diff --git a/docs/infrastructure/deployment.md b/docs/infrastructure/deployment.md
index ef9d6882..b3b45a20 100644
--- a/docs/infrastructure/deployment.md
+++ b/docs/infrastructure/deployment.md
@@ -88,7 +88,6 @@ There are two config files needed to instantiate the rAPId service, they are `in
 state_bucket = ""
 data_bucket_name = ""
 log_bucket_name = ""
-iam_account_alias = ""
 
 application_version = ""
 ui_version = ""
@@ -151,40 +150,7 @@ To set up the S3 backend follow these steps:
 - Replace the values in `backend.hcl` with your custom values (these can be any value you would like). They will be referenced to create the Terraform state components and used going forwards as the backend config.
 - In the root folder run `make infra/backend`, this will initialise Terraform by creating both the state bucket and dynamodb table in AWS.
 
-### IAM User Setup (Optional)
-
-This module is used to set the admin and user roles for the AWS account. It ensures a good level of security by expiring credentials quickly and ensuring that MFA is always needed to refresh them.
-
-> CAUTION: If you have existing AWS users and don't include them as part of the manual_users, this block will remove them!
-
-You will need define the desired IAM users (both new and previous manually added
-ones) in `input-params.tfvars` and deploy the [iam-config](#deploying-remaining-infra-blocks) block with admin privileges. After that you can use [assume-role](#assume-role) to perform infrastructure changes.
-
-`infra-params.tfvars` snippet for 'user1':
-
-```
-set_iam_user_groups = ["users", "admins"]
-
-iam_users = {
-  user1 = {
-    groups = ["users", "admins"]
-  }
-}
-
-manual_users = {
-  "user1@domain.email" = {
-    groups = ["users", "admins"]
-  }
-}
-```
-
-### Assume role
-
-In order to gain the admin privileges necessary for infrastructure changes one needs to assume admin role. This will be
-enabled only for user's defined in `input-params.tfvars`, only after logging into the AWS console for the first time as an
-IAM user and enabling MFA.
-
-### Deploying remaining infra-blocks
+### Deploying infra-blocks
 
 Once the state backend has been configured, provide/change the following inputs in `input-params.tfvars`.
 
@@ -193,17 +159,12 @@ Required:
 - `state_bucket` - The name of the state bucket, as defined in `backend.hcl`
 - `data_bucket_name` - This will be the bucket where the data is going to be stored, it needs to be a unique name.
 - `log_bucket_name` - This is the bucket that will be used for logging, it needs to have a unique name.
-- `iam_account_alias` - account alias required by AWS, it needs to be a unique name
 - `application_version` - service's docker
   image version
 - `ui_version` - The version of the static frontend site
 - `domain_name` - application hostname ([can be a domain or a subdomain](./domains_subdomains.md))
 - `aws_account` - aws account id where the application will be hosted
 - `aws_region` - aws region where the application will be hosted
-- `iam_users` - IAM users to be created automatically, with roles to be attached to them
-- `manual_users` - IAM users that has been already created manually, with roles to be attached. (Can be left empty)
-- `set_iam_user_groups` - User groups that need to be present on each user. (i.e. if the value is set to admin, then all
-  the users will require the admin role)
 - `support_emails_for_cloudwatch_alerts` - list of engineer emails that should receive alert notifications [more info](./alerting_monitoring.md)
 - `ip_whitelist` - ip range to add to application whitelist. The expected value is a list of strings.
 
@@ -225,11 +186,9 @@ Then, run the following command on each block:
 
 Run the blocks in this order:
 
-1. [iam-config](#iam-user-setup-optional)
-   > All the users' roles/policies will be handled here and will delete any previous config
-2. vpc
-3. s3
-4. auth
-5. data-workflow
-6. app-cluster
-7. ui
+1. vpc
+2. s3
+3. auth
+4. data-workflow
+5. app-cluster
+6. ui
diff --git a/infrastructure/blocks/ecr/main.tf b/infrastructure/blocks/ecr/main.tf
index 15ebdf81..00f963e5 100644
--- a/infrastructure/blocks/ecr/main.tf
+++ b/infrastructure/blocks/ecr/main.tf
@@ -4,6 +4,18 @@ terraform {
   }
 }
 
+resource "aws_ecr_registry_scanning_configuration" "this" {
+  scan_type = "BASIC"
+
+  rule {
+    scan_frequency = "SCAN_ON_PUSH"
+    repository_filter {
+      filter      = "*"
+      filter_type = "WILDCARD"
+    }
+  }
+}
+
 resource "aws_ecr_repository" "private" {
   #checkov:skip=CKV_AWS_51:No need for immutable tags
   name                 = "data-f1-registry"
@@ -55,58 +67,6 @@ resource "aws_ecr_lifecycle_policy" "image_expiry_policies" {
 EOF
 }
 
-
-resource "aws_ecr_repository" "private_ckan" {
-  #checkov:skip=CKV_AWS_51:No need for immutable tags
-  name                 = "rapid-ckan"
-  image_tag_mutability = "MUTABLE"
-  tags                 = var.tags
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  encryption_configuration {
-    encryption_type = "KMS"
-  }
-}
-
-resource "aws_ecr_lifecycle_policy" "image_expiry_policies_ckan" {
-  repository = aws_ecr_repository.private_ckan.name
-
-  policy = <<EOF
-{
-    "rules": [
-        {
-            "rulePriority": 1,
-            "description": "Retain PROD image",
-            "selection": {
-                "tagStatus": "tagged",
-                "tagPrefixList": ["PROD"],
-                "countType": "imageCountMoreThan",
-                "countNumber": 9999
-            },
-            "action": {
-                "type": "expire"
-            }
-        },
-        {
-            "rulePriority": 2,
-            "description": "Expire old images",
-            "selection": {
-                "tagStatus": "any",
-                "countType": "imageCountMoreThan",
-                "countNumber": 5
-            },
-            "action": {
-                "type": "expire"
-            }
-        }
-    ]
-}
-EOF
-}
-
 provider "aws" {
   alias  = "us_east_1"
   region = "us-east-1"
@@ -129,19 +89,3 @@ resource "aws_ecrpublic_repository" "public" {
     usage_text = "Please see https://github.com/no10ds/rapid-infrastructure/ for details on the use"
   }
 }
-
-resource "aws_ecrpublic_repository" "public_ckan" {
-  provider = aws.us_east_1
-
-  repository_name = "ckan"
-
-  catalog_data {
-    about_text = "Please see https://github.com/no10ds/rapid-catalogue-module for more information"
-    architectures = [
-    "x86-64"]
-    description = "Project rAPId CKAN Image"
-    operating_systems = [
-    "Linux"]
-    usage_text = "Please see https://github.com/no10ds/rapid-catalogue-module for details on the use"
-  }
-}
diff --git a/infrastructure/blocks/ecr/outputs.tf b/infrastructure/blocks/ecr/outputs.tf
index f7795ddb..470aedcf 100644
--- a/infrastructure/blocks/ecr/outputs.tf
+++ b/infrastructure/blocks/ecr/outputs.tf
@@ -8,17 +8,7 @@ output "ecr_private_repo_arn" {
   description = "The arn of the private ecr repo"
 }
 
-output "ecr_private_ckan_repo_arn" {
-  value       = aws_ecr_repository.private_ckan.arn
-  description = "The arn of the private ckan ecr repo"
-}
-
 output "ecr_public_repo_arn" {
   value       = aws_ecrpublic_repository.public.arn
   description = "The arn of the public ecr repo"
 }
-
-output "ecr_public_ckan_repo_arn" {
-  value       = aws_ecrpublic_repository.public_ckan.arn
-  description = "The arn of the public ckan ecr repo"
-}
diff --git a/infrastructure/blocks/iam-config/main.tf b/infrastructure/blocks/iam-config/main.tf
deleted file mode 100644
index 5fef7774..00000000
--- a/infrastructure/blocks/iam-config/main.tf
+++ /dev/null
@@ -1,41 +0,0 @@
-terraform {
-  backend "s3" {
-    key = "iam-config/terraform.tfstate"
-  }
-}
-
-module "config" {
-  source = "../../modules/aws-core/config"
-
-  bucket_prefix                      = var.bucket_prefix
-  bucket_key_prefix                  = var.bucket_prefix
-  enable_lifecycle_management_for_s3 = var.enable_lifecycle_management_for_s3
-  password_policy                    = var.password_policy
-}
-
-module "iam_users" {
-  source = "../../modules/aws-core/iam-users"
-
-  # This includes some random bits here purely for demonstrational purposes. Please use a distinct unique identifier otherwise!
-  iam_account_alias = var.iam_account_alias
-  iam_users         = var.iam_users
-  password_policy   = var.password_policy
-}
-
-module "iam_resources" {
-  source = "../../modules/aws-core/iam-resources"
-
-  # Mandatory parameter so we can't skip it
-  iam_account_alias = var.iam_account_alias
-  # This will make sure we're only setting the IAM account alias once, as we're operating in the same account
-  set_iam_account_alias       = false
-  admin_multi_factor_auth_age = "14400"
-  admin_max_session_duration  = "14400"
-}
-
-resource "aws_iam_user_group_membership" "manual_user_memberships" {
-  for_each = var.manual_users
-  user     = each.key
-
-  groups = each.value["groups"]
-}
diff --git a/infrastructure/blocks/iam-config/output.tf b/infrastructure/blocks/iam-config/output.tf
deleted file mode 100644
index 5ccb65fe..00000000
--- a/infrastructure/blocks/iam-config/output.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-output "iam_users" {
-  value       = var.iam_users
-  description = "The users in the aws account"
-}
-
-output "bucket_prefix" {
-  value       = var.bucket_prefix
-  description = "The prefix used for all the bucktes"
-}
-
-output "resource_admin_role_arn" {
-  value       = module.iam_resources.resource_admin_role_arn
-  description = "The arn of the admin role."
-}
-
-output "resource_user_role_arn" {
-  value       = module.iam_resources.resource_user_role_arn
-  description = "The arn of the user role."
-}
diff --git a/infrastructure/blocks/iam-config/variables.tf b/infrastructure/blocks/iam-config/variables.tf
deleted file mode 100644
index 168fba8f..00000000
--- a/infrastructure/blocks/iam-config/variables.tf
+++ /dev/null
@@ -1,47 +0,0 @@
-variable "bucket_prefix" {
-  type        = string
-  description = "The prefix attached to the AWS Config S3 bucket where evaluation results are stored"
-  # The module default is "aws-config" so you don't necessarily need to specify this
-  default = "rapid-aws-config-bucket"
-}
-
-variable "iam_account_alias" {
-  type        = string
-  description = "Unique alias name for the iam account"
-}
-
-variable "enable_lifecycle_management_for_s3" {
-  type        = bool
-  description = "Whether or not to enable lifecycle management for the created S3 buckets"
-  # You should set this to true, or just delete the line (the default is "true"), if you're moving this into a production context
-  default = true
-}
-
-variable "set_iam_user_groups" {
-  type        = list(string)
-  description = "A list of user groups every user should belong to"
-}
-
-variable "iam_users" {
-  type        = map(map(list(string)))
-  description = "A list of users you want to create inside the \"users\" account"
-}
-
-variable "manual_users" {
-  type        = map(map(list(string)))
-  description = "A list of users that were created manually into the account"
-}
-
-variable "password_policy" {
-  type = object({
-    require_uppercase_characters   = bool
-    require_lowercase_characters   = bool
-    require_symbols                = bool
-    require_numbers                = bool
-    minimum_password_length        = number
-    password_reuse_prevention      = number
-    max_password_age               = number
-    allow_users_to_change_password = bool
-  })
-  description = "The password policy for the IAM users"
-}
diff --git a/infrastructure/blocks/iam-config/versions.tf b/infrastructure/blocks/iam-config/versions.tf
deleted file mode 100644
index 28bc5987..00000000
--- a/infrastructure/blocks/iam-config/versions.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 4.53.0"
-    }
-  }
-  required_version = ">= 1.3.5"
-}
diff --git a/infrastructure/blocks/pipeline-ami/data.tf b/infrastructure/blocks/pipeline-ami/data.tf
deleted file mode 100644
index 603ec83b..00000000
--- a/infrastructure/blocks/pipeline-ami/data.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-data "terraform_remote_state" "vpc-state" {
-  backend   = "s3"
-  workspace = "prod"
-
-  config = {
-    key    = "vpc/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
diff --git a/infrastructure/blocks/pipeline-ami/install.sh b/infrastructure/blocks/pipeline-ami/install.sh
deleted file mode 100644
index 020b8edf..00000000
--- a/infrastructure/blocks/pipeline-ami/install.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-# Enable SSM
-sudo snap install amazon-ssm-agent --classic
-sudo snap start amazon-ssm-agent
-
-# Update base packages
-sudo apt update -y
-sudo dpkg --configure -a
-
-# Install make
-sudo apt-get -y install make
-
-# Install Java
-sudo apt-get install default-jre -y
-
-# Install jq
-sudo apt-get install jq -y
-
-# Install Docker
-sudo apt-get install docker.io -y
-
-# Install zip
-sudo apt-get install zip -y
-
-# Install unzip
-sudo apt-get install unzip -y
-
-# Install GitHub cli (gh)
-type -p curl >/dev/null || sudo apt install curl -y
-curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
-sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
-echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
-sudo apt update
-sudo apt install gh -y
-
-# Install V2 AWS CLI
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-sudo ./aws/install
diff --git a/infrastructure/blocks/pipeline-ami/packer.tf b/infrastructure/blocks/pipeline-ami/packer.tf
deleted file mode 100644
index 3b246320..00000000
--- a/infrastructure/blocks/pipeline-ami/packer.tf
+++ /dev/null
@@ -1,25 +0,0 @@
-resource "null_resource" "packer_build" {
-  triggers = {
-    sha256_ami_config  = filesha256("${path.module}/template.json")
-    sha256_ami_install = filesha256("${path.module}/install.sh")
-    version            = var.pipeline_ami_version
-  }
-
-  provisioner "local-exec" {
-    command = <<EOF
-    set -ex;
-    PACKER_LOG=1 packer validate \
-      -var "version=${var.pipeline_ami_version}" \
-      -var "subnet_id=${data.terraform_remote_state.vpc-state.outputs.public_subnets_ids[0]}" \
-      -var "vpc_id=${data.terraform_remote_state.vpc-state.outputs.vpc_id}" \
-      -var "region=${var.aws_region}" \
-      template.json
-    PACKER_LOG=1 packer build \
-      -var "version=${var.pipeline_ami_version}" \
-      -var "subnet_id=${data.terraform_remote_state.vpc-state.outputs.public_subnets_ids[0]}" \
-      -var "vpc_id=${data.terraform_remote_state.vpc-state.outputs.vpc_id}" \
-      -var "region=${var.aws_region}" \
-      template.json
-EOF
-  }
-}
diff --git a/infrastructure/blocks/pipeline-ami/provider.tf b/infrastructure/blocks/pipeline-ami/provider.tf
deleted file mode 100644
index 214eedca..00000000
--- a/infrastructure/blocks/pipeline-ami/provider.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-terraform {
-  backend "s3" {
-    key = "pipeline-ami/terraform.tfstate"
-  }
-}
diff --git a/infrastructure/blocks/pipeline-ami/template.json b/infrastructure/blocks/pipeline-ami/template.json
deleted file mode 100644
index f606ce20..00000000
--- a/infrastructure/blocks/pipeline-ami/template.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "variables": {
-    "version": "",
-    "region": "",
-    "subnet_id": "",
-    "vpc_id": ""
-  },
-  "builders": [
-    {
-      "ami_description": "An AMI for creating github runners",
-      "ami_name": "pipeline-ami-{{user `version`}}",
-      "instance_type": "t3.large",
-      "region": "{{user `region`}}",
-      "force_deregister": "true",
-      "force_delete_snapshot": "true",
-      "vpc_id": "{{user `vpc_id`}}",
-      "subnet_id": "{{user `subnet_id`}}",
-      "associate_public_ip_address": true,
-      "ami_block_device_mappings": [
-        {
-          "device_name": "/dev/sda1",
-          "encrypted": false,
-          "volume_type": "gp2",
-          "volume_size": 32,
-          "delete_on_termination": true
-        }
-      ],
-      "source_ami_filter": {
-        "filters": {
-          "name": "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*",
-          "virtualization-type": "hvm",
-          "root-device-type": "ebs"
-        },
-        "most_recent": true,
-        "owners": ["099720109477"]
-      },
-      "ssh_username": "ubuntu",
-      "type": "amazon-ebs"
-    }
-  ],
-  "provisioners": [
-    {
-      "inline": [
-        "echo 'Sleeping for 30 seconds to give Ubuntu enough time to initialize (otherwise, packages may fail to install).'",
-        "sleep 30"
-      ],
-      "type": "shell"
-    },
-    {
-      "scripts": ["{{template_dir}}/install.sh"],
-      "type": "shell"
-    }
-  ]
-}
diff --git a/infrastructure/blocks/pipeline-ami/variables.tf b/infrastructure/blocks/pipeline-ami/variables.tf
deleted file mode 100644
index 87e70237..00000000
--- a/infrastructure/blocks/pipeline-ami/variables.tf
+++ /dev/null
@@ -1,33 +0,0 @@
-variable "tags" {
-  type        = map(string)
-  description = "A common map of tags for all VPC resources that are created (for e.g. billing purposes)"
-}
-
-variable "state_bucket" {
-  type        = string
-  description = "Bucket name for backend state"
-}
-
-variable "aws_account" {
-  type        = string
-  description = "AWS Account number to host the rAPId service"
-}
-
-variable "aws_region" {
-  type        = string
-  description = "The region of the AWS Account for the rAPId service"
-}
-
-variable "version_check" {
-  description = "Ensure that you have incremented the version of the ami. Enter 'yes' to continue"
-  validation {
-    condition     = var.version_check == "yes"
-    error_message = "You must enter 'yes' to continue"
-  }
-}
-
-
-variable "pipeline_ami_version" {
-  type        = string
-  description = "The version of the pipeline AMI to use"
-}
diff --git a/infrastructure/blocks/pipeline/data.tf b/infrastructure/blocks/pipeline/data.tf
deleted file mode 100644
index b735ab50..00000000
--- a/infrastructure/blocks/pipeline/data.tf
+++ /dev/null
@@ -1,55 +0,0 @@
-data "terraform_remote_state" "vpc-state" {
-  backend   = "s3"
-  workspace = "prod"
-
-  config = {
-    key    = "vpc/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
-
-
-data "terraform_remote_state" "s3-state" {
-  backend   = "s3"
-  workspace = "prod"
-
-  config = {
-    key    = "s3/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
-
-data "terraform_remote_state" "s3-state-preprod" {
-  backend   = "s3"
-  workspace = "preprod"
-
-  config = {
-    key    = "s3/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
-
-data "terraform_remote_state" "s3-state-dev" {
-  backend   = "s3"
-  workspace = "dev"
-
-  config = {
-    key    = "s3/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
-
-data "terraform_remote_state" "ecr-state" {
-  backend = "s3"
-
-  config = {
-    key    = "ecr/terraform.tfstate"
-    bucket = var.state_bucket
-  }
-}
-
-data "aws_ami" "this" {
-  most_recent = true
-  name_regex  = "pipeline-ami-${var.pipeline_ami_version}"
-  owners      = ["self"]
-}
diff --git a/infrastructure/blocks/pipeline/iam.tf b/infrastructure/blocks/pipeline/iam.tf
deleted file mode 100644
index fb9ed514..00000000
--- a/infrastructure/blocks/pipeline/iam.tf
+++ /dev/null
@@ -1,264 +0,0 @@
-resource "aws_iam_policy" "pipeline_ecr_access" {
-  # checkov:skip=CKV_AWS_355: GetAuthorizationToken has no resource constraint
-  name        = "pipeline_ecr_access"
-  description = "Allow pipeline to access ECR"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [
-      {
-        Effect : "Allow",
-        Action : [
-          "ecr:GetAuthorizationToken",
-        ],
-        Resource : "*"
-      },
-      {
-        Effect : "Allow",
-        Action : [
-          "ecs:UpdateService",
-          "ecs:DescribeServices",
-        ],
-        Resource : "arn:aws:ecs:${var.aws_region}:${var.aws_account}:*"
-      },
-      {
-        Effect : "Allow",
-        Action : [
-          "ecr:BatchDeleteImage",
-          "ecr:DescribeImageScanFindings",
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:DescribeRegistry",
-          "ecr:DescribeImageReplicationStatus",
-          "ecr:GetAuthorizationToken",
-          "ecr:ListTagsForResource",
-          "ecr:UploadLayerPart",
-          "ecr:ListImages",
-          "ecr:PutImage",
-          "ecr:UntagResource",
-          "ecr:BatchGetImage",
-          "ecr:CompleteLayerUpload",
-          "ecr:DescribeImages",
-          "ecr:TagResource",
-          "ecr:DescribeRepositories",
-          "ecr:InitiateLayerUpload",
-          "ecr:BatchCheckLayerAvailability",
-        ],
-        Resource : [
-          data.terraform_remote_state.ecr-state.outputs.ecr_private_repo_arn,
-          data.terraform_remote_state.ecr-state.outputs.ecr_private_ckan_repo_arn
-        ]
-      }
-    ]
-  })
-}
-
-resource "aws_iam_policy" "pipeline_ecr_public_access" {
-  # checkov:skip=CKV_AWS_355: GetAuthorizationToken has no resource constraint
-  # checkov:skip=CKV_AWS_287: GetServiceBearerToken has no resource constraint
-  name        = "pipeline_ecr_public_access"
-  description = "Allow pipeline to access the public ECR"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [
-      {
-        Effect : "Allow",
-        Action : [
-          "ecr-public:GetAuthorizationToken",
-          "sts:GetServiceBearerToken",
-        ],
-        Resource : "*"
-      },
-      {
-        Effect : "Allow",
-        Action : [
-          "ecr-public:BatchCheckLayerAvailability",
-          "ecr-public:GetRepositoryPolicy",
-          "ecr-public:DescribeRepositories",
-          "ecr-public:DescribeRegistries",
-          "ecr-public:DescribeImages",
-          "ecr-public:DescribeImageTags",
-          "ecr-public:GetRepositoryCatalogData",
-          "ecr-public:GetRegistryCatalogData",
-          "ecr-public:InitiateLayerUpload",
-          "ecr-public:UploadLayerPart",
-          "ecr-public:CompleteLayerUpload",
-          "ecr-public:PutImage"
-        ],
-        Resource : [
-          data.terraform_remote_state.ecr-state.outputs.ecr_public_repo_arn,
-          data.terraform_remote_state.ecr-state.outputs.ecr_public_ckan_repo_arn
-        ]
-      }
-    ]
-  })
-}
-
-resource "aws_iam_policy" "pipeline_s3_access" {
-  name        = "pipeline_s3_access"
-  description = "Allow pipeline to access S3"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Statement" : [
-      {
-        "Action" : "s3:ListBucket",
-        "Effect" : "Allow",
-        "Resource" : [
-          data.terraform_remote_state.s3-state.outputs.s3_bucket_arn,
-          data.terraform_remote_state.s3-state-preprod.outputs.s3_bucket_arn,
-          data.terraform_remote_state.s3-state-dev.outputs.s3_bucket_arn
-        ]
-      },
-      {
-        "Action" : [
-          "s3:PutObject",
-          "s3:GetObject",
-          "s3:DeleteObject",
-          "s3:DeleteObjects",
-          "s3:ListObjects"
-        ],
-        "Effect" : "Allow",
-        "Resource" : [
-          "${data.terraform_remote_state.s3-state.outputs.s3_bucket_arn}/data/default/test_e2e/*",
-          "${data.terraform_remote_state.s3-state.outputs.s3_bucket_arn}/raw_data/default/test_e2e/*",
-          "${data.terraform_remote_state.s3-state-preprod.outputs.s3_bucket_arn}/data/default/test_e2e/*",
-          "${data.terraform_remote_state.s3-state-preprod.outputs.s3_bucket_arn}/raw_data/default/test_e2e/*",
-          "${data.terraform_remote_state.s3-state-dev.outputs.s3_bucket_arn}/data/default/test_e2e/*",
-          "${data.terraform_remote_state.s3-state-dev.outputs.s3_bucket_arn}/raw_data/default/test_e2e/*"
-        ]
-      }
-    ],
-    "Version" : "2012-10-17"
-  })
-}
-
-resource "aws_iam_policy" "pipeline_secrets_manager_access" {
-  # checkov:skip=CKV_AWS_355: Allow secrets manager access
-  # checkov:skip=CKV_AWS_288: Likewise
-  name        = "pipeline_secrets_manager_access"
-  description = "Allow pipeline to access AWS Secrets Manager"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Statement" : [
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "secretsmanager:GetRandomPassword",
-          "secretsmanager:GetResourcePolicy",
-          "secretsmanager:GetSecretValue",
-          "secretsmanager:DescribeSecret",
-          "secretsmanager:ListSecretVersionIds",
-          "secretsmanager:ListSecrets"
-        ],
-        "Resource" : "*"
-      }
-    ],
-    "Version" : "2012-10-17"
-  })
-}
-
-resource "aws_iam_policy" "pipeline_dynamodb_access" {
-  # checkov:skip=CKV_AWS_290: Allow dynamodb access
-  # checkov:skip=CKV_AWS_355: Likewise
-  name        = "pipeline_dynamodb_access"
-  description = "Allow pipeline to access DynamoDB"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Statement" : [
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "dynamodb:Query",
-          "dynamodb:BatchWriteItem",
-        ],
-        "Resource" : "*"
-      }
-    ],
-    "Version" : "2012-10-17"
-  })
-}
-
-resource "aws_iam_policy" "pipeline_glue_access" {
-  # checkov:skip=CKV_AWS_290: Allow glue access
-  # checkov:skip=CKV_AWS_355: Likewise
-  name        = "pipeline_glue_access"
-  description = "Allow pipeline to access Glue"
-  tags        = var.tags
-
-  policy = jsonencode({
-    "Statement" : [
-      {
-        "Effect" : "Allow",
-        "Action" : [
-          "glue:DeleteTable",
-          "glue:TagResource",
-        ],
-        "Resource" : "*"
-      },
-    ],
-    "Version" : "2012-10-17"
-  })
-}
-
-resource "aws_iam_role" "pipeline_ecr_role" {
-  name = "pipeline-ecr-role"
-  tags = var.tags
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-
-resource "aws_iam_role_policy_attachment" "ssm_policy_attachment" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
-}
-
-
-resource "aws_iam_role_policy_attachment" "ecr_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_ecr_access.arn
-}
-
-resource "aws_iam_role_policy_attachment" "ecr_public_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_ecr_public_access.arn
-}
-
-resource "aws_iam_role_policy_attachment" "s3_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_s3_access.arn
-}
-
-resource "aws_iam_role_policy_attachment" "secrets_manager_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_secrets_manager_access.arn
-}
-
-resource "aws_iam_role_policy_attachment" "dynamodb_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_dynamodb_access.arn
-}
-
-resource "aws_iam_role_policy_attachment" "glue_role_policy_attach" {
-  role       = aws_iam_role.pipeline_ecr_role.name
-  policy_arn = aws_iam_policy.pipeline_glue_access.arn
-}
diff --git a/infrastructure/blocks/pipeline/initialisation-script.sh.tpl b/infrastructure/blocks/pipeline/initialisation-script.sh.tpl
deleted file mode 100644
index 00995048..00000000
--- a/infrastructure/blocks/pipeline/initialisation-script.sh.tpl
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-# ---- Start docker service
-sudo service docker start
-
-# ---- Allow ubuntu user to manage Docker service
-sudo usermod -a -G docker ubuntu
-
-# Install GitHub Actions Runner
-# Need to run these commands as the ubuntu user for correct permissions
-sudo -u ubuntu mkdir /home/ubuntu/actions-runner
-cd /home/ubuntu/actions-runner
-sudo -u ubuntu curl -o actions-runner-linux-x64-2.307.1.tar.gz -L https://github.com/actions/runner/releases/download/v2.307.1/actions-runner-linux-x64-2.307.1.tar.gz
-sudo -u ubuntu tar xzf ./actions-runner-linux-x64-2.307.1.tar.gz
-sudo -u ubuntu ./config.sh --url https://github.com/no10ds --token "${runner-registration-token}" --name Data-F1-Pipeline-Runner --unattended --replace
-
-# Run the GitHub Actions Runner
-sudo -u ubuntu ./run.sh &
-
-# # Configure the GitHub Actions Runner to start on reboot
-sudo crontab -l -u ubuntu | echo "@reboot sudo -u ubuntu /home/ubuntu/actions-runner/run.sh &" | sudo crontab -u ubuntu -
diff --git a/infrastructure/blocks/pipeline/main.tf b/infrastructure/blocks/pipeline/main.tf
deleted file mode 100644
index 7dc9d931..00000000
--- a/infrastructure/blocks/pipeline/main.tf
+++ /dev/null
@@ -1,56 +0,0 @@
-resource "aws_instance" "pipeline" {
-  #checkov:skip=CKV_AWS_135:EBS Optimised not available for instance type
-  ami                         = data.aws_ami.this.id
-  instance_type               = "t3.medium"
-  associate_public_ip_address = false
-  iam_instance_profile        = aws_iam_instance_profile.pipeline_instance_profile.name
-  subnet_id                   = data.terraform_remote_state.vpc-state.outputs.private_subnets_ids[0]
-  user_data                   = data.template_file.initialise-runner.rendered
-  monitoring                  = true
-  vpc_security_group_ids      = [aws_security_group.this.id]
-
-  metadata_options {
-    http_endpoint = "enabled"
-    http_tokens   = "required"
-  }
-
-  root_block_device {
-    encrypted   = true
-    volume_size = 64
-  }
-
-  tags = merge(
-    var.tags,
-    {
-      Name = "github-action-runner"
-    },
-  )
-}
-
-resource "aws_iam_instance_profile" "pipeline_instance_profile" {
-  name = "pipeline_instance_profile"
-  role = aws_iam_role.pipeline_ecr_role.name
-}
-
-data "template_file" "initialise-runner" {
-  template = file("${path.module}/initialisation-script.sh.tpl")
-  vars = {
-    runner-registration-token = var.runner-registration-token
-  }
-}
-
-resource "aws_security_group" "this" {
-  vpc_id      = data.terraform_remote_state.vpc-state.outputs.vpc_id
-  name        = "${var.resource-name-prefix}-pipeline-sg"
-  description = "Pipeline security group"
-}
-
-resource "aws_security_group_rule" "this" {
-  type              = "egress"
-  description       = "Allow all outbound traffic"
-  from_port         = 0
-  to_port           = 65535
-  protocol          = "TCP"
-  cidr_blocks       = ["0.0.0.0/0"]
-  security_group_id = aws_security_group.this.id
-}
diff --git a/infrastructure/blocks/pipeline/outputs.tf b/infrastructure/blocks/pipeline/outputs.tf
deleted file mode 100644
index 151d5c96..00000000
--- a/infrastructure/blocks/pipeline/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "tags" {
-  value       = var.tags
-  description = "The tags used in the project"
-}
diff --git a/infrastructure/blocks/pipeline/provider.tf b/infrastructure/blocks/pipeline/provider.tf
deleted file mode 100644
index b94153b4..00000000
--- a/infrastructure/blocks/pipeline/provider.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-terraform {
-  backend "s3" {
-    key = "pipeline/terraform.tfstate"
-  }
-}
diff --git a/infrastructure/blocks/pipeline/variables.tf b/infrastructure/blocks/pipeline/variables.tf
deleted file mode 100644
index cbcbfcc6..00000000
--- a/infrastructure/blocks/pipeline/variables.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-variable "tags" {
-  type        = map(string)
-  description = "A common map of tags for all VPC resources that are created (for e.g. billing purposes)"
-}
-
-variable "runner-registration-token" {
-  description = "The Github Actions Runner registration token (you can get this from Settings > Actions > Runner (or by hitting the relevant endpoint))"
-  type        = string
-}
-
-variable "state_bucket" {
-  type        = string
-  description = "Bucket name for backend state"
-}
-
-variable "aws_account" {
-  type        = string
-  description = "AWS Account number to host the rAPId service"
-}
-
-variable "aws_region" {
-  type        = string
-  description = "The region of the AWS Account for the rAPId service"
-}
-
-variable "pipeline_ami_version" {
-  type        = string
-  description = "The version of the pipeline AMI to use"
-}
-
-variable "resource-name-prefix" {
-  type        = string
-  description = "The prefix to add to resources for easier identification"
-}
diff --git a/infrastructure/blocks/pipeline/versions.tf b/infrastructure/blocks/pipeline/versions.tf
deleted file mode 100644
index bebf677a..00000000
--- a/infrastructure/blocks/pipeline/versions.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 4.53.0"
-    }
-  }
-  required_version = ">= 1.5"
-}
diff --git a/infrastructure/blocks/s3/main.tf b/infrastructure/blocks/s3/main.tf
index 14cd430b..2ab51ad6 100644
--- a/infrastructure/blocks/s3/main.tf
+++ b/infrastructure/blocks/s3/main.tf
@@ -6,30 +6,39 @@ terraform {
 
 resource "aws_s3_bucket" "rapid_data_storage" {
   #checkov:skip=CKV_AWS_144:No need for cross region replication
-  #checkov:skip=CKV_AWS_145:No need for non default key
   #checkov:skip=CKV2_AWS_62:No need for event notifications
   #checkov:skip=CKV2_AWS_61:No need for lifecycle configuration
   bucket        = var.data_bucket_name
   force_destroy = false
 
   tags = var.tags
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = "" # use default
-        sse_algorithm     = "AES256"
-      }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_data_storage" {
+  bucket = aws_s3_bucket.rapid_data_storage.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = "aws:kms"
     }
   }
-  versioning {
-    enabled = true
-  }
-  logging {
-    target_bucket = aws_s3_bucket.logs.bucket
-    target_prefix = "log/${var.data_bucket_name}"
+}
+
+resource "aws_s3_bucket_versioning" "rapid_data_storage" {
+  bucket = aws_s3_bucket.rapid_data_storage.id
+
+  versioning_configuration {
+    status = "Enabled"
   }
 }
 
+resource "aws_s3_bucket_logging" "rapid_data_storage" {
+  bucket = aws_s3_bucket.rapid_data_storage.id
+
+  target_bucket = aws_s3_bucket.logs.bucket
+  target_prefix = "log/${var.data_bucket_name}"
+}
+
 resource "aws_s3_bucket_ownership_controls" "rapid_data_storage" {
   bucket = aws_s3_bucket.rapid_data_storage.id
 
@@ -60,7 +69,6 @@ resource "aws_s3_bucket_notification" "rapid_data_storage" {
 
 resource "aws_s3_bucket" "logs" {
   #checkov:skip=CKV_AWS_144:No need for cross region replication
-  #checkov:skip=CKV_AWS_145:No need for non default key
   #checkov:skip=CKV_AWS_18:Log bucket shouldn't be logging
   #checkov:skip=CKV_AWS_21:No need to version log bucket
   #checkov:skip=CKV2_AWS_62:No need for event notifications
@@ -69,12 +77,14 @@ resource "aws_s3_bucket" "logs" {
   force_destroy = false
 
   tags = var.tags
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = "" # use default
-        sse_algorithm     = "AES256"
-      }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
+  bucket = aws_s3_bucket.logs.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = "aws:kms"
     }
   }
 }
@@ -100,3 +110,51 @@ resource "aws_s3_bucket_public_access_block" "logs" {
   block_public_policy     = true
   restrict_public_buckets = true
 }
+
+resource "aws_s3_bucket_policy" "rapid_data_storage_secure_transport" {
+  bucket = aws_s3_bucket.rapid_data_storage.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AllowSSLRequestsOnly"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource = [
+          aws_s3_bucket.rapid_data_storage.arn,
+          "${aws_s3_bucket.rapid_data_storage.arn}/*"
+        ]
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_s3_bucket_policy" "logs_secure_transport" {
+  bucket = aws_s3_bucket.logs.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AllowSSLRequestsOnly"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource = [
+          aws_s3_bucket.logs.arn,
+          "${aws_s3_bucket.logs.arn}/*"
+        ]
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      }
+    ]
+  })
+}
diff --git a/infrastructure/modules/app-cluster/load_balancer.tf b/infrastructure/modules/app-cluster/load_balancer.tf
index 8ff15435..024bcb06 100644
--- a/infrastructure/modules/app-cluster/load_balancer.tf
+++ b/infrastructure/modules/app-cluster/load_balancer.tf
@@ -1,5 +1,4 @@
 resource "aws_alb" "application_load_balancer" {
-  #checkov:skip=CKV_AWS_150:No need for deletion protection
   #checkov:skip=CKV2_AWS_28:No need for load balancer waf
   name                       = "${var.resource-name-prefix}-alb"
   internal                   = false
diff --git a/infrastructure/modules/app-cluster/main.tf b/infrastructure/modules/app-cluster/main.tf
index 02767227..6940c209 100644
--- a/infrastructure/modules/app-cluster/main.tf
+++ b/infrastructure/modules/app-cluster/main.tf
@@ -66,6 +66,14 @@ resource "aws_iam_policy" "app_s3_access" {
           "s3:PutObject"
         ],
         "Resource" : "${var.data_s3_bucket_arn}/data/schemas/**/*.json"
+      },
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:Decrypt",
+          "kms:GenerateDataKey"
+        ],
+        "Resource" : "arn:aws:kms:${var.aws_region}:${var.aws_account}:alias/aws/s3"
       }
     ]
   })
@@ -119,6 +127,15 @@ resource "aws_iam_policy" "app_athena_query_access" {
           var.athena_query_output_bucket_arn,
           "${var.athena_query_output_bucket_arn}/*"
         ]
+      },
+      {
+        "Sid" : "KMSAccess",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:Decrypt",
+          "kms:GenerateDataKey"
+        ],
+        "Resource" : "arn:aws:kms:${var.aws_region}:${var.aws_account}:alias/aws/s3"
       }
     ]
   })
diff --git a/infrastructure/modules/aws-core/README.md b/infrastructure/modules/aws-core/README.md
deleted file mode 100644
index 579f2a1c..00000000
Binary files a/infrastructure/modules/aws-core/README.md and /dev/null differ
diff --git a/infrastructure/modules/aws-core/config/main.tf b/infrastructure/modules/aws-core/config/main.tf
deleted file mode 100644
index aba1c629..00000000
--- a/infrastructure/modules/aws-core/config/main.tf
+++ /dev/null
@@ -1,539 +0,0 @@
-data "aws_iam_policy_document" "config_assume_role_policy" {
-  statement {
-    actions = ["sts:AssumeRole"]
-    effect  = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["config.amazonaws.com"]
-    }
-  }
-}
-
-resource "aws_iam_role" "config" {
-  name = var.iam_role_name
-
-  assume_role_policy = data.aws_iam_policy_document.config_assume_role_policy.json
-}
-
-resource "aws_iam_role_policy_attachment" "config" {
-  role       = aws_iam_role.config.name
-  policy_arn = local.config_policy_arn
-}
-
-data "aws_iam_policy_document" "allow_s3_access_for_aws_config_policy_document" {
-  statement {
-    effect    = "Allow"
-    actions   = ["s3:GetBucketAcl"]
-    resources = [var.enable_lifecycle_management_for_s3 ? aws_s3_bucket.config_with_lifecycle[0].arn : aws_s3_bucket.config_without_lifecycle[0].arn]
-
-    condition {
-      test     = "Bool"
-      variable = "aws:SecureTransport"
-      values   = ["true"]
-    }
-  }
-
-  statement {
-    effect    = "Allow"
-    actions   = ["s3:PutObject"]
-    resources = ["${var.enable_lifecycle_management_for_s3 ? aws_s3_bucket.config_with_lifecycle[0].arn : aws_s3_bucket.config_without_lifecycle[0].arn}/${var.bucket_key_prefix}/AWSLogs/${local.bucket_account_id}/Config/*"]
-
-    condition {
-      test     = "Bool"
-      variable = "aws:SecureTransport"
-      values   = ["true"]
-    }
-
-    condition {
-      test     = "StringEquals"
-      variable = "s3:x-amz-acl"
-      values   = ["bucket-owner-full-control"]
-    }
-  }
-}
-
-resource "aws_iam_policy" "allow_s3_access_for_aws_config_policy" {
-  name   = "allow_s3_access_for_aws_config_policy"
-  policy = data.aws_iam_policy_document.allow_s3_access_for_aws_config_policy_document.json
-}
-
-resource "aws_iam_role_policy_attachment" "allow_s3_access_for_aws_config_attachment" {
-  role       = aws_iam_role.config.name
-  policy_arn = aws_iam_policy.allow_s3_access_for_aws_config_policy.arn
-}
-
-# S3 buckets
-resource "aws_s3_bucket" "config_with_lifecycle" {
-  #checkov:skip=CKV_AWS_144:No need for cross region replication
-  #checkov:skip=CKV_AWS_18:No need for logging
-  #checkov:skip=CKV2_AWS_62:No need for event notifications
-  #checkov:skip=CKV2_AWS_6:Public blocking applied via resource
-  #checkov:skip=CKV2_AWS_61:No need for lifecycle configuration
-  count         = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket_prefix = var.bucket_prefix
-
-  lifecycle {
-    prevent_destroy = true
-
-  }
-
-}
-
-resource "aws_s3_bucket_acl" "config_with_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_with_lifecycle[0].id
-  acl    = "private"
-}
-
-resource "aws_s3_bucket_versioning" "config_with_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_with_lifecycle[0].id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "config_with_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_with_lifecycle[0].id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = var.s3_kms_sse_encryption_key_arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "config_with_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_with_lifecycle[0].id
-
-  rule {
-    id = "rule-1"
-
-    filter {
-      prefix = "${var.bucket_key_prefix}/"
-    }
-
-    expiration {
-      days = 365
-    }
-
-    noncurrent_version_expiration {
-      noncurrent_days = 365
-    }
-
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "config_with_lifecycle" {
-  count                   = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket                  = aws_s3_bucket.config_with_lifecycle[0].id
-  ignore_public_acls      = true
-  block_public_acls       = true
-  block_public_policy     = true
-  restrict_public_buckets = true
-}
-
-
-resource "aws_s3_bucket" "config_without_lifecycle" {
-  #checkov:skip=CKV_AWS_144:No need for cross region replication
-  #checkov:skip=CKV_AWS_18:No need for logging
-  #checkov:skip=CKV2_AWS_61:No need for lifecycle configuration
-  #checkov:skip=CKV2_AWS_62:No need for event notifications
-  count         = var.enable_lifecycle_management_for_s3 ? 0 : 1
-  bucket_prefix = var.bucket_prefix
-
-  force_destroy = true
-}
-
-resource "aws_s3_bucket_acl" "config_without_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_without_lifecycle[0].id
-  acl    = "private"
-}
-
-resource "aws_s3_bucket_versioning" "config_without_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_without_lifecycle[0].id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "config_without_lifecycle" {
-  count  = var.enable_lifecycle_management_for_s3 ? 1 : 0
-  bucket = aws_s3_bucket.config_without_lifecycle[0].id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = var.s3_kms_sse_encryption_key_arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-
-
-
-resource "aws_s3_bucket_public_access_block" "config_without_lifecycle" {
-  count                   = var.enable_lifecycle_management_for_s3 ? 0 : 1
-  bucket                  = aws_s3_bucket.config_without_lifecycle[0].id
-  ignore_public_acls      = true
-  block_public_acls       = true
-  block_public_policy     = true
-  restrict_public_buckets = true
-}
-
-resource "aws_config_configuration_recorder" "config" {
-  name     = var.config_recorder_name
-  role_arn = aws_iam_role.config.arn
-
-  recording_group {
-    all_supported                 = true
-    include_global_resource_types = true
-  }
-}
-
-resource "aws_config_delivery_channel" "config" {
-  name           = var.config_delivery_channel_name
-  s3_bucket_name = var.enable_lifecycle_management_for_s3 ? aws_s3_bucket.config_with_lifecycle[0].bucket : aws_s3_bucket.config_without_lifecycle[0].bucket
-  s3_key_prefix  = var.bucket_key_prefix
-
-  snapshot_delivery_properties {
-    delivery_frequency = var.delivery_frequency
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_configuration_recorder_status" "config" {
-  name       = aws_config_configuration_recorder.config.name
-  is_enabled = true
-
-  depends_on = [aws_config_delivery_channel.config]
-}
-
-resource "aws_config_config_rule" "instances_in_vpc" {
-  name = "instances_in_vpc"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "INSTANCES_IN_VPC"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "ec2_volume_inuse_check" {
-  name = "ec2_volume_inuse_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "EC2_VOLUME_INUSE_CHECK"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "eip_attached" {
-  name = "eip_attached"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "EIP_ATTACHED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "encrypted_volumes" {
-  name = "encrypted_volumes"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "ENCRYPTED_VOLUMES"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "incoming_ssh_disabled" {
-  name = "incoming_ssh_disabled"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "INCOMING_SSH_DISABLED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "cloud_trail_enabled" {
-  name = "cloud_trail_enabled"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "CLOUD_TRAIL_ENABLED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "cloudwatch_alarm_action_check" {
-  name = "cloudwatch_alarm_action_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "CLOUDWATCH_ALARM_ACTION_CHECK"
-  }
-
-  input_parameters = jsonencode({
-    alarmActionRequired            = "true"
-    insufficientDataActionRequired = "false"
-    okActionRequired               = "false"
-  })
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "iam_group_has_users_check" {
-  name = "iam_group_has_users_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_GROUP_HAS_USERS_CHECK"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-//see https://docs.aws.amazon.com/config/latest/developerguide/iam-password-policy.html
-resource "aws_config_config_rule" "iam_password_policy" {
-  name = "iam_password_policy"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_PASSWORD_POLICY"
-  }
-
-  input_parameters = jsonencode(
-    {
-      RequireUppercaseCharacters = local.password_policy["require_uppercase_characters"]
-      RequireLowercaseCharacters = local.password_policy["require_lowercase_characters"]
-      RequireSymbols             = local.password_policy["require_symbols"]
-      RequireNumbers             = local.password_policy["require_numbers"]
-      MinimumPasswordLength      = local.password_policy["minimum_password_length"]
-      PasswordReusePrevention    = local.password_policy["password_reuse_prevention"]
-      MaxPasswordAge             = local.password_policy["max_password_age"]
-    }
-  )
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "iam_user_group_membership_check" {
-  name = "iam_user_group_membership_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
-  }
-
-  input_parameters = jsonencode(var.iam_user_groups)
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "iam_user_no_policies_check" {
-  name = "iam_user_no_policies_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_USER_NO_POLICIES_CHECK"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "root_account_mfa_enabled" {
-  name = "root_account_mfa_enabled"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "s3_bucket_public_read_prohibited" {
-  name = "s3_bucket_public_read_prohibited"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "S3_BUCKET_PUBLIC_READ_PROHIBITED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "s3_bucket_public_write_prohibited" {
-  name = "s3_bucket_public_write_prohibited"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "S3_BUCKET_PUBLIC_WRITE_PROHIBITED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "s3_bucket_ssl_requests_only" {
-  name = "s3_bucket_ssl_requests_only"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "S3_BUCKET_SSL_REQUESTS_ONLY"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "s3_bucket_server_side_encryption_enabled" {
-  name = "s3_bucket_server_side_encryption_enabled"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "s3_bucket_versioning_enabled" {
-  name = "s3_bucket_versioning_enabled"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "S3_BUCKET_VERSIONING_ENABLED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "ebs_optimized_instance" {
-  name = "ebs_optimized_instance"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "EBS_OPTIMIZED_INSTANCE"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "access_key_rotated" {
-  name = "access_key_rotated"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "ACCESS_KEYS_ROTATED"
-  }
-
-  input_parameters = jsonencode({
-    maxAccessKeyAge = var.max_access_key_age
-  })
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "approved_amis_by_tag" {
-  count = length(var.amis_by_tag_key_and_value_list) > 0 ? 1 : 0
-  name  = "approved_amis_by_tag"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "APPROVED_AMIS_BY_TAG"
-  }
-
-  input_parameters = jsonencode({
-    amisByTagKeyAndValue = var.amis_by_tag_key_and_value_list
-  })
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "autoscaling_group_elb_healthcheck_required" {
-  name = "autoscaling_group_elb_healthcheck_required"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "desired_instance_type" {
-  count = length(var.desired_instance_types) > 0 ? 1 : 0
-  name  = "desired_instance_type"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "DESIRED_INSTANCE_TYPE"
-  }
-
-  input_parameters = jsonencode({
-    InstanceType = var.desired_instance_types
-  })
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "rds_instance_public_access_check" {
-  name = "rds_instance_public_access_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "RDS_INSTANCE_PUBLIC_ACCESS_CHECK"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "rds_snapshots_public_prohibited" {
-  name = "rds_snapshots_public_prohibited"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "RDS_SNAPSHOTS_PUBLIC_PROHIBITED"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "iam_policy_no_statements_with_admin_access" {
-  name = "iam_policy_no_statements_with_admin_access"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
-
-resource "aws_config_config_rule" "iam_root_access_key_check" {
-  name = "iam_root_access_key_check"
-
-  source {
-    owner             = "AWS"
-    source_identifier = "IAM_ROOT_ACCESS_KEY_CHECK"
-  }
-
-  depends_on = [aws_config_configuration_recorder.config]
-}
diff --git a/infrastructure/modules/aws-core/config/outputs.tf b/infrastructure/modules/aws-core/config/outputs.tf
deleted file mode 100644
index e0a6ea91..00000000
--- a/infrastructure/modules/aws-core/config/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "config_s3_bucket_id" {
-  description = "The ID of the S3 bucket AWS Config writes its findings into"
-  value       = var.enable_lifecycle_management_for_s3 ? aws_s3_bucket.config_with_lifecycle[0].id : aws_s3_bucket.config_without_lifecycle[0].id
-}
diff --git a/infrastructure/modules/aws-core/config/variables.tf b/infrastructure/modules/aws-core/config/variables.tf
deleted file mode 100644
index 68229584..00000000
--- a/infrastructure/modules/aws-core/config/variables.tf
+++ /dev/null
@@ -1,99 +0,0 @@
-variable "bucket_prefix" {
-  type        = string
-  description = "The prefix for the S3 bucket AWS Config Recorder writes to"
-  default     = "aws-config"
-}
-
-variable "bucket_key_prefix" {
-  type        = string
-  description = "The prefix of the keys AWS Config writes to"
-  default     = "aws_config"
-}
-
-variable "config_recorder_name" {
-  type        = string
-  description = "The name of the recorder for AWS Config"
-  default     = "config"
-}
-
-variable "config_delivery_channel_name" {
-  type        = string
-  description = "The name of the delivery channel for AWS Config"
-  default     = "config"
-}
-
-variable "iam_role_name" {
-  type        = string
-  description = "The name of the IAM role created for delegating permissions to AWS Config"
-  default     = "config"
-}
-
-variable "bucket_account_id" {
-  type        = string
-  description = "The AWS account ID the S3 bucket lives in that AWS Config is writing its records to. Defaults to the ID of the current account"
-  default     = ""
-}
-
-variable "delivery_frequency" {
-  type        = string
-  description = "The frequency at which AWS Config delivers its recorded findings to S3"
-  default     = "Three_Hours"
-}
-
-variable "password_policy" {
-  type        = map(string)
-  description = "A map of values describing the password policy parameters AWS Config is looking for"
-  default     = {}
-}
-
-variable "iam_user_groups" {
-  type        = map(string)
-  description = "A list of mandatory groups for IAM users"
-  default     = {}
-}
-
-variable "max_access_key_age" {
-  type        = string
-  description = "The maximum amount of days an access key can live without being rotated"
-  default     = "90"
-}
-
-variable "enable_lifecycle_management_for_s3" {
-  type        = bool
-  description = "Whether or not to enable lifecycle management for the S3 bucket AWS Config writes to"
-  default     = true
-}
-
-variable "amis_by_tag_key_and_value_list" {
-  type        = list(string)
-  description = "Required AMI tags for EC2 instances"
-  default     = []
-}
-
-variable "desired_instance_types" {
-  type        = set(string)
-  description = "A string of comma-delimited instance types"
-  default     = []
-}
-
-variable "s3_kms_sse_encryption_key_arn" {
-  type        = string
-  description = "The ARN for the KMS key to use for S3 server-side bucket encryption"
-  default     = "" # Use the default master key
-}
-
-locals {
-  config_policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
-  bucket_account_id = length(var.bucket_account_id) > 0 ? var.bucket_account_id : data.aws_caller_identity.current.account_id
-  password_policy = merge({
-    require_uppercase_characters = true
-    require_lowercase_characters = true
-    require_symbols              = true
-    require_numbers              = true
-    minimum_password_length      = 32
-    password_reuse_prevention    = 5
-    max_password_age             = 90
-  }, var.password_policy)
-}
-
-data "aws_caller_identity" "current" {}
diff --git a/infrastructure/modules/aws-core/config/versions.tf b/infrastructure/modules/aws-core/config/versions.tf
deleted file mode 100644
index c24371c1..00000000
--- a/infrastructure/modules/aws-core/config/versions.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-terraform {
-  required_version = ">= 1.3.5"
-}
diff --git a/infrastructure/modules/aws-core/iam-resources/iam.tf b/infrastructure/modules/aws-core/iam-resources/iam.tf
deleted file mode 100644
index 9e23136f..00000000
--- a/infrastructure/modules/aws-core/iam-resources/iam.tf
+++ /dev/null
@@ -1,204 +0,0 @@
-resource "aws_iam_account_alias" "iam_account_alias" {
-  count         = var.set_iam_account_alias ? 1 : 0
-  account_alias = var.iam_account_alias
-}
-
-# Roles
-data "aws_iam_policy_document" "admin_access_role_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "sts:AssumeRole",
-    ]
-
-    condition {
-      test     = "Bool"
-      variable = "aws:MultiFactorAuthPresent"
-      values   = ["true"]
-    }
-
-    condition {
-      test     = "NumericLessThan"
-      variable = "aws:MultiFactorAuthAge"
-      values   = [var.admin_multi_factor_auth_age]
-    }
-
-    principals {
-      type = "AWS"
-
-      identifiers = [
-        "arn:aws:iam::${local.users_account_id}:root",
-      ]
-    }
-  }
-}
-
-resource "aws_iam_role" "admin_access_role" {
-  name                 = var.admin_access_role_name
-  max_session_duration = var.admin_max_session_duration
-  assume_role_policy   = data.aws_iam_policy_document.admin_access_role_policy.json
-}
-
-data "aws_iam_policy_document" "user_access_role_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "sts:AssumeRole",
-    ]
-
-    condition {
-      test     = "Bool"
-      variable = "aws:MultiFactorAuthPresent"
-      values   = ["true"]
-    }
-
-    condition {
-      test     = "NumericLessThan"
-      variable = "aws:MultiFactorAuthAge"
-      values   = [var.user_multi_factor_auth_age]
-    }
-
-    principals {
-      type = "AWS"
-
-      identifiers = [
-        "arn:aws:iam::${local.users_account_id}:root",
-      ]
-    }
-  }
-}
-
-resource "aws_iam_role" "user_access_role" {
-  name = var.user_access_role_name
-
-  assume_role_policy = data.aws_iam_policy_document.user_access_role_policy.json
-}
-
-data "aws_iam_policy_document" "user_access_policy_document" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "iam:PassRole",
-    ]
-
-    not_resources = [
-      aws_iam_role.user_access_role.arn,
-      aws_iam_role.admin_access_role.arn
-    ]
-  }
-}
-
-resource "aws_iam_policy" "user_access_policy" {
-  name        = "user_access_policy"
-  description = "User access for roles"
-
-  policy = data.aws_iam_policy_document.user_access_policy_document.json
-}
-
-data "aws_iam_policy_document" "no_vpc_access_policy_document" {
-  statement {
-    effect = "Deny"
-
-    actions = [
-      "ec2:AcceptVpcPeeringConnection",
-      "ec2:AssociateDhcpOptions",
-      "ec2:AssociateRouteTable",
-      "ec2:AttachClassicLinkVpc",
-      "ec2:AttachInternetGateway",
-      "ec2:AttachVpnGateway",
-      "ec2:CreateCustomerGateway",
-      "ec2:CreateDhcpOptions",
-      "ec2:CreateFlowLogs",
-      "ec2:CreateInternetGateway",
-      "ec2:CreateNatGateway",
-      "ec2:CreateNetworkAcl",
-      "ec2:CreateNetworkAclEntry",
-      "ec2:CreateRoute",
-      "ec2:CreateRouteTable",
-      "ec2:CreateSubnet",
-      "ec2:CreateVpc",
-      "ec2:CreateVpcPeeringConnection",
-      "ec2:CreateVpnConnection",
-      "ec2:CreateVpnConnectionRoute",
-      "ec2:CreateVpnGateway",
-      "ec2:DeleteCustomerGateway",
-      "ec2:DeleteDhcpOptions",
-      "ec2:DeleteInternetGateway",
-      "ec2:DeleteNatGateway",
-      "ec2:DeleteNetworkAcl",
-      "ec2:DeleteNetworkAclEntry",
-      "ec2:DeleteRoute",
-      "ec2:DeleteRouteTable",
-      "ec2:DeleteSubnet",
-      "ec2:DeleteVpc",
-      "ec2:DeleteVpnConnection",
-      "ec2:DeleteVpnConnectionRoute",
-      "ec2:DeleteVpnGateway",
-      "ec2:DetachClassicLinkVpc",
-      "ec2:DetachInternetGateway",
-      "ec2:DetachVpnGateway",
-      "ec2:DisableVgwRoutePropagation",
-      "ec2:DisableVpcClassicLink",
-      "ec2:DisableVpcClassicLinkDnsSupport",
-      "ec2:DisassociateRouteTable",
-      "ec2:EnableVgwRoutePropagation",
-      "ec2:EnableVpcClassicLink",
-      "ec2:EnableVpcClassicLinkDnsSupport",
-      "ec2:ModifySubnetAttribute",
-      "ec2:ModifyVpcAttribute",
-      "ec2:ModifyVpcEndpoint",
-      "ec2:ModifyVpcPeeringConnectionOptions",
-      "ec2:MoveAddressToVpc",
-      "ec2:RejectVpcPeeringConnection",
-      "ec2:ReplaceNetworkAclAssociation",
-      "ec2:ReplaceNetworkAclEntry",
-      "ec2:ReplaceRoute",
-      "ec2:ReplaceRouteTableAssociation",
-      "ec2:RestoreAddressToClassic",
-    ]
-
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_policy" "user_no_vpc_access_policy" {
-  name        = "user_no_vpc_access_policy"
-  description = "deny user access to VPC related commands"
-
-  policy = data.aws_iam_policy_document.no_vpc_access_policy_document.json
-}
-
-# Policy attachments for roles
-resource "aws_iam_policy_attachment" "admin_access_policy_attachment" {
-  # checkov:skip=CKV_AWS_274: Allow for AWS Administator Access
-  name       = "admin_access_policy_attachment"
-  roles      = [aws_iam_role.admin_access_role.name]
-  policy_arn = local.administrator_access_policy_arn
-}
-
-resource "aws_iam_policy_attachment" "user_access_policy_attachment" {
-  name       = "user_access_policy_attachment"
-  roles      = [aws_iam_role.user_access_role.name]
-  policy_arn = aws_iam_policy.user_access_policy.arn
-}
-
-resource "aws_iam_policy_attachment" "user_access_no_vpc_access_policy_attachment" {
-  name       = "user_access_no_vpc_access_policy_attachment"
-  roles      = [aws_iam_role.user_access_role.name]
-  policy_arn = aws_iam_policy.user_no_vpc_access_policy.arn
-}
-
-resource "aws_iam_policy_attachment" "user_access_iam_read_only_policy_attachment" {
-  name       = "user_access_iam_read_only_policy_attachment"
-  roles      = [aws_iam_role.user_access_role.name]
-  policy_arn = local.iam_read_only_access_policy_arn
-}
-
-resource "aws_iam_policy_attachment" "user_access_power_user_policy_attachment" {
-  name       = "user_access_power_user_policy_attachment"
-  roles      = [aws_iam_role.user_access_role.name]
-  policy_arn = local.power_user_access_policy_arn
-}
diff --git a/infrastructure/modules/aws-core/iam-resources/outputs.tf b/infrastructure/modules/aws-core/iam-resources/outputs.tf
deleted file mode 100644
index 3da8433b..00000000
--- a/infrastructure/modules/aws-core/iam-resources/outputs.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-output "resource_admin_role_name" {
-  value       = aws_iam_role.admin_access_role.name
-  description = "The name of the role users are able to assume to attain admin privileges"
-}
-
-output "resource_admin_role_arn" {
-  value       = aws_iam_role.admin_access_role.arn
-  description = "The ARN of the role users are able to assume to attain admin privileges"
-}
-
-output "resource_user_role_name" {
-  value       = aws_iam_role.user_access_role.name
-  description = "The name of the role users are able to assume to attain user privileges"
-}
-
-output "resource_user_role_arn" {
-  value       = aws_iam_role.user_access_role.arn
-  description = "The ARN of the role users are able to assume to attain user privileges"
-}
diff --git a/infrastructure/modules/aws-core/iam-resources/variables.tf b/infrastructure/modules/aws-core/iam-resources/variables.tf
deleted file mode 100644
index dc3f269c..00000000
--- a/infrastructure/modules/aws-core/iam-resources/variables.tf
+++ /dev/null
@@ -1,55 +0,0 @@
-variable "iam_account_alias" {
-  type        = string
-  description = "A globally unique identifier, human-readable for your AWS account"
-}
-
-variable "users_account_id" {
-  type        = string
-  description = "The account ID of where the users are living in"
-  default     = ""
-}
-
-variable "set_iam_account_alias" {
-  type        = bool
-  description = "Whether or not to set the account alias (useful to set to false when iam-users and iam-resources module are being deployed into the same account)"
-  default     = true
-}
-
-variable "admin_multi_factor_auth_age" {
-  type        = string
-  description = "The amount of time (in seconds) for a admin session to be valid"
-  default     = "3600"
-}
-
-variable "user_multi_factor_auth_age" {
-  type        = string
-  description = "The amount of time (in seconds) for a user session to be valid"
-  default     = "14400"
-}
-
-variable "admin_access_role_name" {
-  type        = string
-  description = "Name of the admin role"
-  default     = "resource-admin"
-}
-
-variable "user_access_role_name" {
-  type        = string
-  description = "Name of the user role"
-  default     = "resource-user"
-}
-
-variable "admin_max_session_duration" {
-  type        = string
-  description = "The maximum session duration for the admin role"
-  default     = "3600"
-}
-
-data "aws_caller_identity" "current" {}
-
-locals {
-  administrator_access_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
-  iam_read_only_access_policy_arn = "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
-  power_user_access_policy_arn    = "arn:aws:iam::aws:policy/PowerUserAccess"
-  users_account_id                = length(var.users_account_id) > 0 ? var.users_account_id : data.aws_caller_identity.current.account_id
-}
diff --git a/infrastructure/modules/aws-core/iam-resources/versions.tf b/infrastructure/modules/aws-core/iam-resources/versions.tf
deleted file mode 100644
index 1ee80683..00000000
--- a/infrastructure/modules/aws-core/iam-resources/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 1.3.5"
-}
diff --git a/infrastructure/modules/aws-core/iam-users/iam.tf b/infrastructure/modules/aws-core/iam-users/iam.tf
deleted file mode 100644
index 68d19ae5..00000000
--- a/infrastructure/modules/aws-core/iam-users/iam.tf
+++ /dev/null
@@ -1,236 +0,0 @@
-# This is a policy which lets you self-service your own access keys.
-# The only condition is that you have a MFA enabled session
-data "aws_iam_policy_document" "aws_access_key_self_service_policy" {
-  statement {
-    actions = [
-      "iam:CreateAccessKey",
-      "iam:DeleteAccessKey",
-      "iam:ListAccessKeys",
-      "iam:UpdateAccessKey",
-    ]
-
-    effect = "Allow"
-
-    condition {
-      test     = "Bool"
-      variable = "aws:MultiFactorAuthPresent"
-      values   = ["true"]
-    }
-
-    condition {
-      test     = "NumericLessThan"
-      variable = "aws:MultiFactorAuthAge"
-      values   = [var.multi_factor_auth_age]
-    }
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}",
-    ]
-  }
-}
-
-resource "aws_iam_policy" "aws_access_key_self_service" {
-  name        = "aws_access_key_self_service"
-  description = "Policy for access key self service"
-
-  policy = data.aws_iam_policy_document.aws_access_key_self_service_policy.json
-}
-
-resource "aws_iam_account_password_policy" "strict" {
-  # checkov:skip=CKV_AWS_9:Let users determine their own password policy
-  # checkov:skip=CKV_AWS_11:Let users determine their own password policy
-  # checkov:skip=CKV_AWS_12:Let users determine their own password policy
-  # checkov:skip=CKV_AWS_13:Let users determine their own password policy
-  # checkov:skip=CKV_AWS_14:Let users determine their own password policy
-  # checkov:skip=CKV_AWS_15:Let users determine their own password policy
-  minimum_password_length        = local.password_policy["minimum_password_length"]
-  max_password_age               = local.password_policy["max_password_age"]
-  password_reuse_prevention      = local.password_policy["password_reuse_prevention"]
-  require_lowercase_characters   = local.password_policy["require_lowercase_characters"]
-  require_numbers                = local.password_policy["require_numbers"]
-  require_uppercase_characters   = local.password_policy["require_uppercase_characters"]
-  require_symbols                = local.password_policy["require_symbols"]
-  allow_users_to_change_password = local.password_policy["allow_users_to_change_password"]
-}
-
-# This allows users without MFA to at least get a few details about their own account
-data "aws_iam_policy_document" "aws_list_iam_users_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "iam:GetAccountSummary",
-      "iam:ListAccountAliases",
-      "iam:ListGroupsForUser",
-      "iam:ListUsers",
-    ]
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:*",
-    ]
-  }
-
-  statement {
-    actions = ["iam:GetUser"]
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}",
-    ]
-
-    effect = "Allow"
-  }
-}
-
-resource "aws_iam_policy" "aws_list_iam_users" {
-  name        = "aws_list_iam_users"
-  description = "Let users see the list of users"
-
-  policy = data.aws_iam_policy_document.aws_list_iam_users_policy.json
-}
-
-data "aws_iam_policy_document" "aws_mfa_self_service_policy" {
-  statement {
-    effect = "Allow"
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}",
-    ]
-
-    actions = [
-      "iam:DeactivateMFADevice",
-      "iam:EnableMFADevice",
-      "iam:ResyncMFADevice",
-      "iam:ListVirtualMFADevices",
-      "iam:ListMFADevices",
-    ]
-  }
-
-  statement {
-    effect = "Allow"
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/$${aws:username}",
-    ]
-
-    actions = [
-      "iam:CreateVirtualMFADevice",
-      "iam:DeleteVirtualMFADevice",
-    ]
-  }
-
-  statement {
-    effect = "Allow"
-
-    resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/*",
-    ]
-
-    actions = [
-      "iam:ListVirtualMFADevices",
-      "iam:ListMFADevices",
-    ]
-  }
-}
-
-resource "aws_iam_policy" "aws_mfa_self_service" {
-  name        = "aws_mfa_self_service"
-  description = "Policy for MFA self service"
-
-  policy = data.aws_iam_policy_document.aws_mfa_self_service_policy.json
-}
-
-resource "aws_iam_account_alias" "iam_account_alias" {
-  count         = var.set_iam_account_alias ? 1 : 0
-  account_alias = var.iam_account_alias
-}
-
-# Users
-resource "aws_iam_user" "users" {
-  # checkov:skip=CKV_AWS_273: Allow for iam defined users
-  for_each = var.iam_users
-  name     = each.key
-}
-
-resource "aws_iam_user_group_membership" "users_group_memberships" {
-  depends_on = [
-    aws_iam_user.users,
-    aws_iam_group.groups
-  ]
-  for_each = var.iam_users
-  user     = each.key
-
-  groups = each.value["groups"]
-}
-
-# Groups
-resource "aws_iam_group" "groups" {
-  for_each = toset(concat(
-    local.admin_groups,
-    local.user_groups
-  ))
-  name = each.key
-}
-
-# Group policy assignments
-resource "aws_iam_policy_attachment" "users_mfa_self_service" {
-  name       = "users_mfa_self_service"
-  groups     = values(aws_iam_group.groups)[*].name
-  policy_arn = aws_iam_policy.aws_mfa_self_service.arn
-}
-
-resource "aws_iam_policy_attachment" "users_access_key_self_service" {
-  name       = "users_access_key_self_service"
-  groups     = values(aws_iam_group.groups)[*].name
-  policy_arn = aws_iam_policy.aws_access_key_self_service.arn
-}
-
-resource "aws_iam_policy_attachment" "users_list_iam_users" {
-  name       = "users_list_iam_users"
-  groups     = values(aws_iam_group.groups)[*].name
-  policy_arn = aws_iam_policy.aws_list_iam_users.arn
-}
-
-# Group policies
-data "aws_iam_policy_document" "assume_role_admin_access_group_policy_document" {
-  statement {
-    actions = [
-      "sts:AssumeRole",
-    ]
-
-    effect = "Allow"
-
-    resources = [
-      "arn:aws:iam::${local.resources_account_id}:role/${var.resource_admin_role_name}",
-    ]
-  }
-}
-
-resource "aws_iam_group_policy" "assume_role_admin_access_group_policy" {
-  for_each = toset(local.admin_groups)
-  name     = "admin_access_group_policy"
-  group    = aws_iam_group.groups[each.key].id
-
-  policy = data.aws_iam_policy_document.assume_role_admin_access_group_policy_document.json
-}
-
-data "aws_iam_policy_document" "assume_role_users_access_group_policy_document" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "sts:AssumeRole",
-    ]
-
-    resources = [
-      "arn:aws:iam::${local.resources_account_id}:role/${var.resource_user_role_name}"
-    ]
-  }
-}
-
-resource "aws_iam_group_policy" "assume_role_users_access_group_policy" {
-  for_each = toset(local.user_groups)
-  name     = "users_access_group_policy"
-  group    = aws_iam_group.groups[each.key].id
-
-  policy = data.aws_iam_policy_document.assume_role_users_access_group_policy_document.json
-}
diff --git a/infrastructure/modules/aws-core/iam-users/outputs.tf b/infrastructure/modules/aws-core/iam-users/outputs.tf
deleted file mode 100644
index ca4088a5..00000000
--- a/infrastructure/modules/aws-core/iam-users/outputs.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-output "admin_group_names" {
-  value       = values(aws_iam_group.groups)[*].name
-  description = "The names of the admin groups"
-}
-
-output "user_group_names" {
-  value       = values(aws_iam_group.groups)[*].name
-  description = "The name of the user groups"
-}
diff --git a/infrastructure/modules/aws-core/iam-users/variables.tf b/infrastructure/modules/aws-core/iam-users/variables.tf
deleted file mode 100644
index d1771a56..00000000
--- a/infrastructure/modules/aws-core/iam-users/variables.tf
+++ /dev/null
@@ -1,88 +0,0 @@
-variable "iam_account_alias" {
-  type        = string
-  description = "A globally unique identifier, human-readable for your AWS account"
-}
-
-variable "set_iam_account_alias" {
-  type        = bool
-  description = "Whether or not to set the account alias (useful to set to false when iam-users and iam-resources module are being deployed into the same account)"
-  default     = true
-}
-
-variable "multi_factor_auth_age" {
-  type        = string
-  description = "The amount of time (in seconds) for a user session to be valid"
-  default     = "14400"
-}
-
-variable "password_policy" {
-  type        = map(string)
-  description = "A map of password policy parameters you want to set differently from the defaults"
-  default     = {}
-}
-
-variable "resources_account_id" {
-  type        = string
-  description = "The account ID of the AWS account you want to start resources in"
-  default     = ""
-}
-
-variable "resource_admin_role_name" {
-  type        = string
-  description = "The name of the administrator role one is supposed to assume in the resource account"
-  default     = "resource-admin"
-}
-
-variable "resource_user_role_name" {
-  type        = string
-  description = "The name of the user role one is supposed to assume in the resource account"
-  default     = "resource-user"
-}
-
-variable "admin_group_name" {
-  type        = string
-  description = "The name of the initial group created for administrators"
-  default     = "admins"
-}
-
-variable "user_group_name" {
-  type        = string
-  description = "The name of the initial group created for users"
-  default     = "users"
-}
-
-variable "additional_admin_groups" {
-  type        = list(string)
-  description = "A list of additional groups to create associated with administrative privileges"
-  default     = []
-}
-
-variable "additional_user_groups" {
-  type        = list(string)
-  description = "A list of additional groups to create associated with regular users"
-  default     = []
-}
-
-variable "iam_users" {
-  type        = map(map(list(string)))
-  description = "A list of maps of users and their groups. Default is to create no users."
-  default     = {}
-}
-
-data "aws_caller_identity" "current" {}
-
-locals {
-  resources_account_id = length(var.resources_account_id) > 0 ? var.resources_account_id : data.aws_caller_identity.current.account_id
-  password_policy = merge({
-    require_uppercase_characters   = true
-    require_lowercase_characters   = true
-    require_symbols                = true
-    require_numbers                = true
-    minimum_password_length        = 32
-    password_reuse_prevention      = 5
-    max_password_age               = 90
-    allow_users_to_change_password = true # pragma: allowlist secret
-  }, var.password_policy)
-  admin_groups = compact(concat([var.admin_group_name], var.additional_admin_groups))
-  user_groups  = compact(concat([var.user_group_name], var.additional_user_groups))
-}
diff --git a/infrastructure/modules/aws-core/iam-users/versions.tf b/infrastructure/modules/aws-core/iam-users/versions.tf
deleted file mode 100644
index f3355dbf..00000000
--- a/infrastructure/modules/aws-core/iam-users/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 1.5"
-}
diff --git a/infrastructure/modules/data-workflow/athena.tf b/infrastructure/modules/data-workflow/athena.tf
index c8fd0bad..547f02a7 100644
--- a/infrastructure/modules/data-workflow/athena.tf
+++ b/infrastructure/modules/data-workflow/athena.tf
@@ -1,6 +1,5 @@
 resource "aws_s3_bucket" "rapid_athena_query_results_bucket" {
   #checkov:skip=CKV_AWS_144:No need for cross region replication
-  #checkov:skip=CKV_AWS_145:No need for non default key
   #checkov:skip=CKV_AWS_21:No need to version query results
   #checkov:skip=CKV_AWS_18:No need to log query results
   #checkov:skip=CKV2_AWS_62:No need for event notifications
@@ -15,7 +14,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "rapid_athena_quer
 
   rule {
     apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
+      sse_algorithm = "aws:kms"
     }
   }
 }
@@ -58,8 +57,7 @@ resource "aws_athena_workgroup" "rapid_athena_workgroup" {
       output_location = "s3://${aws_s3_bucket.rapid_athena_query_results_bucket.bucket}"
 
       encryption_configuration {
-        encryption_option = "SSE_S3"
-        # kms_key_arn = ""
+        encryption_option = "SSE_KMS"
       }
     }
   }
diff --git a/infrastructure/modules/multihost-vpc/README.md b/infrastructure/modules/multihost-vpc/README.md
deleted file mode 100644
index d0476738..00000000
Binary files a/infrastructure/modules/multihost-vpc/README.md and /dev/null differ
diff --git a/infrastructure/modules/multihost-vpc/main.tf b/infrastructure/modules/multihost-vpc/main.tf
deleted file mode 100644
index 3ac6a6ea..00000000
--- a/infrastructure/modules/multihost-vpc/main.tf
+++ /dev/null
@@ -1,112 +0,0 @@
-# Multihost VPC
-resource "aws_vpc" "core" {
-  #checkov:skip=CKV2_AWS_11: No need for vpc flow logs
-  #checkov:skip=CKV2_AWS_12: Allow for non-restrictive vpc traffic
-  cidr_block           = var.vpc_cidr_range
-  enable_dns_support   = var.enable_dns_support
-  enable_dns_hostnames = var.enable_dns_hostnames
-
-  tags = merge({ Name = var.vpc_name }, var.tags)
-}
-
-# Public subnets
-resource "aws_subnet" "public_subnet" {
-  # checkov:skip=CKV_AWS_130: Allow for public IP by default
-  count                   = length(data.aws_availability_zones.available.names)
-  vpc_id                  = aws_vpc.core.id
-  cidr_block              = length(var.public_subnet_cidrs) > 0 ? var.public_subnet_cidrs[count.index] : cidrsubnet(var.vpc_cidr_range, var.public_subnet_size, count.index)
-  availability_zone       = data.aws_availability_zones.available.names[count.index]
-  map_public_ip_on_launch = true
-
-  tags = merge({
-    Name = "${local.public_subnet_prefix}_${replace(
-      data.aws_availability_zones.available.names[count.index],
-      "-",
-      "_",
-    )}"
-    Scope = "public" },
-  var.tags)
-}
-
-# IGW - Internet Gateway
-resource "aws_internet_gateway" "core_igw" {
-  vpc_id = aws_vpc.core.id
-
-  tags = merge({
-    Name = "${var.vpc_name}_igw"
-  }, var.tags)
-}
-
-# EIPs for NAT Gateways
-resource "aws_eip" "core_nat_gw_eip" {
-  count  = length(data.aws_availability_zones.available.names)
-  domain = "vpc"
-
-  depends_on = [aws_internet_gateway.core_igw]
-
-  tags = merge({
-    Name = "${var.vpc_name}_nat_gw_eip_${replace(
-      data.aws_availability_zones.available.names[count.index],
-      "-",
-      "_",
-    )}"
-  }, var.tags)
-}
-
-# NAT Gateways for private subnets
-resource "aws_nat_gateway" "core_nat_gw" {
-  count         = length(data.aws_availability_zones.available.names)
-  subnet_id     = aws_subnet.public_subnet[count.index].id
-  allocation_id = aws_eip.core_nat_gw_eip[count.index].id
-
-  tags = merge({
-    Name = "${var.vpc_name}_nat_gw_${replace(
-      data.aws_availability_zones.available.names[count.index],
-      "-",
-      "_",
-    )}"
-  }, var.tags)
-}
-
-# Route tables for public/private subnets
-resource "aws_route_table" "core_main_route_table" {
-  vpc_id = aws_vpc.core.id
-
-  tags = merge({
-    Name = "${var.vpc_name}_main_route_table_name"
-  }, var.tags)
-}
-
-resource "aws_route_table" "core_private_route_table" {
-  count  = length(data.aws_availability_zones.available.names)
-  vpc_id = aws_vpc.core.id
-
-  tags = merge({
-    Name = "${var.vpc_name}_private_route_table_${replace(
-      data.aws_availability_zones.available.names[count.index],
-      "-",
-      "_",
-    )}"
-  }, var.tags)
-}
-
-# Default public route through the IGW
-resource "aws_route" "core_main_route_table_public_default_route" {
-  route_table_id         = aws_route_table.core_main_route_table.id
-  destination_cidr_block = "0.0.0.0/0"
-  gateway_id             = aws_internet_gateway.core_igw.id
-}
-
-# Default private route through the NAT gateways
-resource "aws_route" "core_private_route_table_default_route" {
-  count                  = length(data.aws_availability_zones.available.names)
-  route_table_id         = aws_route_table.core_private_route_table[count.index].id
-  destination_cidr_block = "0.0.0.0/0"
-  nat_gateway_id         = aws_nat_gateway.core_nat_gw[count.index].id
-}
-
-# Route table associations
-resource "aws_main_route_table_association" "core_main_route_table_association" {
-  vpc_id         = aws_vpc.core.id
-  route_table_id = aws_route_table.core_main_route_table.id
-}
diff --git a/infrastructure/modules/multihost-vpc/outputs.tf b/infrastructure/modules/multihost-vpc/outputs.tf
deleted file mode 100644
index 9f395f63..00000000
--- a/infrastructure/modules/multihost-vpc/outputs.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-output "vpc_id" {
-  value       = aws_vpc.core.id
-  description = "The ID of the created VPC"
-}
-
-output "vpc_cidr_range" {
-  value       = aws_vpc.core.cidr_block
-  description = "The ID of the created VPC"
-}
-
-output "private_route_table_ids" {
-  value       = aws_route_table.core_private_route_table[*].id
-  description = "A list of private route table IDs"
-}
-
-output "public_subnet_ids" {
-  value       = aws_subnet.public_subnet[*].id
-  description = "A list of public subnet IDs"
-}
diff --git a/infrastructure/modules/multihost-vpc/variables.tf b/infrastructure/modules/multihost-vpc/variables.tf
deleted file mode 100644
index 1d8335a3..00000000
--- a/infrastructure/modules/multihost-vpc/variables.tf
+++ /dev/null
@@ -1,54 +0,0 @@
-variable "tags" {
-  type        = map(string)
-  description = "A map of tags to apply to all VPC resources"
-  default     = {}
-}
-
-variable "vpc_name" {
-  type        = string
-  description = "The name of the VPC"
-  default     = "core_vpc"
-}
-
-variable "vpc_cidr_range" {
-  type        = string
-  description = "The IP address space to use for the VPC"
-  default     = "10.0.0.0/16"
-}
-#
-variable "public_subnet_cidrs" {
-  type        = list(string)
-  description = "A list of CIDRs for the public subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)"
-  default     = []
-}
-
-variable "public_subnet_size" {
-  type        = number
-  description = "The size of the public subnet (default: 1022 usable addresses)"
-  default     = "6"
-}
-
-variable "public_subnet_prefix" {
-  type        = string
-  description = "The prefix to attach to the name of the public subnets"
-  default     = ""
-}
-
-variable "enable_dns_support" {
-  type        = bool
-  description = "Whether or not to enable VPC DNS support"
-  default     = true
-}
-
-variable "enable_dns_hostnames" {
-  type        = bool
-  description = "Whether or not to enable VPC DNS hostname support"
-  default     = true
-}
-#
-locals {
-  # We are using locals for this because there already is a fair amount of function calling inside the actual resources
-  public_subnet_prefix = length(var.public_subnet_prefix) > 0 ? var.public_subnet_prefix : "${var.vpc_name}_public_subnet"
-}
-#
-data "aws_availability_zones" "available" {}
diff --git a/infrastructure/modules/subnets/README.md b/infrastructure/modules/subnets/README.md
deleted file mode 100644
index 0ef643c4..00000000
Binary files a/infrastructure/modules/subnets/README.md and /dev/null differ
diff --git a/infrastructure/modules/subnets/main.tf b/infrastructure/modules/subnets/main.tf
deleted file mode 100644
index e1231828..00000000
--- a/infrastructure/modules/subnets/main.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-# Subnets
-# Private subnets
-resource "aws_subnet" "private_subnet" {
-  count             = length(data.aws_availability_zones.available.names)
-  vpc_id            = var.vpc_id
-  cidr_block        = length(var.private_subnet_cidrs) > 0 ? var.private_subnet_cidrs[count.index] : cidrsubnet(var.vpc_cidr_range, var.private_subnet_size, var.private_subnet_offset + count.index)
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-
-  tags = merge({
-    Name = "${local.private_subnet_prefix}_${replace(
-      data.aws_availability_zones.available.names[count.index],
-      "-",
-      "_",
-    )}"
-    Scope = "private" },
-  var.tags)
-}
-
-resource "aws_route_table_association" "core_private_route_table_association" {
-  count          = length(data.aws_availability_zones.available.names)
-  subnet_id      = aws_subnet.private_subnet[count.index].id
-  route_table_id = var.core_private_route_table_ids[count.index]
-}
diff --git a/infrastructure/modules/subnets/outputs.tf b/infrastructure/modules/subnets/outputs.tf
deleted file mode 100644
index 24444878..00000000
--- a/infrastructure/modules/subnets/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "private_subnet_ids" {
-  value       = aws_subnet.private_subnet[*].id
-  description = "A list of private subnet IDs"
-}
diff --git a/infrastructure/modules/subnets/variables.tf b/infrastructure/modules/subnets/variables.tf
deleted file mode 100644
index 4d23daa9..00000000
--- a/infrastructure/modules/subnets/variables.tf
+++ /dev/null
@@ -1,76 +0,0 @@
-variable "tags" {
-  type        = map(string)
-  description = "A map of tags to apply to all VPC resources"
-  default     = {}
-}
-#
-variable "vpc_name" {
-  type        = string
-  description = "The name of the VPC"
-  default     = "core_vpc"
-}
-#
-variable "vpc_cidr_range" {
-  type        = string
-  description = "The IP address space to use for the VPC"
-}
-
-variable "vpc_id" {
-  type        = string
-  description = "The VPC ID of the core VPC"
-}
-
-variable "core_private_route_table_ids" {
-  type        = list(string)
-  description = "The private route table IDs of the core to route private subnets to the Nat gateways "
-}
-
-variable "public_subnet_cidrs" {
-  type        = list(string)
-  description = "A list of CIDRs for the public subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)"
-  default     = []
-}
-
-variable "public_subnet_size" {
-  type        = number
-  description = "The size of the public subnet (default: 1022 usable addresses)"
-  default     = "6"
-}
-
-variable "private_subnet_cidrs" {
-  type        = list(string)
-  description = "A list of CIDRs for the private subnets. Needs to be the same amount as subnets in the Availability Zone you are deploying into (probably 3)"
-  default     = []
-}
-
-variable "private_subnet_size" {
-  type        = number
-  description = "The size of the private subnet (default: 1022 usable addresses)"
-  default     = 6
-}
-
-variable "private_subnet_offset" {
-  type        = number
-  description = "The amount of IP space between the public and the private subnet"
-  default     = 32
-}
-
-variable "public_subnet_prefix" {
-  type        = string
-  description = "The prefix to attach to the name of the public subnets"
-  default     = ""
-}
-
-variable "private_subnet_prefix" {
-  type        = string
-  description = "The prefix to attach to the name of the private subnets"
-  default     = ""
-}
-
-locals {
-  # We are using locals for this because there already is a fair amount of function calling inside the actual resources
-  public_subnet_prefix  = length(var.public_subnet_prefix) > 0 ? var.public_subnet_prefix : "${var.vpc_name}_public_subnet"
-  private_subnet_prefix = length(var.private_subnet_prefix) > 0 ? var.private_subnet_prefix : "${var.vpc_name}_private_subnet"
-}
-
-data "aws_availability_zones" "available" {}
diff --git a/infrastructure/modules/subnets/versions.tf b/infrastructure/modules/subnets/versions.tf
deleted file mode 100644
index f3355dbf..00000000
--- a/infrastructure/modules/subnets/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 1.5"
-}
diff --git a/infrastructure/modules/ui/lambda.tf b/infrastructure/modules/ui/lambda.tf
index 9dac1505..f3ed5ee0 100644
--- a/infrastructure/modules/ui/lambda.tf
+++ b/infrastructure/modules/ui/lambda.tf
@@ -29,10 +29,15 @@ data "aws_iam_policy_document" "this" {
   }
 }
 
-resource "aws_iam_role_policy" "github_runner_lambda" {
-  name   = "${var.resource-name-prefix}-cloudfront-router-policy"
-  role   = aws_iam_role.this.name
-  policy = data.aws_iam_policy_document.this.json
+resource "aws_iam_policy" "cloudfront_router_policy" {
+  name        = "${var.resource-name-prefix}-cloudfront-router-policy"
+  description = "Managed policy for CloudFront Lambda@Edge router logging"
+  policy      = data.aws_iam_policy_document.this.json
+}
+
+resource "aws_iam_role_policy_attachment" "cloudfront_router_policy_attachment" {
+  role       = aws_iam_role.this.name
+  policy_arn = aws_iam_policy.cloudfront_router_policy.arn
 }
 
 resource "aws_lambda_function" "this" {