+        service_account_name = "snapshots"
+        image_pull_secrets {
+          name = "harbor-pull-secret"
+        }
+        container {
+          name              = "restore"
+          image             = "harbor.devops.indico.io/indico/cod-snapshot:latest"
+          image_pull_policy = "Always"
+          command           = ["bash", "/app/restore.sh", "${var.restore_snapshot_name}", "${lower(var.aws_account)}"]
+          env {
+            name = "DB_NAME"
+            value_from {
+              secret_key_ref {
+                name = "postgres-data-pguser-indico"
+                key  = "dbname"
+              }
+            }
+          }
+          env {
+            name = "DB_HOST"
+            value_from {
+              secret_key_ref {
+                name = "postgres-data-pguser-indico"
+                key  = "host"
+              }
+            }
+          }
+          env {
+            name = "DB_PORT"
+            value_from {
+              secret_key_ref {
+                name = "postgres-data-pguser-indico"
+                key  = "port"
+              }
+            }
+          }
+          env {
+            name = "DB_USER"
+            value_from {
+              secret_key_ref {
+                name = "postgres-data-pguser-indico"
+                key  = "user"
+              }
+            }
+          }
+          env {
+            name = "DB_PASSWORD"
+            value_from {
+              secret_key_ref {
+                name = "postgres-data-pguser-indico"
+                key  = "password"
+              }
+            }
+          }
+
+          volume_mount {
+            name       = "root-nfs"
+            mount_path = "/indicoapidata"
+          }
+        }
+        restart_policy = "Never"
+        volume {
+          name = "root-nfs"
+          persistent_volume_claim {
+            claim_name = "read-write"
+          }
+        }
+      }
+    }
+  }
+  wait_for_completion = true
+
+  # up to 30 minutes to
+  timeouts {
+    create = "30m"
+    update = "30m"
+  }
+
+}
diff --git a/waf.tf b/old-terraform/xwaf.tf
similarity index 100%
rename from waf.tf
rename to old-terraform/xwaf.tf
diff --git a/tf-smoketest-variables.tf b/tf-smoketest-variables.tf
deleted file mode 100644
index d9a6b60a..00000000
--- a/tf-smoketest-variables.tf
+++ /dev/null
@@ -1,145 +0,0 @@
-resource "kubernetes_config_map" "terraform-variables" {
-  # this file is generated via pre-commit, DO NOT EDIT !
-    depends_on = [null_resource.wait-for-tf-cod-chart-build]
-    metadata {
-      name = "terraform-variables"
-    }
-    data = {
-      is_azure = "${jsonencode(var.is_azure)}"
-    is_aws = "${jsonencode(var.is_aws)}"
-    label = "${jsonencode(var.label)}"
-    environment = "${jsonencode(var.environment)}"
-    message = "${jsonencode(var.message)}"
-    applications = "${jsonencode(var.applications)}"
-    region = "${jsonencode(var.region)}"
-    direct_connect = "${jsonencode(var.direct_connect)}"
-    additional_tags = "${jsonencode(var.additional_tags)}"
-    default_tags = "${jsonencode(var.default_tags)}"
-    vpc_cidr = "${jsonencode(var.vpc_cidr)}"
-    public_ip = "${jsonencode(var.public_ip)}"
-    vpc_name = "${jsonencode(var.vpc_name)}"
-    private_subnet_cidrs = "${jsonencode(var.private_subnet_cidrs)}"
-    public_subnet_cidrs = "${jsonencode(var.public_subnet_cidrs)}"
-    subnet_az_zones = "${jsonencode(var.subnet_az_zones)}"
-    storage_gateway_size = "${jsonencode(var.storage_gateway_size)}"
-    existing_kms_key = "${jsonencode(var.existing_kms_key)}"
-    bucket_versioning = "${jsonencode(var.bucket_versioning)}"
-    submission_expiry = "${jsonencode(var.submission_expiry)}"
-    uploads_expiry = "${jsonencode(var.uploads_expiry)}"
-    name = "${jsonencode(var.name)}"
-    cluster_name = "${jsonencode(var.cluster_name)}"
-    k8s_version = "${jsonencode(var.k8s_version)}"
-    node_groups = "${jsonencode(var.node_groups)}"
-    node_bootstrap_arguments = "${jsonencode(var.node_bootstrap_arguments)}"
-    node_user_data = "${jsonencode(var.node_user_data)}"
-    node_disk_size = "${jsonencode(var.node_disk_size)}"
-    cluster_node_policies = "${jsonencode(var.cluster_node_policies)}"
-    kms_encrypt_secrets = "${jsonencode(var.kms_encrypt_secrets)}"
-    enable_readapi = "${jsonencode(var.enable_readapi)}"
-    azure_readapi_client_id = "${jsonencode(var.azure_readapi_client_id)}"
-    azure_readapi_subscription_id = "${jsonencode(var.azure_readapi_subscription_id)}"
-    azure_readapi_tenant_id = "${jsonencode(var.azure_readapi_tenant_id)}"
-    azure_indico_io_client_id = "${jsonencode(var.azure_indico_io_client_id)}"
-    azure_indico_io_subscription_id = "${jsonencode(var.azure_indico_io_subscription_id)}"
-    azure_indico_io_tenant_id = "${jsonencode(var.azure_indico_io_tenant_id)}"
-    eks_cluster_iam_role = "${jsonencode(var.eks_cluster_iam_role)}"
-    eks_cluster_nodes_iam_role = "${jsonencode(var.eks_cluster_nodes_iam_role)}"
-    storage_capacity = "${jsonencode(var.storage_capacity)}"
-    deletion_protection_enabled = "${jsonencode(var.deletion_protection_enabled)}"
-    skip_final_snapshot = "${jsonencode(var.skip_final_snapshot)}"
-    per_unit_storage_throughput = "${jsonencode(var.per_unit_storage_throughput)}"
-    az_count = "${jsonencode(var.az_count)}"
-    snapshot_id = "${jsonencode(var.snapshot_id)}"
-    include_rox = "${jsonencode(var.include_rox)}"
-    aws_account = "${jsonencode(var.aws_account)}"
-    argo_enabled = "${jsonencode(var.argo_enabled)}"
-    argo_host = "${jsonencode(var.argo_host)}"
-    argo_repo = "${jsonencode(var.argo_repo)}"
-    argo_branch = "${jsonencode(var.argo_branch)}"
-    argo_namespace = "${jsonencode(var.argo_namespace)}"
-    argo_path = "${jsonencode(var.argo_path)}"
-    argo_github_team_owner = "${jsonencode(var.argo_github_team_owner)}"
-    ipa_repo = "${jsonencode(var.ipa_repo)}"
-    ipa_version = "${jsonencode(var.ipa_version)}"
-    ipa_smoketest_values = "${jsonencode(var.ipa_smoketest_values)}"
-    ipa_smoketest_repo = "${jsonencode(var.ipa_smoketest_repo)}"
-    ipa_smoketest_version = "${jsonencode(var.ipa_smoketest_version)}"
-    ipa_smoketest_enabled = "${jsonencode(var.ipa_smoketest_enabled)}"
-    monitoring_version = "${jsonencode(var.monitoring_version)}"
-    ipa_pre_reqs_version = "${jsonencode(var.ipa_pre_reqs_version)}"
-    ipa_crds_version = "${jsonencode(var.ipa_crds_version)}"
-    ipa_enabled = "${jsonencode(var.ipa_enabled)}"
-    ipa_values = "${jsonencode(var.ipa_values)}"
-    vault_address = "${jsonencode(var.vault_address)}"
-    vault_username = "${jsonencode(var.vault_username)}"
-    sqs_sns = "${jsonencode(var.sqs_sns)}"
-    restore_snapshot_enabled = "${jsonencode(var.restore_snapshot_enabled)}"
-    restore_snapshot_name = "${jsonencode(var.restore_snapshot_name)}"
-    oidc_enabled = "${jsonencode(var.oidc_enabled)}"
-    oidc_client_id = "${jsonencode(var.oidc_client_id)}"
-    oidc_config_name = "${jsonencode(var.oidc_config_name)}"
-    oidc_issuer_url = "${jsonencode(var.oidc_issuer_url)}"
-    oidc_groups_prefix = "${jsonencode(var.oidc_groups_prefix)}"
-    oidc_groups_claim = "${jsonencode(var.oidc_groups_claim)}"
-    oidc_username_prefix = "${jsonencode(var.oidc_username_prefix)}"
-    oidc_username_claim = "${jsonencode(var.oidc_username_claim)}"
-    monitoring_enabled = "${jsonencode(var.monitoring_enabled)}"
-    hibernation_enabled = "${jsonencode(var.hibernation_enabled)}"
-    keda_version = "${jsonencode(var.keda_version)}"
-    external_secrets_version = "${jsonencode(var.external_secrets_version)}"
-    opentelemetry_collector_version = "${jsonencode(var.opentelemetry-collector_version)}"
-    include_fsx = "${jsonencode(var.include_fsx)}"
-    include_pgbackup = "${jsonencode(var.include_pgbackup)}"
-    include_efs = "${jsonencode(var.include_efs)}"
-    performance_bucket = "${jsonencode(var.performance_bucket)}"
-    crds_values_yaml_b64 = "${jsonencode(var.crds-values-yaml-b64)}"
-    pre_reqs_values_yaml_b64 = "${jsonencode(var.pre-reqs-values-yaml-b64)}"
-    k8s_dashboard_chart_version = "${jsonencode(var.k8s_dashboard_chart_version)}"
-    enable_k8s_dashboard = "${jsonencode(var.enable_k8s_dashboard)}"
-    use_acm = "${jsonencode(var.use_acm)}"
-    enable_waf = "${jsonencode(var.enable_waf)}"
-    vault_mount_path = "${jsonencode(var.vault_mount_path)}"
-    terraform_vault_mount_path = "${jsonencode(var.terraform_vault_mount_path)}"
-    snowflake_enabled = "${jsonencode(var.snowflake_enabled)}"
-    snowflake_region = "${jsonencode(var.snowflake_region)}"
-    snowflake_username = "${jsonencode(var.snowflake_username)}"
-    snowflake_account = "${jsonencode(var.snowflake_account)}"
-    snowflake_private_key = "${jsonencode(var.snowflake_private_key)}"
-    snowflake_db_name = "${jsonencode(var.snowflake_db_name)}"
-    enable_weather_station = "${jsonencode(var.enable_weather_station)}"
-    aws_primary_dns_role_arn = "${jsonencode(var.aws_primary_dns_role_arn)}"
-    is_alternate_account_domain = "${jsonencode(var.is_alternate_account_domain)}"
-    domain_suffix = "${jsonencode(var.domain_suffix)}"
-    domain_host = "${jsonencode(var.domain_host)}"
-    alerting_enabled = "${jsonencode(var.alerting_enabled)}"
-    alerting_slack_enabled = "${jsonencode(var.alerting_slack_enabled)}"
-    alerting_pagerduty_enabled = "${jsonencode(var.alerting_pagerduty_enabled)}"
-    alerting_email_enabled = "${jsonencode(var.alerting_email_enabled)}"
-    alerting_slack_token = "${jsonencode(var.alerting_slack_token)}"
-    alerting_slack_channel = "${jsonencode(var.alerting_slack_channel)}"
-    alerting_pagerduty_integration_key = "${jsonencode(var.alerting_pagerduty_integration_key)}"
-    alerting_email_from = "${jsonencode(var.alerting_email_from)}"
-    alerting_email_to = "${jsonencode(var.alerting_email_to)}"
-    alerting_email_host = "${jsonencode(var.alerting_email_host)}"
-    alerting_email_username = "${jsonencode(var.alerting_email_username)}"
-    alerting_email_password = "${jsonencode(var.alerting_email_password)}"
-    eks_addon_version_guardduty = "${jsonencode(var.eks_addon_version_guardduty)}"
-    use_static_ssl_certificates = "${jsonencode(var.use_static_ssl_certificates)}"
-    ssl_static_secret_name = "${jsonencode(var.ssl_static_secret_name)}"
-    local_registry_version = "${jsonencode(var.local_registry_version)}"
-    local_registry_enabled = "${jsonencode(var.local_registry_enabled)}"
-    devops_tools_cluster_host = "${jsonencode(var.devops_tools_cluster_host)}"
-    thanos_grafana_admin_username = "${jsonencode(var.thanos_grafana_admin_username)}"
-    thanos_cluster_host = "${jsonencode(var.thanos_cluster_host)}"
-    thanos_cluster_name = "${jsonencode(var.thanos_cluster_name)}"
-    indico_devops_aws_region = "${jsonencode(var.indico_devops_aws_region)}"
-    thanos_enabled = "${jsonencode(var.thanos_enabled)}"
-    keycloak_enabled = "${jsonencode(var.keycloak_enabled)}"
-    terraform_smoketests_enabled = "${jsonencode(var.terraform_smoketests_enabled)}"
-    on_prem_test = "${jsonencode(var.on_prem_test)}"
-    harness_delegate = "${jsonencode(var.harness_delegate)}"
-    harness_mount_path = "${jsonencode(var.harness_mount_path)}"
-
-    }
-  }
-  
\ No newline at end of file