diff --git a/install.sh b/install.sh
index c11219cbd..3a3be01d8 100755
--- a/install.sh
+++ b/install.sh
@@ -18,6 +18,7 @@ usage(){
   /usr/bin/echo '--hostname: the server hostname to set (default: depends on system or provider)'
   /usr/bin/echo '--no-firewall: skip installing iptables with ports 22, 80 and 443 open'
   /usr/bin/echo '--gitlab: install GitLab CE on this server (default: no, set to desired GitLab address to install, e.g. gitlab.example.com)'
+  /usr/bin/echo '--ansible-version: pass an Ansible version string such as <12 for less than version 12 (default: latest)'
   /usr/bin/echo '--letsencrypt: try to create an SSL certificate with LetsEncrypt (requires DNS pointing at this server for provided GitLab URL)'
   /usr/bin/echo '--aws: enable AWS support'
   /usr/bin/echo '--docker: script is running in a Docker container'
@@ -52,6 +53,10 @@ parse_options(){
           shift
           GITLAB_URL="$1"
         ;;
+      "--ansible-version")
+          shift
+          ANSIBLE_VERSION="$1"
+        ;;
       "--letsencrypt")
           LE_SUPPORT="yes"
         ;;
@@ -84,7 +89,7 @@ FIREWALL="true"
 AWS_SUPPORT="false"
 IS_LOCAL="false"
 SERVER_HOSTNAME=$(hostname)
-ANSIBLE_VERSION="<12"
+ANSIBLE_VERSION=""
 
 # Parse options.
 parse_options "$@"
diff --git a/roles/_overrides/tasks/main.yml b/roles/_overrides/tasks/main.yml
index 18365b2e6..3fcfdd4eb 100644
--- a/roles/_overrides/tasks/main.yml
+++ b/roles/_overrides/tasks/main.yml
@@ -6,7 +6,7 @@
     loop_var: override_file
   when:
     - _overrides.files is defined
-    - _overrides.files | length
+    - _overrides.files|length > 0
 
 - name: Generate links overrides.
   ansible.builtin.include_tasks: link.yml
@@ -15,4 +15,4 @@
     loop_var: override_link
   when:
     - _overrides.links is defined
-    - _overrides.links | length
+    - _overrides.links|length > 0
diff --git a/roles/aws/aws_ami/tasks/main.yml b/roles/aws/aws_ami/tasks/main.yml
index 2973ee816..1ce621463 100644
--- a/roles/aws/aws_ami/tasks/main.yml
+++ b/roles/aws/aws_ami/tasks/main.yml
@@ -17,7 +17,7 @@
     ami_base_image_latest: "{{ ami_base_image.images | sort(attribute='creation_date') | last }}"
   when:
     - ami_base_image.images is defined
-    - ami_base_image.images
+    - ami_base_image.images|length > 0
 
 - name: Delete existing image.
   ansible.builtin.include_tasks: delete.yml
diff --git a/roles/aws/aws_ami/templates/packer.json.j2 b/roles/aws/aws_ami/templates/packer.json.j2
index faa3074a1..0a27cdbc7 100755
--- a/roles/aws/aws_ami/templates/packer.json.j2
+++ b/roles/aws/aws_ami/templates/packer.json.j2
@@ -31,7 +31,7 @@
         "owners": ["{{ aws_ami.owner }}"],
         "most_recent": true
       },
-      {% if aws_ami.vpc_filter is defined and aws_ami.vpc_filter | length > 0 %}
+      {% if aws_ami.vpc_filter is defined and aws_ami.vpc_filter|length > 0 %}
       "vpc_filter": {
         "filters": {
           "tag:Name": "{{ aws_ami.vpc_filter }}"
@@ -53,7 +53,7 @@
       "playbook_file": "{{ aws_ami.playbook_file }}",
       "inventory_directory": "{{ _ce_provision_base_dir }}/hosts",
       "ssh_authorized_key_file": "/home/{{ user_provision.username }}/.ssh/{{ aws_ami.public_key_name }}",
-      {% if aws_ami.groups is defined and aws_ami.groups | length %}
+      {% if aws_ami.groups is defined and aws_ami.groups|length > 0 %}
       "groups": {{ aws_ami.groups | to_json }},
       {% endif %}
       "ansible_env_vars":
@@ -68,7 +68,7 @@
         {% if ansible_verbosity >= 1 %}
         "-vvvv",
         {% endif %}
-        {% if _aws_ami_extra_vars is defined and _aws_ami_extra_vars | length %}
+        {% if _aws_ami_extra_vars is defined and _aws_ami_extra_vars|length > 0 %}
         "--extra-vars",
         "{{ _aws_ami_extra_vars }}",
         {% endif %}
diff --git a/roles/aws/aws_cloudfront_distribution/tasks/add_cf_function.yml b/roles/aws/aws_cloudfront_distribution/tasks/add_cf_function.yml
index a91c48477..f87ec0f7c 100644
--- a/roles/aws/aws_cloudfront_distribution/tasks/add_cf_function.yml
+++ b/roles/aws/aws_cloudfront_distribution/tasks/add_cf_function.yml
@@ -7,7 +7,7 @@
 
 - name: Setting previous command output into variable.
   ansible.builtin.set_fact:
-    _acc_id: "{{ _acc_id.stdout | from_json }}"
+    _acc_id: "{{ _acc_id.stdout }}"
 
 - name: Get CloudFront info.
   ansible.builtin.shell: "aws cloudfront get-distribution-config --id {{ _aws_cloudfront_distribution.id }} --output json > /tmp/dist-config.json"
diff --git a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml
index 2bb19d861..42e1898d4 100644
--- a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml
+++ b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml
@@ -27,7 +27,7 @@
 - name: Use provided VPC id.
   ansible.builtin.set_fact:
     _aws_ec2_autoscale_cluster_vpc_id: "{{ aws_ec2_autoscale_cluster.vpc_id }}"
-  when: aws_ec2_autoscale_cluster.vpc_name is not defined or (aws_ec2_autoscale_cluster.vpc_name | length) == 0
+  when: (aws_ec2_autoscale_cluster.vpc_name is not defined) or (aws_ec2_autoscale_cluster.vpc_name|length == 0)
 
 - name: Create matching Security Group.
   ansible.builtin.include_role:
@@ -223,113 +223,98 @@
     - aws_ec2_autoscale_cluster.type == "ecs"
 
 # EC2 - AMI BUILDING
-- name: Add RDS endpoint address to extra vars for AMI building.
-  ansible.builtin.set_fact:
-    aws_ec2_autoscale_cluster:
-      ami_extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default([]) + ['_rds_endpoint: ' + _rds_instance_info.endpoint.address] }}"
-  when:
-    - _rds_instance_info.db_instance_identifier is defined
-    - aws_ec2_autoscale_cluster.rds.rds is defined
-    - aws_ec2_autoscale_cluster.rds.rds
-    - aws_ec2_autoscale_cluster.type == "ec2"
-
-- name: Add Aurora RDS endpoint address to extra vars for AMI building.
-  ansible.builtin.set_fact:
-    aws_ec2_autoscale_cluster:
-      ami_extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default([]) + ['_rds_endpoint: ' + _rds_instance_info_aurora.endpoint.address] }}"
-  when:
-    - _rds_instance_info_aurora.db_instance_identifier is defined
-    - aws_ec2_autoscale_cluster.rds.rds is defined
-    - aws_ec2_autoscale_cluster.rds.rds
-    - aws_ec2_autoscale_cluster.type == "ec2"
-
-- name: Gather running instances information.
-  amazon.aws.ec2_instance_info:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    filters:
-      "tag:Name": "{{ aws_ec2_autoscale_cluster.name }}"
-      instance-state-name: ["running"]
-  register: aws_ec2_autoscale_cluster_running_instances
-  when:
-    - aws_ec2_autoscale_cluster.asg_refresh or aws_ec2_autoscale_cluster.ami_refresh
-    - aws_ec2_autoscale_cluster.type == "ec2"
-
-- name: Gather subnet information for temporary EC2 instance if using the 'repack' operation to generate a new AMI.
-  amazon.aws.ec2_vpc_subnet_info:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    filters:
-      vpc-id: "{{ _aws_ec2_autoscale_cluster_vpc_id }}"
-      tag:Name: "{{ aws_ec2_autoscale_cluster.ami_subnet_name }}"
-  register: _aws_ec2_autoscale_ami_subnet
-  when:
-    - aws_ec2_autoscale_cluster.ami_refresh and aws_ec2_autoscale_cluster.ami_operation == 'repack'
-    - aws_ec2_autoscale_cluster.type == "ec2"
-
-- name: Create new AMI.
-  ansible.builtin.include_role:
-    name: aws/aws_ami
-  vars:
-    aws_ami:
-      aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-      region: "{{ aws_ec2_autoscale_cluster.region }}"
-      ami_name: "{{ _aws_ec2_autoscale_cluster_unique_name }}"
-      encrypt_boot: "{{ aws_ec2_autoscale_cluster.encrypt_boot }}"
-      name_filter: "{{ aws_ec2_autoscale_cluster.packer_name_filter }}"
-      repack:
-        root_volume_type: "{{ aws_ec2_autoscale_cluster.root_volume_type }}"
-        root_volume_size: "{{ aws_ec2_autoscale_cluster.root_volume_size }}"
-        cluster_name: "{{ aws_ec2_autoscale_cluster.name }}"
-        iam_role: "{{ aws_ec2_autoscale_cluster.iam_role_name | default(omit) }}"
-        vpc_id: "{{ _aws_ec2_autoscale_cluster_vpc_id }}"
-        vpc_subnet_id: "{{ _aws_ec2_autoscale_ami_subnet.subnets[0].subnet_id | default(omit) }}"
-        key_name: "{{ aws_ec2_autoscale_cluster.key_name }}"
-        ebs_optimized: "{{ aws_ec2_autoscale_cluster.ebs_optimized }}"
-        device_name: "{{ aws_ec2_autoscale_cluster.device_name }}"
-      playbook_file: "{{ aws_ec2_autoscale_cluster.ami_playbook_file }}"
-      on_error: "{{ aws_ec2_autoscale_cluster.packer_on_error }}"
-      vpc_filter: "{{ aws_ec2_autoscale_cluster.packer_vpc_filter }}"
-      subnet_filter_az: "{{ aws_ec2_autoscale_cluster.packer_subnet_filter_az }}"
-      force: "{{ aws_ec2_autoscale_cluster.packer_force }}"
-      operation: "{% if aws_ec2_autoscale_cluster_running_instances.instances | length > 0 %}{{ aws_ec2_autoscale_cluster.ami_operation }}{% else %}create{% endif %}"
-      tags: "{{ aws_ec2_autoscale_cluster.tags }}"
-      extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default(omit) }}"
-  when:
-    - aws_ec2_autoscale_cluster.ami_refresh
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-# No register in the previous task because we might not repack the AMI so we need to look it up.
-- name: Gather AMI image from name.
-  amazon.aws.ec2_ami_info:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    owners: self
-    filters:
-      name: "{{ aws_ec2_autoscale_cluster.name }}*"
-  register: aws_ec2_autoscale_cluster_image
-  when:
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Register latest AMI image.
-  ansible.builtin.set_fact:
-    aws_ec2_autoscale_cluster_image_latest: "{{ aws_ec2_autoscale_cluster_image.images | sort(attribute='creation_date') | last }}"
-  when:
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create ami cleanup function.
-  ansible.builtin.include_role:
-    name: aws/aws_ami_asg_cleanup
-
-- name: Gather IAM role info.
-  amazon.aws.iam_role_info:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    name: "{{ aws_ec2_autoscale_cluster.iam_role_name }}"
-  register: _aws_ec2_autoscale_cluster_iam_role_info
+- name: Create an AMI for EC2 clusters.
+  when: aws_ec2_autoscale_cluster.type == "ec2"
+  block:
+    - name: Add RDS endpoint address to extra vars for AMI building.
+      ansible.builtin.set_fact:
+        aws_ec2_autoscale_cluster:
+          ami_extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default([]) + ['_rds_endpoint: ' + _rds_instance_info.endpoint.address] }}"
+      when:
+        - _rds_instance_info.db_instance_identifier is defined
+        - aws_ec2_autoscale_cluster.rds.rds is defined
+        - aws_ec2_autoscale_cluster.rds.rds
+
+    - name: Add Aurora RDS endpoint address to extra vars for AMI building.
+      ansible.builtin.set_fact:
+        aws_ec2_autoscale_cluster:
+          ami_extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default([]) + ['_rds_endpoint: ' + _rds_instance_info_aurora.endpoint.address] }}"
+      when:
+        - _rds_instance_info_aurora.db_instance_identifier is defined
+        - aws_ec2_autoscale_cluster.rds.rds is defined
+        - aws_ec2_autoscale_cluster.rds.rds
+
+    - name: Gather running instances information.
+      amazon.aws.ec2_instance_info:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        filters:
+          "tag:Name": "{{ aws_ec2_autoscale_cluster.name }}"
+          instance-state-name: ["running"]
+      register: aws_ec2_autoscale_cluster_running_instances
+      when: aws_ec2_autoscale_cluster.asg_refresh or aws_ec2_autoscale_cluster.ami_refresh
+
+    - name: Gather subnet information for temporary EC2 instance if using the 'repack' operation to generate a new AMI.
+      amazon.aws.ec2_vpc_subnet_info:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        filters:
+          vpc-id: "{{ _aws_ec2_autoscale_cluster_vpc_id }}"
+          tag:Name: "{{ aws_ec2_autoscale_cluster.ami_subnet_name }}"
+      register: _aws_ec2_autoscale_ami_subnet
+      when: aws_ec2_autoscale_cluster.ami_refresh and aws_ec2_autoscale_cluster.ami_operation == 'repack'
+
+    - name: Create new AMI.
+      ansible.builtin.include_role:
+        name: aws/aws_ami
+      vars:
+        aws_ami:
+          aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+          region: "{{ aws_ec2_autoscale_cluster.region }}"
+          ami_name: "{{ _aws_ec2_autoscale_cluster_unique_name }}"
+          encrypt_boot: "{{ aws_ec2_autoscale_cluster.encrypt_boot }}"
+          name_filter: "{{ aws_ec2_autoscale_cluster.packer_name_filter }}"
+          repack:
+            root_volume_type: "{{ aws_ec2_autoscale_cluster.root_volume_type }}"
+            root_volume_size: "{{ aws_ec2_autoscale_cluster.root_volume_size }}"
+            cluster_name: "{{ aws_ec2_autoscale_cluster.name }}"
+            iam_role: "{{ aws_ec2_autoscale_cluster.iam_role_name | default(omit) }}"
+            vpc_id: "{{ _aws_ec2_autoscale_cluster_vpc_id }}"
+            vpc_subnet_id: "{{ _aws_ec2_autoscale_ami_subnet.subnets[0].subnet_id | default(omit) }}"
+            key_name: "{{ aws_ec2_autoscale_cluster.key_name }}"
+            ebs_optimized: "{{ aws_ec2_autoscale_cluster.ebs_optimized }}"
+            device_name: "{{ aws_ec2_autoscale_cluster.device_name }}"
+          playbook_file: "{{ aws_ec2_autoscale_cluster.ami_playbook_file }}"
+          on_error: "{{ aws_ec2_autoscale_cluster.packer_on_error }}"
+          vpc_filter: "{{ aws_ec2_autoscale_cluster.packer_vpc_filter }}"
+          subnet_filter_az: "{{ aws_ec2_autoscale_cluster.packer_subnet_filter_az }}"
+          force: "{{ aws_ec2_autoscale_cluster.packer_force }}"
+          operation: "{% if aws_ec2_autoscale_cluster_running_instances.instances | length > 0 %}{{ aws_ec2_autoscale_cluster.ami_operation }}{% else %}create{% endif %}"
+          tags: "{{ aws_ec2_autoscale_cluster.tags }}"
+          extra_vars: "{{ aws_ec2_autoscale_cluster.ami_extra_vars | default(omit) }}"
+      when:
+        - aws_ec2_autoscale_cluster.ami_refresh
+        - aws_ec2_autoscale_cluster.deploy_cluster
+
+    # No register in the previous task because we might not repack the AMI so we need to look it up.
+    - name: Gather AMI image from name.
+      amazon.aws.ec2_ami_info:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        owners: self
+        filters:
+          name: "{{ aws_ec2_autoscale_cluster.name }}*"
+      register: aws_ec2_autoscale_cluster_image
+      when: aws_ec2_autoscale_cluster.deploy_cluster
+
+    - name: Register latest AMI image.
+      ansible.builtin.set_fact:
+        aws_ec2_autoscale_cluster_image_latest: "{{ aws_ec2_autoscale_cluster_image.images | sort(attribute='creation_date') | last }}"
+      when: aws_ec2_autoscale_cluster.deploy_cluster
+
+    - name: Create ami cleanup function.
+      ansible.builtin.include_role:
+        name: aws/aws_ami_asg_cleanup
 
 # LOAD BALANCING
 - name: "Create a Target group for port {{ aws_ec2_autoscale_cluster.target_group_http_port }}."
@@ -361,360 +346,321 @@
   when:
     - aws_ec2_autoscale_cluster.asg_refresh
 
-- name: Define default ALB listeners.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_listeners_http:
-      Protocol: HTTP
-      Port: "{{ aws_ec2_autoscale_cluster.alb_http_port }}"
-      DefaultActions:
-        - Type: forward
-          TargetGroupName: "{{ aws_ec2_autoscale_cluster.name }}"
-      Rules: "{{ aws_ec2_autoscale_cluster.listeners_http.rules }}"
-    _aws_ec2_autoscale_cluster_listeners_redirect:
-      Protocol: HTTP
-      Port: "{{ aws_ec2_autoscale_cluster.alb_http_port }}"
-      DefaultActions:
-        - Type: redirect
-          RedirectConfig:
-            Protocol: HTTPS
-            Host: "#{host}"
-            Query: "#{query}"
-            Path: "/#{path}"
-            Port: "{{ aws_ec2_autoscale_cluster.alb_https_port }}"
-            StatusCode: HTTP_301
-    _aws_ec2_autoscale_cluster_listeners_https:
-      Protocol: HTTPS
-      Port: "{{ aws_ec2_autoscale_cluster.alb_https_port }}"
-      SslPolicy: "{{ aws_ec2_autoscale_cluster.alb_ssl_policy }}"
-      Certificates:
-        - CertificateArn: "{{ _ssl_certificate_ARN }}"
-      DefaultActions:
-        - Type: forward
-          TargetGroupName: "{{ aws_ec2_autoscale_cluster.name }}"
-      Rules: "{{ aws_ec2_autoscale_cluster.listeners_https.rules }}"
-  when: aws_ec2_autoscale_cluster.create_elb
-
-# @TODO - we can use the aws_acm_obsolete_certificate_arn variable to tidy up previous ACM certs, if it is defined.
-
-- name: Add HTTP listeners.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_listeners: "{{ [_aws_ec2_autoscale_cluster_listeners_http] }}"
-  when:
-    - aws_ec2_autoscale_cluster.create_elb
-    - _ssl_certificate_ARN | length < 1
-
-- name: Add HTTPS Listener.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_listeners: "{{ [_aws_ec2_autoscale_cluster_listeners_redirect, _aws_ec2_autoscale_cluster_listeners_https] }}"
-  when:
-    - aws_ec2_autoscale_cluster.create_elb
-    - _ssl_certificate_ARN | length > 1
-
-- name: Add custom Listeners.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_listeners: "{{ _aws_ec2_autoscale_cluster_listeners + aws_ec2_autoscale_cluster.listeners }}"
-  when:
-    - aws_ec2_autoscale_cluster is defined
-    - aws_ec2_autoscale_cluster | length
-    - aws_ec2_autoscale_cluster.create_elb
-
-- name: Generate security group information for the ALB.
-  ansible.builtin.include_role:
-    name: aws/aws_security_groups
-  vars:
-    aws_security_groups:
-      profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-      region: "{{ aws_ec2_autoscale_cluster.region }}"
-      group_names: "{{ aws_ec2_autoscale_cluster.alb_security_groups }}"
-      return_type: ids
-  when:
-    - aws_ec2_autoscale_cluster.alb_security_groups | length > 0
-    - aws_ec2_autoscale_cluster.create_elb
-
-- name: Create the ALB.
-  amazon.aws.elb_application_lb:
-    name: "{{ aws_ec2_autoscale_cluster.name }}"
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    state: "{{ aws_ec2_autoscale_cluster.state }}"
-    tags: "{{ aws_ec2_autoscale_cluster.tags }}"
-    subnets: "{{ _aws_ec2_autoscale_cluster_public_subnets_ids }}"
-    security_groups: "{{ _aws_security_group_list + [_aws_ec2_autoscale_cluster_security_group.group_id] }}"
-    listeners: "{{ _aws_ec2_autoscale_cluster_listeners }}"
-    idle_timeout: "{{ aws_ec2_autoscale_cluster.alb_idle_timeout }}"
-  register: _aws_ec2_autoscale_cluster_alb
+- name: Build an ALB.
   when: aws_ec2_autoscale_cluster.create_elb
-
-- name: "Get ALB listener ARN for port {{ aws_ec2_autoscale_cluster.alb_https_port }}."
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_alb_listener_ARN: "{{ item.listener_arn }}"
-  when:
-    - aws_ec2_autoscale_cluster.create_elb
-    - item.port == aws_ec2_autoscale_cluster.alb_https_port
-    - aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs
-    - _ssl_certificate_ARN | length > 1
-  with_items: "{{ _aws_ec2_autoscale_cluster_alb.listeners }}"
-
-- name: Add extra SSL certificates to the ALB.
-  ansible.builtin.command:
-    cmd: "aws elbv2 add-listener-certificates --region {{ aws_ec2_autoscale_cluster.region }} --profile {{ aws_ec2_autoscale_cluster.aws_profile }} --listener-arn {{ _aws_ec2_autoscale_cluster_alb_listener_ARN }} --certificates CertificateArn={{ item }}"
-  when:
-    - aws_ec2_autoscale_cluster.create_elb
-    - aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs
-    - _ssl_certificate_ARN | length > 1
-  with_items: "{{ aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs }}"
+  block:
+    - name: Define default ALB listeners.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_listeners_http:
+          Protocol: HTTP
+          Port: "{{ aws_ec2_autoscale_cluster.alb_http_port }}"
+          DefaultActions:
+            - Type: forward
+              TargetGroupName: "{{ aws_ec2_autoscale_cluster.name }}"
+          Rules: "{{ aws_ec2_autoscale_cluster.listeners_http.rules }}"
+        _aws_ec2_autoscale_cluster_listeners_redirect:
+          Protocol: HTTP
+          Port: "{{ aws_ec2_autoscale_cluster.alb_http_port }}"
+          DefaultActions:
+            - Type: redirect
+              RedirectConfig:
+                Protocol: HTTPS
+                Host: "#{host}"
+                Query: "#{query}"
+                Path: "/#{path}"
+                Port: "{{ aws_ec2_autoscale_cluster.alb_https_port|string }}"
+                StatusCode: HTTP_301
+        _aws_ec2_autoscale_cluster_listeners_https:
+          Protocol: HTTPS
+          Port: "{{ aws_ec2_autoscale_cluster.alb_https_port }}"
+          SslPolicy: "{{ aws_ec2_autoscale_cluster.alb_ssl_policy }}"
+          Certificates:
+            - CertificateArn: "{{ _ssl_certificate_ARN }}"
+          DefaultActions:
+            - Type: forward
+              TargetGroupName: "{{ aws_ec2_autoscale_cluster.name }}"
+          Rules: "{{ aws_ec2_autoscale_cluster.listeners_https.rules }}"
+
+    # @TODO - we can use the aws_acm_obsolete_certificate_arn variable to tidy up previous ACM certs, if it is defined.
+
+    - name: Add HTTP listeners.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_listeners: "{{ [_aws_ec2_autoscale_cluster_listeners_http] }}"
+      when:
+        - _ssl_certificate_ARN|length < 1
+
+    - name: Add HTTPS Listener.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_listeners: "{{ [_aws_ec2_autoscale_cluster_listeners_redirect, _aws_ec2_autoscale_cluster_listeners_https] }}"
+      when:
+        - _ssl_certificate_ARN|length > 1
+
+    - name: Add custom Listeners.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_listeners: "{{ _aws_ec2_autoscale_cluster_listeners + aws_ec2_autoscale_cluster.listeners }}"
+      when:
+        - aws_ec2_autoscale_cluster is defined
+        - aws_ec2_autoscale_cluster|length > 0
+
+    - name: Generate security group information for the ALB.
+      ansible.builtin.include_role:
+        name: aws/aws_security_groups
+      vars:
+        aws_security_groups:
+          profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+          region: "{{ aws_ec2_autoscale_cluster.region }}"
+          group_names: "{{ aws_ec2_autoscale_cluster.alb_security_groups }}"
+          return_type: ids
+      when:
+        - aws_ec2_autoscale_cluster.alb_security_groups|length > 0
+
+    - name: Create the ALB.
+      amazon.aws.elb_application_lb:
+        name: "{{ aws_ec2_autoscale_cluster.name }}"
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        state: "{{ aws_ec2_autoscale_cluster.state }}"
+        tags: "{{ aws_ec2_autoscale_cluster.tags }}"
+        subnets: "{{ _aws_ec2_autoscale_cluster_public_subnets_ids }}"
+        security_groups: "{{ _aws_security_group_list + [_aws_ec2_autoscale_cluster_security_group.group_id] }}"
+        listeners: "{{ _aws_ec2_autoscale_cluster_listeners }}"
+        idle_timeout: "{{ aws_ec2_autoscale_cluster.alb_idle_timeout }}"
+      register: _aws_ec2_autoscale_cluster_alb
+
+    - name: "Get ALB listener ARN for port {{ aws_ec2_autoscale_cluster.alb_https_port }}."
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_alb_listener_ARN: "{{ item.listener_arn }}"
+      when:
+        - item.port == aws_ec2_autoscale_cluster.alb_https_port
+        - aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs|length > 0
+        - _ssl_certificate_ARN|length > 1
+      with_items: "{{ _aws_ec2_autoscale_cluster_alb.listeners }}"
+
+    - name: Add extra SSL certificates to the ALB.
+      ansible.builtin.command:
+        cmd: "aws elbv2 add-listener-certificates --region {{ aws_ec2_autoscale_cluster.region }} --profile {{ aws_ec2_autoscale_cluster.aws_profile }} --listener-arn {{ _aws_ec2_autoscale_cluster_alb_listener_ARN }} --certificates CertificateArn={{ item }}"
+      when:
+        - aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs|length > 0
+        - _ssl_certificate_ARN|length > 1
+      with_items: "{{ aws_ec2_autoscale_cluster.ssl_extra_certificate_ARNs }}"
 
 # EC2 - BUILD ASG
-- name: Generate security group information for the ASG.
-  ansible.builtin.include_role:
-    name: aws/aws_security_groups
-  vars:
-    aws_security_groups:
-      profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-      region: "{{ aws_ec2_autoscale_cluster.region }}"
-      group_names: "{{ aws_ec2_autoscale_cluster.cluster_security_groups }}"
-      return_type: ids
-  when:
-    - aws_ec2_autoscale_cluster.cluster_security_groups | length > 0
-    - aws_ec2_autoscale_cluster.asg_refresh
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create launch template.
-  amazon.aws.ec2_launch_template:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    name: "{{ aws_ec2_autoscale_cluster.name }}"
-    image_id: "{{ aws_ec2_autoscale_cluster.image_id if aws_ec2_autoscale_cluster.image_id is defined else aws_ec2_autoscale_cluster_image_latest.image_id }}"
-    key_name: "{{ aws_ec2_autoscale_cluster.key_name }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    state: "{{ aws_ec2_autoscale_cluster.state }}"
-    instance_type: "{{ aws_ec2_autoscale_cluster.instance_type }}"
-    iam_instance_profile: "{{ _aws_ec2_autoscale_cluster_iam_role_info.iam_roles[0].instance_profiles[0].arn }}"
-    disable_api_termination: "{{ aws_ec2_autoscale_cluster.instance_disable_api_termination }}"
-    ebs_optimized: "{{ aws_ec2_autoscale_cluster.ebs_optimized }}"
-    network_interfaces:
-      - associate_public_ip_address: "{{ aws_ec2_autoscale_cluster.assign_public_ip }}"
-        delete_on_termination: "{{ aws_ec2_autoscale_cluster.instance_nic_delete_on_termination }}"
-        subnet_id: "{{ subnet_id }}" # picked randomly from _aws_ec2_autoscale_cluster_subnets_ids, see with_random_choice
-        device_index: 0 # must be 0 - see https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface
-        groups: "{{ _aws_security_group_list + [_aws_ec2_autoscale_cluster_security_group.group_id] }}"
-    block_device_mappings:
-      - ebs:
-          delete_on_termination: "{{ aws_ec2_autoscale_cluster.root_volume_delete_on_termination }}"
-          encrypted: "{{ aws_ec2_autoscale_cluster.encrypt_boot }}"
-          volume_size: "{{ aws_ec2_autoscale_cluster.root_volume_size }}"
-          volume_type: "{{ aws_ec2_autoscale_cluster.root_volume_type }}"
-        device_name: "{{ aws_ec2_autoscale_cluster.device_name }}"
-    credit_specification: "{{ aws_ec2_autoscale_cluster.instance_credit_specification | default(omit) }}"
-  with_random_choice: "{{ _aws_ec2_autoscale_cluster_subnets_ids }}"
-  loop_control:
-    loop_var: subnet_id
+- name: Build the ASG.
   when:
-    - aws_ec2_autoscale_cluster.asg_refresh
-    - aws_ec2_autoscale_cluster.type == "ec2"
     - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create AutoScale group and spin up new instances.
-  amazon.aws.autoscaling_group:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    name: "{{ aws_ec2_autoscale_cluster.name }}"
-    state: "{{ aws_ec2_autoscale_cluster.state }}"
-    launch_template:
-      launch_template_name: "{{ aws_ec2_autoscale_cluster.name }}"
-    health_check_type: "{% if aws_ec2_autoscale_cluster_running_instances.instances | length > 0 %}{{ aws_ec2_autoscale_cluster.alb_health_check_type }}{% else %}EC2{% endif %}"
-    health_check_period: "{{ aws_ec2_autoscale_cluster.alb_health_check_period | default(omit) }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    replace_all_instances: true
-    replace_batch_size: "{{ aws_ec2_autoscale_cluster.min_size if aws_ec2_autoscale_cluster.desired_capacity == 0 else aws_ec2_autoscale_cluster.desired_capacity }}"
-    wait_for_instances: true
-    lt_check: true
-    wait_timeout: 3000
-    desired_capacity: "{{ aws_ec2_autoscale_cluster.min_size if aws_ec2_autoscale_cluster.desired_capacity == 0 else aws_ec2_autoscale_cluster.desired_capacity }}"
-    min_size: "{{ aws_ec2_autoscale_cluster.min_size }}"
-    max_size: "{{ aws_ec2_autoscale_cluster.max_size }}"
-    tags: "{{ aws_ec2_autoscale_cluster.tags | simpledict2list }}"
-    vpc_zone_identifier: "{{ _aws_ec2_autoscale_cluster_subnets_ids }}"
-    target_group_arns:
-      - "{{ _aws_ec2_target_group_created.target_group_arn }}"
-  register: _aws_ec2_asg_created
-  when:
     - aws_ec2_autoscale_cluster.asg_refresh
     - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create step scaling AutoScale policies.
-  community.aws.autoscaling_policy:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    state: "present"
-    name: "{{ item.name }}-{{ item.policy_type }}"
-    adjustment_type: "{{ item.adjustment_type }}"
-    asg_name: "{{ aws_ec2_autoscale_cluster.name }}"
-    scaling_adjustment: "{{ item.adjustment }}"
-    min_adjustment_step: "{{ item.adjustment_step }}"
-    metric_aggregation: "{{ item.metric_aggregation }}"
-    step_adjustments: "{{ item.step_adjustments }}"
-  when:
-    - aws_ec2_autoscale_cluster.asg_scaling_policies
-    - item.policy_type == 'StepScaling'
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-  register: _aws_ec2_autoscale_cluster_step_scaling_policies
-  with_items: "{{ aws_ec2_autoscale_cluster.asg_scaling_policies }}"
-
-- name: Create simple scaling AutoScale policies.
-  community.aws.autoscaling_policy:
-    profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-    region: "{{ aws_ec2_autoscale_cluster.region }}"
-    state: "present"
-    name: "{{ item.name }}-{{ item.policy_type }}"
-    adjustment_type: "{{ item.adjustment_type }}"
-    asg_name: "{{ aws_ec2_autoscale_cluster.name }}"
-    scaling_adjustment: "{{ item.adjustment }}"
-    min_adjustment_step: "{{ item.adjustment_step }}"
-    cooldown: "{{ item.cooldown }}"
-  when:
-    - aws_ec2_autoscale_cluster.asg_scaling_policies
-    - item.policy_type == 'SimpleScaling'
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-  register: _aws_ec2_autoscale_cluster_simple_scaling_policies
-  with_items: "{{ aws_ec2_autoscale_cluster.asg_scaling_policies }}"
-
-- name: Fetch step scaling policies.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_scaling_policies: "{{ _aws_ec2_autoscale_cluster_step_scaling_policies.results }}"
-  when:
-    - _aws_ec2_autoscale_cluster_step_scaling_policies
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Fetch simple scaling policies.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_scaling_policies: "{{ _aws_ec2_autoscale_cluster_scaling_policies + _aws_ec2_autoscale_cluster_simple_scaling_policies.results }}"
-  when:
-    - _aws_ec2_autoscale_cluster_simple_scaling_policies
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create placeholder ARN variables for scaling policies.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_scaling_up_policy_ARN: ""
-    _aws_ec2_autoscale_cluster_scaling_down_policy_ARN: ""
-  when:
-    - _aws_ec2_autoscale_cluster_scaling_policies is defined
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-# @todo We should support multiple policies. If this built a list
-# then we could potentially loop over it after.
-- name: Set scaling up policy ARN.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_scaling_up_policy_ARN: "{{ item.arn }}"
-  loop: "{{ _aws_ec2_autoscale_cluster_scaling_policies }}"
-  when:
-    - _aws_ec2_autoscale_cluster_scaling_policies is defined
-    - item.item.name == aws_ec2_autoscale_cluster.asg_cloudwatch_policy_scale_up_name
-    - item.arn is defined
+  block:
+    - name: Gather IAM role info.
+      amazon.aws.iam_role_info:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        name: "{{ aws_ec2_autoscale_cluster.iam_role_name }}"
+      register: _aws_ec2_autoscale_cluster_iam_role_info
+
+    - name: Generate security group information for the ASG.
+      ansible.builtin.include_role:
+        name: aws/aws_security_groups
+      vars:
+        aws_security_groups:
+          profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+          region: "{{ aws_ec2_autoscale_cluster.region }}"
+          group_names: "{{ aws_ec2_autoscale_cluster.cluster_security_groups }}"
+          return_type: ids
+      when:
+        - aws_ec2_autoscale_cluster.cluster_security_groups|length > 0
+
+    - name: Create launch template.
+      amazon.aws.ec2_launch_template:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        name: "{{ aws_ec2_autoscale_cluster.name }}"
+        image_id: "{{ aws_ec2_autoscale_cluster.image_id if aws_ec2_autoscale_cluster.image_id is defined else aws_ec2_autoscale_cluster_image_latest.image_id }}"
+        key_name: "{{ aws_ec2_autoscale_cluster.key_name }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        state: "{{ aws_ec2_autoscale_cluster.state }}"
+        instance_type: "{{ aws_ec2_autoscale_cluster.instance_type }}"
+        iam_instance_profile: "{{ _aws_ec2_autoscale_cluster_iam_role_info.iam_roles[0].instance_profiles[0].arn }}"
+        disable_api_termination: "{{ aws_ec2_autoscale_cluster.instance_disable_api_termination }}"
+        ebs_optimized: "{{ aws_ec2_autoscale_cluster.ebs_optimized }}"
+        network_interfaces:
+          - associate_public_ip_address: "{{ aws_ec2_autoscale_cluster.assign_public_ip }}"
+            delete_on_termination: "{{ aws_ec2_autoscale_cluster.instance_nic_delete_on_termination }}"
+            subnet_id: "{{ subnet_id }}" # picked randomly from _aws_ec2_autoscale_cluster_subnets_ids, see with_random_choice
+            device_index: 0 # must be 0 - see https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface
+            groups: "{{ _aws_security_group_list + [_aws_ec2_autoscale_cluster_security_group.group_id] }}"
+        block_device_mappings:
+          - ebs:
+              delete_on_termination: "{{ aws_ec2_autoscale_cluster.root_volume_delete_on_termination }}"
+              encrypted: "{{ aws_ec2_autoscale_cluster.encrypt_boot }}"
+              volume_size: "{{ aws_ec2_autoscale_cluster.root_volume_size }}"
+              volume_type: "{{ aws_ec2_autoscale_cluster.root_volume_type }}"
+            device_name: "{{ aws_ec2_autoscale_cluster.device_name }}"
+        credit_specification: "{{ aws_ec2_autoscale_cluster.instance_credit_specification | default(omit) }}"
+      with_random_choice: "{{ _aws_ec2_autoscale_cluster_subnets_ids }}"
+      loop_control:
+        loop_var: subnet_id
+
+    - name: Create AutoScale group and spin up new instances.
+      amazon.aws.autoscaling_group:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        name: "{{ aws_ec2_autoscale_cluster.name }}"
+        state: "{{ aws_ec2_autoscale_cluster.state }}"
+        launch_template:
+          launch_template_name: "{{ aws_ec2_autoscale_cluster.name }}"
+        health_check_type: "{% if aws_ec2_autoscale_cluster_running_instances.instances | length > 0 %}{{ aws_ec2_autoscale_cluster.alb_health_check_type }}{% else %}EC2{% endif %}"
+        health_check_period: "{{ aws_ec2_autoscale_cluster.alb_health_check_period | default(omit) }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        replace_all_instances: true
+        replace_batch_size: "{{ aws_ec2_autoscale_cluster.min_size if aws_ec2_autoscale_cluster.desired_capacity == 0 else aws_ec2_autoscale_cluster.desired_capacity }}"
+        wait_for_instances: true
+        lt_check: true
+        wait_timeout: 3000
+        desired_capacity: "{{ aws_ec2_autoscale_cluster.min_size if aws_ec2_autoscale_cluster.desired_capacity == 0 else aws_ec2_autoscale_cluster.desired_capacity }}"
+        min_size: "{{ aws_ec2_autoscale_cluster.min_size }}"
+        max_size: "{{ aws_ec2_autoscale_cluster.max_size }}"
+        tags: "{{ aws_ec2_autoscale_cluster.tags | simpledict2list }}"
+        vpc_zone_identifier: "{{ _aws_ec2_autoscale_cluster_subnets_ids }}"
+        target_group_arns:
+          - "{{ _aws_ec2_target_group_created.target_group_arn }}"
+      register: _aws_ec2_asg_created
+
+- name: Handle AutoScale policies and alarms.
+  when:
+    - aws_ec2_autoscale_cluster.asg_scaling_policies|length > 0
     - aws_ec2_autoscale_cluster.type == "ec2"
     - aws_ec2_autoscale_cluster.deploy_cluster
-
-# @todo As above.
-- name: Set scaling down policy ARN.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_scaling_down_policy_ARN: "{{ item.arn }}"
-  loop: "{{ _aws_ec2_autoscale_cluster_scaling_policies }}"
+  block:
+    - name: Set empty scaling policies fact.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_policies: []
+
+    - name: Create simple scaling AutoScale policies.
+      community.aws.autoscaling_policy:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        state: "present"
+        name: "{{ item.name }}-{{ item.policy_type }}"
+        adjustment_type: "{{ item.adjustment_type }}"
+        asg_name: "{{ aws_ec2_autoscale_cluster.name }}"
+        scaling_adjustment: "{{ item.adjustment }}"
+        min_adjustment_step: "{{ item.adjustment_step }}"
+        cooldown: "{{ item.cooldown }}"
+      register: _aws_ec2_autoscale_cluster_simple_scaling_policies
+      with_items: "{{ aws_ec2_autoscale_cluster.asg_scaling_policies }}"
+      when: item.policy_type == 'SimpleScaling'
+
+    - name: Add simple scaling policies to scaling policies list.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_policies: "{{ _aws_ec2_autoscale_cluster_simple_scaling_policies.results }}"
+      when: _aws_ec2_autoscale_cluster_simple_scaling_policies.results is defined
+
+    - name: Create step scaling AutoScale policies.
+      community.aws.autoscaling_policy:
+        profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+        region: "{{ aws_ec2_autoscale_cluster.region }}"
+        state: "present"
+        name: "{{ item.name }}-{{ item.policy_type }}"
+        adjustment_type: "{{ item.adjustment_type }}"
+        asg_name: "{{ aws_ec2_autoscale_cluster.name }}"
+        scaling_adjustment: "{{ item.adjustment }}"
+        min_adjustment_step: "{{ item.adjustment_step }}"
+        metric_aggregation: "{{ item.metric_aggregation }}"
+        step_adjustments: "{{ item.step_adjustments }}"
+      register: _aws_ec2_autoscale_cluster_step_scaling_policies
+      with_items: "{{ aws_ec2_autoscale_cluster.asg_scaling_policies }}"
+      when: item.policy_type == 'StepScaling'
+
+    - name: Add step scaling policies to scaling policies list.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_policies: "{{ _aws_ec2_autoscale_cluster_scaling_policies + _aws_ec2_autoscale_cluster_step_scaling_policies.results }}"
+      when: _aws_ec2_autoscale_cluster_step_scaling_policies.results is defined
+
+- name: Create scaling policies and alarms.
   when:
     - _aws_ec2_autoscale_cluster_scaling_policies is defined
-    - item.item.name == aws_ec2_autoscale_cluster.asg_cloudwatch_policy_scale_down_name
-    - item.arn is defined
-    - aws_ec2_autoscale_cluster.type == "ec2"
-    - aws_ec2_autoscale_cluster.deploy_cluster
-
-- name: Create alarm in CloudWatch for auto scaling up.
-  ansible.builtin.include_role:
-    name: aws/aws_ec2_metric_alarm
-  vars:
-    aws_ec2_metric_alarm:
-      aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-      region: "{{ aws_ec2_autoscale_cluster.region }}"
-      name: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarm_scale_up_name }}"
-      description: "{{ item.description }}"
-      metric: "{{ item.metric }}"
-      namespace: "{{ item.namespace }}"
-      statistic: "{{ item.statistic }}"
-      comparison: "{{ item.comparison }}"
-      threshold: "{{ item.threshold }}"
-      unit: "{{ item.unit }}"
-      period: "{{ item.period }}"
-      evaluation_periods: "{{ item.evaluation_periods }}"
-      alarm_actions:
-        - "{{ _aws_ec2_autoscale_cluster_scaling_up_policy_ARN }}"
-      dimensions:
-        "AutoScalingGroupName": "{{ aws_ec2_autoscale_cluster.name }}"
-  with_items: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarms }}"
-  when:
-    - _aws_ec2_autoscale_cluster_scaling_up_policy_ARN is defined
-    - item.scale_direction == 'up'
-    - aws_ec2_autoscale_cluster.type == "ec2"
-
-- name: Create alarm in CloudWatch for auto scaling down.
-  ansible.builtin.include_role:
-    name: aws/aws_ec2_metric_alarm
-  vars:
-    aws_ec2_metric_alarm:
-      aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-      region: "{{ aws_ec2_autoscale_cluster.region }}"
-      name: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarm_scale_down_name }}"
-      description: "{{ item.description }}"
-      metric: "{{ item.metric }}"
-      namespace: "{{ item.namespace }}"
-      statistic: "{{ item.statistic }}"
-      comparison: "{{ item.comparison }}"
-      threshold: "{{ item.threshold }}"
-      unit: "{{ item.unit }}"
-      period: "{{ item.period }}"
-      evaluation_periods: "{{ item.evaluation_periods }}"
-      alarm_actions:
-        - "{{ _aws_ec2_autoscale_cluster_scaling_down_policy_ARN }}"
-      dimensions:
-        "AutoScalingGroupName": "{{ aws_ec2_autoscale_cluster.name }}"
-  with_items: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarms }}"
-  when:
-    - _aws_ec2_autoscale_cluster_scaling_down_policy_ARN is defined
-    - item.scale_direction == 'down'
     - aws_ec2_autoscale_cluster.type == "ec2"
+  block:
+    - name: Create placeholder ARN variables for scaling policies.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_up_policy_ARN: ""
+        _aws_ec2_autoscale_cluster_scaling_down_policy_ARN: ""
+      when:
+        - aws_ec2_autoscale_cluster.deploy_cluster
+
+    # @todo We should support multiple policies. If this built a list
+    # then we could potentially loop over it after.
+    - name: Set scaling up policy ARN.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_up_policy_ARN: "{{ item.arn }}"
+      loop: "{{ _aws_ec2_autoscale_cluster_scaling_policies }}"
+      when:
+        - item.item.name == aws_ec2_autoscale_cluster.asg_cloudwatch_policy_scale_up_name
+        - item.arn is defined
+        - aws_ec2_autoscale_cluster.deploy_cluster
+
+    # @todo As above.
+    - name: Set scaling down policy ARN.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_scaling_down_policy_ARN: "{{ item.arn }}"
+      loop: "{{ _aws_ec2_autoscale_cluster_scaling_policies }}"
+      when:
+        - item.item.name == aws_ec2_autoscale_cluster.asg_cloudwatch_policy_scale_down_name
+        - item.arn is defined
+        - aws_ec2_autoscale_cluster.deploy_cluster
+
+    - name: Create alarm in CloudWatch for auto scaling up.
+      ansible.builtin.include_role:
+        name: aws/aws_ec2_metric_alarm
+      vars:
+        aws_ec2_metric_alarm:
+          aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+          region: "{{ aws_ec2_autoscale_cluster.region }}"
+          name: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarm_scale_up_name }}"
+          description: "{{ item.description }}"
+          metric: "{{ item.metric }}"
+          namespace: "{{ item.namespace }}"
+          statistic: "{{ item.statistic }}"
+          comparison: "{{ item.comparison }}"
+          threshold: "{{ item.threshold }}"
+          unit: "{{ item.unit }}"
+          period: "{{ item.period }}"
+          evaluation_periods: "{{ item.evaluation_periods }}"
+          alarm_actions:
+            - "{{ _aws_ec2_autoscale_cluster_scaling_up_policy_ARN }}"
+          dimensions:
+            "AutoScalingGroupName": "{{ aws_ec2_autoscale_cluster.name }}"
+      with_items: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarms }}"
+      when:
+        - _aws_ec2_autoscale_cluster_scaling_up_policy_ARN is defined
+        - item.scale_direction == 'up'
+
+    - name: Create alarm in CloudWatch for auto scaling down.
+      ansible.builtin.include_role:
+        name: aws/aws_ec2_metric_alarm
+      vars:
+        aws_ec2_metric_alarm:
+          aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
+          region: "{{ aws_ec2_autoscale_cluster.region }}"
+          name: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarm_scale_down_name }}"
+          description: "{{ item.description }}"
+          metric: "{{ item.metric }}"
+          namespace: "{{ item.namespace }}"
+          statistic: "{{ item.statistic }}"
+          comparison: "{{ item.comparison }}"
+          threshold: "{{ item.threshold }}"
+          unit: "{{ item.unit }}"
+          period: "{{ item.period }}"
+          evaluation_periods: "{{ item.evaluation_periods }}"
+          alarm_actions:
+            - "{{ _aws_ec2_autoscale_cluster_scaling_down_policy_ARN }}"
+          dimensions:
+            "AutoScalingGroupName": "{{ aws_ec2_autoscale_cluster.name }}"
+      with_items: "{{ aws_ec2_autoscale_cluster.asg_cloudwatch_alarms }}"
+      when:
+        - _aws_ec2_autoscale_cluster_scaling_down_policy_ARN is defined
+        - item.scale_direction == 'down'
 
 # CLOUDFRONT
-- name: Create SSL certificate for CloudFront.
-  ansible.builtin.include_role:
-    name: aws/aws_acm
-  vars:
-    aws_acm:
-      export: false
-      region: us-east-1 # Certificate must be in us-east-1 for CloudFront.
-      domain_name: "{{ aws_ec2_autoscale_cluster.route_53.record }}"
-      extra_domains: "{{ aws_ec2_autoscale_cluster.acm.extra_domains }}"
-      route_53:
-        aws_profile: "{{ aws_ec2_autoscale_cluster.acm.route_53.aws_profile }}"
-        zone: "{{ aws_ec2_autoscale_cluster.acm.route_53.zone }}"
-  when:
-    - aws_ec2_autoscale_cluster.cloudfront.create_cert
-    - aws_ec2_autoscale_cluster.region != 'us-east-1'
-    - aws_ec2_autoscale_cluster.cloudfront.create_distribution
-
-- name: Default to provided CloudFront SSL certificate ARN.
-  ansible.builtin.set_fact:
-    _cf_certificate_ARN: "{{ aws_ec2_autoscale_cluster.cloudfront.cf_certificate_ARN }}"
-  when: aws_ec2_autoscale_cluster.cloudfront.create_distribution
-
-- name: If provided, override CloudFront SSL certificate ARN with the one received from ACM.
-  ansible.builtin.set_fact:
-    _cf_certificate_ARN: "{{ aws_acm_certificate_arn }}"
-  when:
-    - aws_ec2_autoscale_cluster.cloudfront.create_cert
-    - aws_ec2_autoscale_cluster.cloudfront.create_distribution
-
 - name: Initialise the domains loop var with main domain entry DNS settings.
   ansible.builtin.set_fact:
     _aws_ec2_autoscale_cluster_dns_all_domains:
@@ -728,40 +674,64 @@
   loop: "{{ aws_ec2_autoscale_cluster.acm.extra_domains }}"
   when: aws_ec2_autoscale_cluster.acm.extra_domains | length > 0
 
-- name: Initialise a list of CloudFront aliases with main domain name.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_cloudfront_aliases: "{{ [_domain_name] }}"
-  when:
-    - aws_ec2_autoscale_cluster.create_elb
-    - aws_ec2_autoscale_cluster.cloudfront.create_distribution
-
-- name: Add extra_domains so we can set up additional CloudFront aliases.
-  ansible.builtin.set_fact:
-    _aws_ec2_autoscale_cluster_cloudfront_aliases: "{{ _aws_ec2_autoscale_cluster_cloudfront_aliases + [item.domain] }}"
-  loop: "{{ aws_ec2_autoscale_cluster.acm.extra_domains }}"
+- name: Handle CloudFront.
   when:
-    - aws_ec2_autoscale_cluster.acm.extra_domains | length > 0
-    - aws_ec2_autoscale_cluster.create_elb
     - aws_ec2_autoscale_cluster.cloudfront.create_distribution
-
-- name: Create a CloudFront distribution.
-  ansible.builtin.include_role:
-    name: aws/aws_cloudfront_distribution
-  vars:
-    aws_cloudfront_distribution:
-      tags: "{{ aws_ec2_autoscale_cluster.tags | combine({'Name': aws_ec2_autoscale_cluster.name}) }}"
-      aliases: "{{ _aws_ec2_autoscale_cluster_cloudfront_aliases }}"
-      viewer_certificate:
-        acm_certificate_arn: "{{ _cf_certificate_ARN }}"
-      origins:
-        - domain_name: "{{ _aws_ec2_autoscale_cluster_alb.dns_name }}"
-          id: "ELB-{{ aws_ec2_autoscale_cluster.name }}"
-      default_cache_behavior:
-        target_origin_id: "ELB-{{ aws_ec2_autoscale_cluster.name }}"
-  when:
     - aws_ec2_autoscale_cluster.create_elb
-    - aws_ec2_autoscale_cluster.cloudfront.create_distribution
-    - _cf_certificate_ARN | length > 1
+  block:
+    - name: Create SSL certificate for CloudFront.
+      ansible.builtin.include_role:
+        name: aws/aws_acm
+      vars:
+        aws_acm:
+          export: false
+          region: us-east-1 # Certificate must be in us-east-1 for CloudFront.
+          domain_name: "{{ aws_ec2_autoscale_cluster.route_53.record }}"
+          extra_domains: "{{ aws_ec2_autoscale_cluster.acm.extra_domains }}"
+          route_53:
+            aws_profile: "{{ aws_ec2_autoscale_cluster.acm.route_53.aws_profile }}"
+            zone: "{{ aws_ec2_autoscale_cluster.acm.route_53.zone }}"
+      when:
+        - aws_ec2_autoscale_cluster.cloudfront.create_cert
+        - aws_ec2_autoscale_cluster.region != 'us-east-1'
+
+    - name: Default to provided CloudFront SSL certificate ARN.
+      ansible.builtin.set_fact:
+        _cf_certificate_ARN: "{{ aws_ec2_autoscale_cluster.cloudfront.cf_certificate_ARN }}"
+
+    - name: If provided, override CloudFront SSL certificate ARN with the one received from ACM.
+      ansible.builtin.set_fact:
+        _cf_certificate_ARN: "{{ aws_acm_certificate_arn }}"
+      when:
+        - aws_ec2_autoscale_cluster.cloudfront.create_cert
+
+    - name: Initialise a list of CloudFront aliases with main domain name.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_cloudfront_aliases: "{{ [_domain_name] }}"
+
+    - name: Add extra_domains so we can set up additional CloudFront aliases.
+      ansible.builtin.set_fact:
+        _aws_ec2_autoscale_cluster_cloudfront_aliases: "{{ _aws_ec2_autoscale_cluster_cloudfront_aliases + [item.domain] }}"
+      loop: "{{ aws_ec2_autoscale_cluster.acm.extra_domains }}"
+      when:
+        - aws_ec2_autoscale_cluster.acm.extra_domains|length > 0
+
+    - name: Create a CloudFront distribution.
+      ansible.builtin.include_role:
+        name: aws/aws_cloudfront_distribution
+      vars:
+        aws_cloudfront_distribution:
+          tags: "{{ aws_ec2_autoscale_cluster.tags | combine({'Name': aws_ec2_autoscale_cluster.name}) }}"
+          aliases: "{{ _aws_ec2_autoscale_cluster_cloudfront_aliases }}"
+          viewer_certificate:
+            acm_certificate_arn: "{{ _cf_certificate_ARN }}"
+          origins:
+            - domain_name: "{{ _aws_ec2_autoscale_cluster_alb.dns_name }}"
+              id: "ELB-{{ aws_ec2_autoscale_cluster.name }}"
+          default_cache_behavior:
+            target_origin_id: "ELB-{{ aws_ec2_autoscale_cluster.name }}"
+      when:
+        - _cf_certificate_ARN|length > 1
 
 # @TODO - we can use the aws_acm_obsolete_certificate_arn variable to tidy up previous ACM certs, if it is defined.
 
@@ -777,11 +747,4 @@
   loop: "{{ _aws_ec2_autoscale_cluster_dns_all_domains }}"
   when:
     - aws_ec2_autoscale_cluster.route_53.zone is defined
-    - aws_ec2_autoscale_cluster.route_53.zone | length > 0
-
-#- name: Copy AMI to backup region.
-#  community.aws.ec2_ami_copy:
-#    aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}"
-#    source_region: "{{ aws_ec2_autoscale_cluster.region }}"
-#    region: "{{ aws_backup.copy_vault.region }}"
-#    source_image_id: "{{ aws_ec2_autoscale_cluster_image_latest.image_id }}"
+    - aws_ec2_autoscale_cluster.route_53.zone|length > 0
diff --git a/roles/aws/aws_elb/tasks/main.yml b/roles/aws/aws_elb/tasks/main.yml
index 9ea51db71..8c988ff1c 100644
--- a/roles/aws/aws_elb/tasks/main.yml
+++ b/roles/aws/aws_elb/tasks/main.yml
@@ -111,7 +111,7 @@
     _aws_ec2_listeners: "{{ _aws_ec2_listeners + aws_elb.listeners }}"
   when:
     - aws_elb is defined
-    - aws_elb | length
+    - aws_elb | length > 0
 
 - name: Generate security group information.
   ansible.builtin.include_role:
diff --git a/roles/aws/aws_iam_saml/templates/simplesamlphp_sp.j2 b/roles/aws/aws_iam_saml/templates/simplesamlphp_sp.j2
index 509fd4dbe..d931cdbaa 100644
--- a/roles/aws/aws_iam_saml/templates/simplesamlphp_sp.j2
+++ b/roles/aws/aws_iam_saml/templates/simplesamlphp_sp.j2
@@ -55,7 +55,7 @@ $metadata['urn:amazon:{{ _aws_account_info.account }}'] = array (
       'groups' => 'urn:oid:1.3.6.1.4.1.5923.1.1.1.1',
     ),
 
-{% if aws_iam_saml.linotp_server is defined and aws_iam_saml.linotp_server|length %}
+{% if aws_iam_saml.linotp_server is defined and aws_iam_saml.linotp_server|length > 0 %}
     # LinOTP settings
     55 => array(
       'class' => 'linotp2:OTP',
diff --git a/roles/debian/ansible/defaults/main.yml b/roles/debian/ansible/defaults/main.yml
index 47707d7d0..bacce1d11 100644
--- a/roles/debian/ansible/defaults/main.yml
+++ b/roles/debian/ansible/defaults/main.yml
@@ -1,14 +1,14 @@
 ---
 ce_ansible:
-  # These are usually set in the _init role using _venv_path, _venv_command and _venv_install_username but can be overridden.
-  #venv_path: "/home/{{ ce_provision.username }}/ansible"
-  #venv_command: /usr/bin/python3.11 -m venv
-  #venv_install_username: ansible # user to become when creating venv
-  ansible_version: "<12.0" # also check install.sh script in the repo root and set the version there accordingly.
+  # These are usually set in the _init role but can be overridden here.
+  venv_path: "{{ _venv_path }}"
+  venv_command: "{{ _venv_command }}"
+  venv_install_username: "{{ _venv_install_username }}"
+  ansible_version: ""  # if used with the install.sh script in the repo root, version strings should match
   upgrade:
-    enabled: false # create systemd timer to auto-upgrade Ansible. Temporary disabled due to ansible 2.19 breaking changes.
+    enabled: false  # create systemd timer to auto-upgrade Ansible. Temporary disabled due to ansible 2.19 breaking changes
     command: "{{ _venv_path }}/bin/python3 -m pip install --upgrade ansible" # if you set venv_path above then set it here too
-    on_calendar: "*-*-* 01:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
+    on_calendar: "*-*-* 01:30:00"  # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
     #timer_name: upgrade_ansible
   linters:
-    enabled: true # will not install linters if false, installing linters breaks cloud-init
+    enabled: true  # will not install linters if false, installing linters breaks cloud-init
diff --git a/roles/debian/ansible/tasks/main.yml b/roles/debian/ansible/tasks/main.yml
index cdf6d0862..146c62e8d 100644
--- a/roles/debian/ansible/tasks/main.yml
+++ b/roles/debian/ansible/tasks/main.yml
@@ -21,20 +21,14 @@
 - name: Override Python venv path if provided.
   ansible.builtin.set_fact:
     _venv_path: "{{ ce_ansible.venv_path }}"
-  when:
-    - ce_ansible.venv_path is defined
 
 - name: Override Python venv command if provided.
   ansible.builtin.set_fact:
     _venv_command: "{{ ce_ansible.venv_command }}"
-  when:
-    - ce_ansible.venv_command is defined
 
 - name: Override Python user if provided.
   ansible.builtin.set_fact:
     _venv_install_username: "{{ ce_ansible.venv_install_username }}"
-  when:
-    - ce_ansible.venv_install_username is defined
 
 - name: Set up Python packages.
   ansible.builtin.include_role:
@@ -75,7 +69,7 @@
 
 - name: Add the venv to $PATH using profile.d.
   ansible.builtin.copy:
-    content: "export PATH=$PATH:{{ ce_ansible.venv_path | default(_venv_path) }}/bin"
+    content: "export PATH=$PATH:{{ ce_ansible.venv_path }}/bin"
     dest: "/etc/profile.d/ansible-path.sh"
     mode: '0644'
 
diff --git a/roles/debian/apache/templates/cloudwatch-main.json.j2 b/roles/debian/apache/templates/cloudwatch-main.json.j2
index e5e899a15..38b8a0772 100644
--- a/roles/debian/apache/templates/cloudwatch-main.json.j2
+++ b/roles/debian/apache/templates/cloudwatch-main.json.j2
@@ -5,7 +5,7 @@
         "collect_list": [
           {
             "file_path": "/var/log/apache2/access.log",
-{% if apache.log_group_prefix is defined and apache.log_group_prefix|length %}
+{% if apache.log_group_prefix is defined and apache.log_group_prefix|length > 0 %}
             "log_group_name": "{{ apache.log_group_prefix }}apache-access",
 {% else %}
 						"log_group_name": "apache-access",
@@ -14,7 +14,7 @@
           },
           {
             "file_path": "/var/log/apache2/error.log",
-{% if apache.log_group_prefix is defined and apache.log_group_prefix|length %}
+{% if apache.log_group_prefix is defined and apache.log_group_prefix|length > 0 %}
             "log_group_name": "{{ apache.log_group_prefix }}apache-error",
 {% else %}
 						"log_group_name": "apache-error",
@@ -25,4 +25,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/roles/debian/apache/templates/cloudwatch-vhost.json.j2 b/roles/debian/apache/templates/cloudwatch-vhost.json.j2
index 331e30ff5..7299936c0 100644
--- a/roles/debian/apache/templates/cloudwatch-vhost.json.j2
+++ b/roles/debian/apache/templates/cloudwatch-vhost.json.j2
@@ -5,12 +5,12 @@
         "collect_list": [
           {
             "file_path": "{{ domain.access_log }}",
-{% if apache.log_group_prefix is defined and apache.log_group_prefix|length %}
+{% if apache.log_group_prefix is defined and apache.log_group_prefix|length > 0 %}
             "log_group_name": "{{ apache.log_group_prefix }}apache2-access",
 {% else %}
 						"log_group_name": "apache2-access",
 {% endif %}
-{% if domain.log_stream_name is defined and domain.log_stream_name|length %}
+{% if domain.log_stream_name is defined and domain.log_stream_name|length > 0 %}
             "log_stream_name": "{{ domain.log_stream_name }}"
 {% else %}
 						"log_stream_name": "{{ apache.log_stream_name }}"
@@ -18,12 +18,12 @@
           },
           {
             "file_path": "{{ domain.error_log }}",
-{% if apache.log_group_prefix is defined and apache.log_group_prefix|length %}
+{% if apache.log_group_prefix is defined and apache.log_group_prefix|length > 0 %}
             "log_group_name": "{{ apache.log_group_prefix }}apache2-error",
 {% else %}
 						"log_group_name": "apache2-error",
 {% endif %}
-{% if domain.log_stream_name is defined and domain.log_stream_name|length %}
+{% if domain.log_stream_name is defined and domain.log_stream_name|length > 0 %}
             "log_stream_name": "{{ domain.log_stream_name }}"
 {% else %}
 						"log_stream_name": "{{ apache.log_stream_name }}"
@@ -33,4 +33,4 @@
       }
     }
   }
-} 
\ No newline at end of file
+} 
diff --git a/roles/debian/aws_cloudwatch_agent/templates/config.json.j2 b/roles/debian/aws_cloudwatch_agent/templates/config.json.j2
index 169ea4c53..6dce2d3fe 100755
--- a/roles/debian/aws_cloudwatch_agent/templates/config.json.j2
+++ b/roles/debian/aws_cloudwatch_agent/templates/config.json.j2
@@ -9,7 +9,7 @@
 				"collect_list": [
 					{
 						"file_path": "/var/log/syslog",
-{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length %}
+{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length > 0 %}
             "log_group_name": "{{aws_cloudwatch_agent.log_group_prefix}}syslog",
 {% else %}
 						"log_group_name": "syslog",
@@ -18,7 +18,7 @@
 					},
 					{
 						"file_path": "/var/log/auth.log",
-{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length %}
+{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length > 0 %}
             "log_group_name": "{{aws_cloudwatch_agent.log_group_prefix}}auth",
 {% else %}
 						"log_group_name": "auth",
@@ -27,7 +27,7 @@
 					},
 					{
 						"file_path": "/var/log/daemon.log",
-{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length %}
+{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length > 0 %}
             "log_group_name": "{{aws_cloudwatch_agent.log_group_prefix}}daemon",
 {% else %}
 						"log_group_name": "daemon",
@@ -36,7 +36,7 @@
 					},
 					{
 						"file_path": "/var/log/messages",
-{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length %}
+{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length > 0 %}
             "log_group_name": "{{aws_cloudwatch_agent.log_group_prefix}}messages",
 {% else %}
 						"log_group_name": "messages",
@@ -45,7 +45,7 @@
 					},
 					{
 						"file_path": "/var/log/alternatives.log",
-{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length %}
+{% if aws_cloudwatch_agent.log_group_prefix is defined and aws_cloudwatch_agent.log_group_prefix|length > 0 %}
             "log_group_name": "{{aws_cloudwatch_agent.log_group_prefix}}alternatives",
 {% else %}
 						"log_group_name": "alternatives",
@@ -57,7 +57,7 @@
 		}
 	},
 	"metrics": {
-{% if aws_cloudwatch_agent.metrics_namespace is defined and aws_cloudwatch_agent.metrics_namespace|length %}
+{% if aws_cloudwatch_agent.metrics_namespace is defined and aws_cloudwatch_agent.metrics_namespace|length > 0 %}
     "namespace": "{{ aws_cloudwatch_agent.metrics_namespace }}",
 {% endif %}  
 		"append_dimensions": {
@@ -110,4 +110,4 @@
 			}
 		}
 	}
-}
\ No newline at end of file
+}
diff --git a/roles/debian/duplicity/templates/include-exclude-filelist.j2 b/roles/debian/duplicity/templates/include-exclude-filelist.j2
index bf491cd28..61f745439 100644
--- a/roles/debian/duplicity/templates/include-exclude-filelist.j2
+++ b/roles/debian/duplicity/templates/include-exclude-filelist.j2
@@ -1,5 +1,5 @@
 {% for rule in dir.rules %}
-{% if rule|length %}
+{% if rule|length > 0 %}
 {{ rule }}
 {% endif %}
 {% endfor %}
diff --git a/roles/debian/nginx/templates/cloudwatch-main.json.j2 b/roles/debian/nginx/templates/cloudwatch-main.json.j2
index 8ba152202..4c17bb09b 100644
--- a/roles/debian/nginx/templates/cloudwatch-main.json.j2
+++ b/roles/debian/nginx/templates/cloudwatch-main.json.j2
@@ -5,7 +5,7 @@
         "collect_list": [
           {
             "file_path": "/var/log/nginx/access.log",
-{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length %}
+{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length > 0 %}
             "log_group_name": "{{ nginx.log_group_prefix }}nginx-access",
 {% else %}
 						"log_group_name": "nginx-access",
@@ -14,7 +14,7 @@
           },
           {
             "file_path": "/var/log/nginx/error.log",
-{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length %}
+{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length > 0 %}
             "log_group_name": "{{ nginx.log_group_prefix }}nginx-error",
 {% else %}
 						"log_group_name": "nginx-error",
diff --git a/roles/debian/nginx/templates/cloudwatch-vhost.json.j2 b/roles/debian/nginx/templates/cloudwatch-vhost.json.j2
index 285252767..a278f674d 100644
--- a/roles/debian/nginx/templates/cloudwatch-vhost.json.j2
+++ b/roles/debian/nginx/templates/cloudwatch-vhost.json.j2
@@ -5,12 +5,12 @@
         "collect_list": [
           {
             "file_path": "{{ domain.access_log }}",
-{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length %}
+{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length > 0 %}
             "log_group_name": "{{ nginx.log_group_prefix }}nginx-access",
 {% else %}
 						"log_group_name": "nginx-access",
 {% endif %}
-{% if domain.log_stream_name is defined and domain.log_stream_name|length %}
+{% if domain.log_stream_name is defined and domain.log_stream_name|length > 0 %}
             "log_stream_name": "{{ domain.log_stream_name }}"
 {% else %}
 						"log_stream_name": "{{ nginx.log_stream_name }}"
@@ -18,12 +18,12 @@
           },
           {
             "file_path": "{{ domain.error_log }}",
-{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length %}
+{% if nginx.log_group_prefix is defined and nginx.log_group_prefix|length > 0 %}
             "log_group_name": "{{ nginx.log_group_prefix }}nginx-error",
 {% else %}
 						"log_group_name": "nginx-error",
 {% endif %}
-{% if domain.log_stream_name is defined and domain.log_stream_name|length %}
+{% if domain.log_stream_name is defined and domain.log_stream_name|length > 0 %}
             "log_stream_name": "{{ domain.log_stream_name }}"
 {% else %}
 						"log_stream_name": "{{ nginx.log_stream_name }}"
diff --git a/roles/debian/openvpn/templates/headless-openvpn-install.sh.j2 b/roles/debian/openvpn/templates/headless-openvpn-install.sh.j2
index 2d078a5f9..0b36d94d8 100644
--- a/roles/debian/openvpn/templates/headless-openvpn-install.sh.j2
+++ b/roles/debian/openvpn/templates/headless-openvpn-install.sh.j2
@@ -13,12 +13,12 @@ export COMPRESSION_CHOICE={{ openvpn.compression_choice }}
 export CUSTOMIZE_ENC=n
 export CLIENT={{ openvpn.test_username }}
 export PASS=1
-{% if openvpn.nat_endpoint is defined and openvpn.nat_endpoint | length %}
+{% if openvpn.nat_endpoint is defined and openvpn.nat_endpoint | length > 0 %}
 export ENDPOINT={{ openvpn.nat_endpoint }}
 {% endif %}
 {% if openvpn.dns | int == 13 %}
 export DNS1={{ openvpn.dns1 }}
-{% if openvpn.dns2 is defined and openvpn.dns2 | length %}
+{% if openvpn.dns2 is defined and openvpn.dns2 | length > 0 %}
 export DNS2={{ openvpn.dns2 }}
 {% endif %}
 {% endif %}
diff --git a/roles/debian/pam_ldap/tasks/main.yml b/roles/debian/pam_ldap/tasks/main.yml
index 10e432be4..fbcf2c26c 100644
--- a/roles/debian/pam_ldap/tasks/main.yml
+++ b/roles/debian/pam_ldap/tasks/main.yml
@@ -14,14 +14,14 @@
   ansible.builtin.file:
     path: /etc/ldap/ssl
     state: directory
-  when: pam_ldap.ssl_certificate is defined and pam_ldap.ssl_certificate | length > 0
+  when: pam_ldap.ssl_certificate|length > 0
 
 - name: Copy certificate.
   ansible.builtin.copy:
     src: "{{ pam_ldap.ssl_certificate }}"
     dest: "/etc/ldap/ssl/{{ pam_ldap.ssl_certificate | basename }}"
     mode: "0666"
-  when: pam_ldap.ssl_certificate is defined and pam_ldap.ssl_certificate | length > 0
+  when: pam_ldap.ssl_certificate|length > 0
 
 - name: Copy nslcd config.
   ansible.builtin.template:
@@ -82,33 +82,31 @@
     mode: 0555
     owner: root
 
-- name: Create LDAP key script passwd file.
-  ansible.builtin.template:
-    src: ldap-bindpw.j2
-    dest: /etc/ldap/ldap-bindpw
-    mode: "0600"
-    owner: root
-  when:
-    - ldap_client.binddn is defined and ldap_client.binddn
-    - ldap_client.bindpw is defined and ldap_client.bindpw
-
-- name: Create wrapper script for LDAP key script.
-  ansible.builtin.template:
-    src: ssh-getkey-ldap-wrapper.sh.j2
-    dest: /usr/local/bin/ssh-getkey-ldap-wrapper.sh
-    mode: "0555"
-    owner: root
-  when:
-    - ldap_client.binddn is defined and ldap_client.binddn
-    - ldap_client.bindpw is defined and ldap_client.bindpw
-
-- name: Configure SSH pub key command if there is a binddn set.
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    regexp: "AuthorizedKeysCommand "
-    line: AuthorizedKeysCommand /usr/local/bin/ssh-getkey-ldap-wrapper.sh
+- name: LDAP password handling.
   when:
-    - ldap_client.binddn is defined and ldap_client.binddn
+    - ldap_client.binddn|length > 0
+    - ldap_client.bindpw|length > 0
+  block:
+    - name: Create LDAP key script passwd file.
+      ansible.builtin.template:
+        src: ldap-bindpw.j2
+        dest: /etc/ldap/ldap-bindpw
+        mode: "0600"
+        owner: root
+
+    - name: Create wrapper script for LDAP key script.
+      ansible.builtin.template:
+        src: ssh-getkey-ldap-wrapper.sh.j2
+        dest: /usr/local/bin/ssh-getkey-ldap-wrapper.sh
+        mode: "0555"
+        owner: root
+
+    # We don't support bind DN with no password because if there is no password the necessary script is not created.
+    - name: Configure SSH pub key command if there is a binddn set.
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "AuthorizedKeysCommand "
+        line: AuthorizedKeysCommand /usr/local/bin/ssh-getkey-ldap-wrapper.sh
 
 - name: Configure SSH pub key command if no binddn set.
   ansible.builtin.lineinfile:
@@ -116,7 +114,7 @@
     regexp: "AuthorizedKeysCommand "
     line: AuthorizedKeysCommand /usr/local/bin/ssh-getkey-ldap
   when:
-    - not ldap_client.binddn
+    - ldap_client.binddn|length == 0
 
 - name: Configure SSH pub key command user.
   ansible.builtin.lineinfile:
diff --git a/roles/debian/php-fpm/templates/cloudwatch-php-fpm-fixedport.json.j2 b/roles/debian/php-fpm/templates/cloudwatch-php-fpm-fixedport.json.j2
index 74523ecdf..e5d5ba9eb 100644
--- a/roles/debian/php-fpm/templates/cloudwatch-php-fpm-fixedport.json.j2
+++ b/roles/debian/php-fpm/templates/cloudwatch-php-fpm-fixedport.json.j2
@@ -5,12 +5,12 @@
         "collect_list": [
           {
             "file_path": "/var/log/php{{ php.version[0] }}-fpm.log",
-{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length %}
+{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length > 0 %}
             "log_group_name": "{{ php.fpm.log_group_prefix }}php{{ php.version[0] }}",
 {% else %}
 						"log_group_name": "php",
 {% endif %}
-{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length %}
+{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length > 0 %}
             "log_stream_name": "{{ php.fpm.log_stream_name }}"
 {% else %}
 						"log_stream_name": "php-fpm"
@@ -18,12 +18,12 @@
           },
           {
             "file_path": "{{ php.fpm.slowlog_file_directory }}/php{{ php.version[0] }}-fpm.slow.log",
-{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length %}
+{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length > 0 %}
             "log_group_name": "{{ php.fpm.log_group_prefix }}php{{ php.version[0] }}",
 {% else %}
 						"log_group_name": "php",
 {% endif %}
-{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length %}
+{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length > 0 %}
             "log_stream_name": "{{ php.fpm.log_stream_name }}-slowlog"
 {% else %}
 						"log_stream_name": "php-fpm-slowlog"
diff --git a/roles/debian/php-fpm/templates/cloudwatch-php-fpm.json.j2 b/roles/debian/php-fpm/templates/cloudwatch-php-fpm.json.j2
index 19a848bf3..bfb9efab0 100644
--- a/roles/debian/php-fpm/templates/cloudwatch-php-fpm.json.j2
+++ b/roles/debian/php-fpm/templates/cloudwatch-php-fpm.json.j2
@@ -5,12 +5,12 @@
         "collect_list": [
           {
             "file_path": "/var/log/php{{ version }}-fpm.log",
-{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length %}
+{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length > 0 %}
             "log_group_name": "{{ php.fpm.log_group_prefix }}php{{ version }}",
 {% else %}
 						"log_group_name": "php",
 {% endif %}
-{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length %}
+{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length > 0 %}
             "log_stream_name": "{{ php.fpm.log_stream_name }}"
 {% else %}
 						"log_stream_name": "php-fpm"
@@ -18,12 +18,12 @@
           },
           {
             "file_path": "{{ php.fpm.slowlog_file_directory }}/php{{ version }}-fpm.slow.log",
-{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length %}
+{% if php.fpm.log_group_prefix is defined and php.fpm.log_group_prefix|length > 0 %}
             "log_group_name": "{{ php.fpm.log_group_prefix }}php{{ version }}",
 {% else %}
 						"log_group_name": "php",
 {% endif %}
-{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length %}
+{% if php.fpm.log_stream_name is defined and php.fpm.log_stream_name|length > 0 %}
             "log_stream_name": "{{ php.fpm.log_stream_name }}-slowlog"
 {% else %}
 						"log_stream_name": "php-fpm-slowlog"
diff --git a/roles/debian/postfix/templates/transport.j2 b/roles/debian/postfix/templates/transport.j2
index 098bf5265..1f053c8e2 100644
--- a/roles/debian/postfix/templates/transport.j2
+++ b/roles/debian/postfix/templates/transport.j2
@@ -1,7 +1,7 @@
 {{ ansible_hostname }} :
 {{ ansible_fqdn }} :
 {% for transport in postfix.transport_maps %}
-{% if transport|length %}
+{% if transport|length > 0 %}
 {{ transport }}
 {% endif %}
 {% endfor %}
diff --git a/roles/debian/python_pip_packages/defaults/main.yml b/roles/debian/python_pip_packages/defaults/main.yml
index 67d6d0120..c2e179208 100644
--- a/roles/debian/python_pip_packages/defaults/main.yml
+++ b/roles/debian/python_pip_packages/defaults/main.yml
@@ -1,9 +1,9 @@
 ---
 python_pip_packages:
-  # These are usually set in the _init role using _venv_path, _venv_command and _venv_install_username but can be overridden.
-  #venv_path: /path/to/venv
-  #venv_command: /usr/bin/python3.11 -m venv
-  #install_username: deploy # user to become when creating venv
+  # These are usually set in the _init role but can be overridden here.
+  venv_path: "{{ _venv_path }}"
+  venv_command: "{{ _venv_command }}"
+  install_username: "{{ _venv_install_username }}"
 
   packages: []
   #  - name: pip
diff --git a/roles/debian/python_pip_packages/tasks/main.yml b/roles/debian/python_pip_packages/tasks/main.yml
index 50c038d25..0bdbcd85b 100644
--- a/roles/debian/python_pip_packages/tasks/main.yml
+++ b/roles/debian/python_pip_packages/tasks/main.yml
@@ -2,15 +2,15 @@
 - name: Install packages.
   ansible.builtin.pip:
     name: "{{ item.name }}"
-    state: "{{ item.state | default(omit) }}"
-    virtualenv: "{{ python_pip_packages.venv_path | default(_venv_path) }}"
-    virtualenv_command: "{{ python_pip_packages.venv_command | default(_venv_command) }}"
+    state: "{{ item.state|default(omit) }}"
+    virtualenv: "{{ python_pip_packages.venv_path }}"
+    virtualenv_command: "{{ python_pip_packages.venv_command }}"
   with_items: "{{ python_pip_packages.packages }}"
 
 - name: Ensure venv permissions.
   ansible.builtin.file:
-    path: "{{ python_pip_packages.venv_path | default(_venv_path) }}"
+    path: "{{ python_pip_packages.venv_path }}"
     state: directory
     recurse: true
-    owner: "{{ python_pip_packages.install_username | default(_venv_install_username) }}"
-    group: "{{ python_pip_packages.install_username | default(_venv_install_username) }}"
+    owner: "{{ python_pip_packages.install_username }}"
+    group: "{{ python_pip_packages.install_username }}"
diff --git a/roles/debian/ssh_server/templates/sshd_config.j2 b/roles/debian/ssh_server/templates/sshd_config.j2
index 216792bb0..9c832dbd3 100644
--- a/roles/debian/ssh_server/templates/sshd_config.j2
+++ b/roles/debian/ssh_server/templates/sshd_config.j2
@@ -27,7 +27,7 @@ ListenAddress {{ address }}
 #HostKey /etc/ssh/ssh_host_ecdsa_key
 #HostKey /etc/ssh/ssh_host_ed25519_key
 {% for key in sshd.HostKey %}
-{% if key|length %}
+{% if key|length > 0 %}
 HostKey {{ key }}
 {% endif %}
 {% endfor %}
@@ -119,7 +119,7 @@ UsePAM {{ sshd.UsePAM }}
 
 AllowAgentForwarding {{ sshd.AllowAgentForwarding }}
 AllowTcpForwarding {{ sshd.AllowTcpForwarding }}
-{% if sshd.AllowGroups|length %}
+{% if sshd.AllowGroups|length > 0 %}
 AllowGroups {{ sshd.AllowGroups }}
 {% endif %}
 GatewayPorts {{ sshd.GatewayPorts }}