diff --git a/Jenkinsfile b/Jenkinsfile
index 4837840..59b02d4 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -7,7 +7,7 @@ pipeline {
         stage('Terraform fmt') {
             agent {
                 docker {
-                    image 'hashicorp/terraform:light'
+                    image 'hashicorp/terraform:0.12.6'
                     args '-w $WORKSPACE --entrypoint=""'
                 }
             }
@@ -25,7 +25,7 @@ pipeline {
         stage('Terraform validation') {
             agent {
                 docker {
-                    image 'hashicorp/terraform:0.12.1'
+                    image 'hashicorp/terraform:0.12.6'
                     args '-w $WORKSPACE --entrypoint=""'
                 }
             }
diff --git a/ami/base.json b/ami/base.json
index 375a4a2..fd7e212 100644
--- a/ami/base.json
+++ b/ami/base.json
@@ -20,6 +20,14 @@
                 ],
                 "most_recent": true
             },
+            "launch_block_device_mappings": [
+                {
+                  "device_name": "/dev/xvda",
+                  "volume_size": 20,
+                  "volume_type": "gp2",
+                  "delete_on_termination": true
+                }
+            ],
             "instance_type": "{{user `instance_type`}}",
             "ssh_username": "{{user `ssh_username`}}",
             "ami_name": "{{user `ami_name`}}-{{isotime \"2006-01-02T03-04-05\"}}",
diff --git a/ami/files/teleport/teleport-secrets b/ami/files/teleport/teleport-secrets
index 3864a3d..0921105 100755
--- a/ami/files/teleport/teleport-secrets
+++ b/ami/files/teleport/teleport-secrets
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+cp /etc/teleport.yaml.tmpl /etc/teleport.yaml
+
 # Setup teleport auth server config file
 INSTANCE_ID=$(curl -sSf http://169.254.169.254/latest/meta-data/instance-id)
 PRIVATE_IP=$(curl -sSf http://169.254.169.254/latest/meta-data/local-ipv4)
@@ -7,7 +9,7 @@ REGION=$(curl -sSf http://169.254.169.254/latest/meta-data/placement/availabilit
 ENVIRONMENT=$(aws ec2 describe-tags --region "$REGION" --filters "Name=resource-id,Values=${INSTANCE_ID}" | jq '.Tags | .[] | select(.Key | contains("env")) | .Value ' | cut -f 2 -d '"')
 SECRET_ID="${ENVIRONMENT}/teleport/cluster_token"
 
-NODENAME=$(aws ec2 describe-tags --region "$REGION" --filters "Name=resource-id,Values=${INSTANCE_ID}" | jq '.Tags | .[] | select(.Key | contains("Name")) | .Value ' | cut -f 2 -d '"')
+NODENAME=$(aws ec2 describe-tags --region "$REGION" --filters "Name=resource-id,Values=${INSTANCE_ID}" | jq '.Tags | .[] | select(.Key == "Name") | .Value ' | cut -f 2 -d '"')
 CLUSTER_TOKEN=$(aws secretsmanager get-secret-value --region "$REGION" --secret-id ${SECRET_ID} | jq ".SecretString" | cut -f 2 -d '"')
 
 sed -i "s/{{ private_ip }}/${PRIVATE_IP}/g" /etc/teleport.yaml
diff --git a/ami/files/teleport/teleport.yaml b/ami/files/teleport/teleport.yaml.tmpl
similarity index 100%
rename from ami/files/teleport/teleport.yaml
rename to ami/files/teleport/teleport.yaml.tmpl
diff --git a/ami/provision.sh b/ami/provision.sh
index 2d03cb6..f593836 100644
--- a/ami/provision.sh
+++ b/ami/provision.sh
@@ -27,7 +27,7 @@ sudo useradd -d "/var/lib/teleport/" -g "adm" -k "/dev/null" -m -r -s "/sbin/nol
 sudo passwd -l teleport
 
 # Download info on the teleport release we are targeting
-TELEPORT_VERSION="v4.0.1"
+TELEPORT_VERSION="v4.0.2"
 TELEPORT_INFO=$(curl -sSf https://dashboard.gravitational.com/webapi/releases-oss?product=teleport | jq ".items | map(select(.version == \"${TELEPORT_VERSION}\")) | .[].downloads | map(select(.name == \"teleport-${TELEPORT_VERSION}-linux-amd64-bin.tar.gz\")) | .[]")
 
 # Install teleport binaries
@@ -47,14 +47,17 @@ sudo chmod 0755 /usr/local/bin/teleport-secrets
 
 echo "--- Configure teleport"
 # Install teleport configuration
-sudo cp /tmp/files/teleport/teleport.yaml /etc
-sudo chmod 0644 /etc/teleport.yaml
+sudo cp /tmp/files/teleport/teleport.yaml.tmpl /etc
+sudo chmod 0644 /etc/teleport.yaml.tmpl
 
 # Install teleport systemd units
 sudo cp /tmp/files/teleport/*.service /etc/systemd/system
 sudo chmod 0644 /etc/systemd/system/teleport*
 
 echo "--- Turn on systemd services"
-sudo systemctl enable --now docker
-sudo systemctl enable --now yum-cron
-sudo systemctl enable --now teleport
+sudo systemctl enable docker
+sudo systemctl enable yum-cron
+sudo systemctl enable teleport
+
+echo "--- Turn off systemd services"
+sudo systemctl disable --now amazon-ssm-agent
\ No newline at end of file
diff --git a/app_base/Readme.md b/app_base/Readme.md
deleted file mode 100644
index ceede3a..0000000
--- a/app_base/Readme.md
+++ /dev/null
@@ -1,16 +0,0 @@
-
-### Key feature comparison to previous Ad Hoc examples (default values used)
-
-| Feature            | Foundation | Soapbox Platform | ACO API | QPP Foundational | USCIS RFDS RFI |
-|--------------------|------------|------------------|---------|------------------|----------------|
-| Plain instances    | X          | -                | -       | -                | -              |
-| Auto-scaling group | X          | X                | -       | X                | X              |
-| ECS/Fargate Cluster| X          | -                | X       | -                | X              |
-| Domain Name        | X          | -                | -       | -                | X              |
-| TLS                | X          | X                | X       | X                | X              |
-
-Key:
- - X = Present
- - - = Absent
- - * = Optional
-
diff --git a/app_base/data.tf b/app_base/data.tf
deleted file mode 100644
index f9eebba..0000000
--- a/app_base/data.tf
+++ /dev/null
@@ -1,45 +0,0 @@
-#######
-### Lookup resources already created by foundation
-#######
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_subnet" "public_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "public-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_route53_zone" "external" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_route53_zone" "internal" {
-  name         = "${var.env}.local"
-  private_zone = true
-}
-
-data "aws_acm_certificate" "wildcard" {
-  domain      = var.domain_name
-  most_recent = true
-}
-
diff --git a/app_base/main.tf b/app_base/main.tf
deleted file mode 100644
index 64375d2..0000000
--- a/app_base/main.tf
+++ /dev/null
@@ -1,154 +0,0 @@
-#######
-### Domain names
-#######
-
-resource "aws_route53_record" "external_cname" {
-  zone_id = data.aws_route53_zone.external.id
-  name    = var.application_name
-  type    = "CNAME"
-  ttl     = 30
-
-  records = [aws_alb.application_alb.dns_name]
-}
-
-resource "aws_route53_record" "internal_cname" {
-  zone_id = data.aws_route53_zone.internal.id
-  name    = var.application_name
-  type    = "CNAME"
-  ttl     = 30
-
-  records = [aws_alb.application_alb.dns_name]
-}
-
-#######
-### Load balancer
-#######
-
-resource "aws_alb" "application_alb" {
-  # max 6 characters for name prefix
-  name_prefix     = "${format("%.5s", var.application_name)}-"
-  internal        = false
-  security_groups = [aws_security_group.application_alb_sg.id]
-  subnets         = data.aws_subnet.public_subnet.*.id
-
-  ip_address_type = "ipv4"
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = var.application_name
-    name      = "alb-${var.application_name}"
-  }
-}
-
-# ALB target group and listeners
-resource "aws_alb_target_group" "application_target_group" {
-  # max 6 characters for name prefix
-  name_prefix = "${format("%.5s", var.application_name)}-"
-  port        = var.application_port
-  protocol    = "HTTP"
-  vpc_id      = data.aws_vpc.vpc.id
-  target_type = "ip" # Must use IP to support fargate
-
-  health_check {
-    interval            = 60
-    path                = var.health_check_path
-    port                = var.application_port
-    healthy_threshold   = 2
-    unhealthy_threshold = 2
-  }
-
-  depends_on = [aws_alb.application_alb]
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = var.application_name
-    name      = "alb-tg-${var.application_name}:${var.application_port}"
-  }
-}
-
-resource "aws_alb_listener" "application_alb_https" {
-  load_balancer_arn = aws_alb.application_alb.arn
-  port              = var.loadbalancer_port
-  protocol          = "HTTPS"
-  ssl_policy        = "ELBSecurityPolicy-2016-08"
-  certificate_arn   = data.aws_acm_certificate.wildcard.arn
-
-  default_action {
-    target_group_arn = aws_alb_target_group.application_target_group.arn
-    type             = "forward"
-  }
-}
-
-# Security Group: world -> alb
-resource "aws_security_group" "application_alb_sg" {
-  name_prefix = "${var.application_name}-alb-"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = var.application_name
-    name      = "world->alb-sg-${var.application_name}"
-  }
-}
-
-// Allow inbound only to our listening port
-resource "aws_security_group_rule" "lb_ingress" {
-  type        = "ingress"
-  from_port   = var.loadbalancer_port
-  to_port     = var.loadbalancer_port
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.application_alb_sg.id
-}
-
-// Allow all outbound by default
-resource "aws_security_group_rule" "lb_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.application_alb_sg.id
-}
-
-#######
-### Security group for application
-#######
-
-resource "aws_security_group" "app_sg" {
-  name_prefix = "${var.application_name}-app-"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  tags = {
-    app = var.application_name
-    env = var.env
-  }
-}
-
-// Allow inbound only to our application port
-resource "aws_security_group_rule" "app_ingress" {
-  type                     = "ingress"
-  from_port                = var.application_port
-  to_port                  = var.application_port
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.application_alb_sg.id
-
-  security_group_id = aws_security_group.app_sg.id
-}
-
-// Allow all outbound, e.g. third-pary API endpoints, by default
-resource "aws_security_group_rule" "app_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.app_sg.id
-}
-
diff --git a/app_base/outputs.tf b/app_base/outputs.tf
deleted file mode 100644
index ede5779..0000000
--- a/app_base/outputs.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-output "app_sg_id" {
-  value = aws_security_group.app_sg.id
-}
-
-output "lb_tg_arn" {
-  value = aws_alb_target_group.application_target_group.arn
-}
-
diff --git a/app_base/variables.tf b/app_base/variables.tf
deleted file mode 100644
index fcc6985..0000000
--- a/app_base/variables.tf
+++ /dev/null
@@ -1,27 +0,0 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
-}
-
-variable "application_name" {
-  description = "name of the application to be hosted. must be unique in the environment."
-}
-
-variable "health_check_path" {
-  description = "path used by load balancer to health check application. should return 200."
-  default     = "/"
-}
-
-variable "application_port" {
-  description = "port on which the application will be listening."
-  default     = "80"
-}
-
-variable "loadbalancer_port" {
-  description = "port on which the load balancer will be listening. it will terminate TLS on this port."
-  default     = "443"
-}
-
diff --git a/app_base/versions.tf b/app_base/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/app_base/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/autoscaling/ingress.tf b/autoscaling/ingress.tf
new file mode 100644
index 0000000..ac0ae3c
--- /dev/null
+++ b/autoscaling/ingress.tf
@@ -0,0 +1,69 @@
+#####
+# Target group in case it needs to be attached to an LB
+#####
+locals {
+  ingress_enabled = var.public ? 1 : 0
+}
+
+resource "aws_route53_record" "external" {
+  count   = local.ingress_enabled
+  zone_id = var.base.external.id
+  name    = var.application_name
+  type    = "CNAME"
+  ttl     = 30
+
+  records = ["ingress-${var.base.env}.${var.base.domain_name}"]
+}
+
+resource "aws_alb_target_group" "application" {
+  count = local.ingress_enabled
+  # max 6 characters for name prefix
+  name_prefix = "app-lb"
+  port        = var.application_ports[0]
+  protocol    = "HTTP"
+  vpc_id      = var.base.vpc.id
+  target_type = "instance" # Must use instance for ASGs
+
+  health_check {
+    interval            = 60
+    path                = var.health_check_path
+    port                = var.application_ports[0]
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    matcher             = "200-308"
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = var.application_name
+    name      = "app-lb-${var.application_name}-${var.application_ports[0]}"
+  }
+}
+
+resource "aws_alb_listener_rule" "applications" {
+  count        = local.ingress_enabled
+  listener_arn = var.base.ingress.listener.arn
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_alb_target_group.application[0].arn
+  }
+
+  condition {
+    field  = "host-header"
+    values = ["${var.application_name}.${var.base.domain_name}"]
+  }
+}
+
+# Allow ingress to talk to our primary port
+resource "aws_security_group_rule" "ingress" {
+  count                    = local.ingress_enabled
+  type                     = "ingress"
+  from_port                = var.application_ports[0]
+  to_port                  = var.application_ports[0]
+  protocol                 = "tcp"
+  source_security_group_id = var.base.ingress.security_group.id
+
+  security_group_id = aws_security_group.app.id
+}
diff --git a/autoscaling/main.tf b/autoscaling/main.tf
new file mode 100644
index 0000000..659c39c
--- /dev/null
+++ b/autoscaling/main.tf
@@ -0,0 +1,169 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
+locals {
+  ami_id = length(var.ami_id) == 0 ? var.base.ami.id : var.ami_id
+}
+
+#####
+# Autoscaling configuration
+#####
+
+resource "aws_autoscaling_group" "application" {
+  name_prefix         = "${aws_launch_template.application.id}-${aws_launch_template.application.latest_version}"
+  vpc_zone_identifier = var.base.vpc.application[*].id
+
+  max_size         = var.max_count
+  min_size         = 1
+  desired_capacity = var.desired_count
+  force_delete     = false
+
+  target_group_arns         = coalescelist(var.target_group_arns, aws_alb_target_group.application[*].arn)
+  health_check_grace_period = 300
+  health_check_type         = "ELB"
+  wait_for_elb_capacity     = var.desired_count
+  wait_for_capacity_timeout = "600s"
+
+  lifecycle {
+    ignore_changes        = [desired_capacity]
+    create_before_destroy = true
+  }
+
+  launch_template {
+    id      = aws_launch_template.application.id
+    version = "$Latest"
+  }
+
+  tag {
+    key                 = "Name"
+    value               = "${var.base.env}-${var.application_name}"
+    propagate_at_launch = true
+  }
+  tag {
+    key                 = "terraform"
+    value               = "true"
+    propagate_at_launch = true
+  }
+  tag {
+    key                 = "env"
+    value               = var.base.env
+    propagate_at_launch = true
+  }
+  tag {
+    key                 = "app"
+    value               = var.application_name
+    propagate_at_launch = true
+  }
+}
+
+resource "aws_autoscaling_policy" "cpu" {
+  name                   = "${var.base.env}-${var.application_name}-cpu-policy"
+  autoscaling_group_name = aws_autoscaling_group.application.name
+  policy_type            = "TargetTrackingScaling"
+
+  target_tracking_configuration {
+    predefined_metric_specification {
+      predefined_metric_type = "ASGAverageCPUUtilization"
+    }
+
+    target_value = 60
+  }
+}
+
+resource "aws_launch_template" "application" {
+  name_prefix                          = "${var.base.env}-${var.application_name}-"
+  disable_api_termination              = false
+  image_id                             = local.ami_id
+  instance_initiated_shutdown_behavior = "terminate"
+  instance_type                        = var.instance_size
+  ebs_optimized                        = true
+
+  key_name = var.base.ssh_key
+  vpc_security_group_ids = [
+    var.base.security_groups["teleport_nodes"].id,
+    var.base.security_groups["jumpbox_nodes"].id,
+    aws_security_group.app.id
+  ]
+
+  iam_instance_profile {
+    name = aws_iam_instance_profile.iam.name
+  }
+
+  user_data = var.user_data != "" ? base64encode(var.user_data) : null
+
+  credit_specification {
+    cpu_credits = "unlimited"
+  }
+
+  monitoring {
+    enabled = true
+  }
+
+  tags = {
+    Name      = "${var.base.env}-${var.application_name}-launch-template"
+    terraform = "true"
+    env       = var.base.env
+    app       = var.application_name
+  }
+}
+
+#######
+# Security group for application
+#######
+
+resource "aws_security_group" "app" {
+  name_prefix = "${var.application_name}-app-"
+  vpc_id      = var.base.vpc.id
+
+  tags = {
+    app       = var.application_name
+    terraform = "true"
+    env       = var.base.env
+  }
+}
+
+# Allow all outbound, e.g. third-pary API endpoints, by default
+resource "aws_security_group_rule" "egress" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.app.id
+}
+
+
+#####
+# Base IAM instance profile
+#####
+resource "aws_iam_instance_profile" "iam" {
+  name = "${var.base.env}-asg-${var.application_name}"
+  role = aws_iam_role.iam.name
+}
+
+# Auth instance profile and roles
+resource "aws_iam_role" "iam" {
+  name = "${var.base.env}-asg-${var.application_name}"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {"Service": "ec2.amazonaws.com"},
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+EOF
+
+}
+
+# Give it base teleport permissions
+resource "aws_iam_role_policy_attachment" "iam_teleport" {
+  role       = aws_iam_role.iam.name
+  policy_arn = "arn:aws:iam::${var.base.account.account_id}:policy/${var.base.env}/teleport/${var.base.env}-instance-teleport-secrets"
+}
diff --git a/autoscaling/outputs.tf b/autoscaling/outputs.tf
new file mode 100644
index 0000000..634fcf1
--- /dev/null
+++ b/autoscaling/outputs.tf
@@ -0,0 +1,14 @@
+output "name" {
+  description = "name of the application this hosts"
+  value       = var.application_name
+}
+
+output "security_group" {
+  description = "object with the application-specific security group. defaults to unrestricted egress"
+  value       = aws_security_group.app
+}
+
+output "instance_iam_role" {
+  description = "IAM role name for attaching additional policies to the instance with aws_iam_role_policy_attachment"
+  value       = aws_iam_role.iam
+}
diff --git a/autoscaling/variables.tf b/autoscaling/variables.tf
new file mode 100644
index 0000000..d6dcfab
--- /dev/null
+++ b/autoscaling/variables.tf
@@ -0,0 +1,62 @@
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
+}
+
+variable "application_name" {
+  type        = string
+  description = "name of the application to be hosted. will be used as the subdomain if exposed via ingress"
+}
+
+variable "ami_id" {
+  type        = string
+  description = "OPTIONAL: ID of the AMI to use for the autoscaling group. defaults to base ami"
+  default     = ""
+}
+
+variable "instance_size" {
+  type        = string
+  description = "OPTIONAL: ec2 instance type to be used for hosting the app"
+  default     = "t3.medium"
+}
+
+variable "desired_count" {
+  type        = number
+  description = "OPTIONAL: target number of copies to run before autoscaling kicks in."
+  default     = 2
+}
+
+variable "max_count" {
+  type        = number
+  description = "OPTIONAL: maximum number of copies that autoscaling will spin up"
+  default     = 16
+}
+
+variable "public" {
+  type        = bool
+  description = "OPTIONAL: whether or not to expose the application publicly"
+  default     = true
+}
+
+variable "target_group_arns" {
+  type        = list(string)
+  description = "OPTIONAL: list of ARNs for target groups for the autoscaling group to attach to"
+  default     = []
+}
+
+variable "application_ports" {
+  type        = list(number)
+  description = "OPTIONAL: ports on which the application will be listening. the first listed port will be used for health checks"
+  default     = [80]
+}
+
+variable "health_check_path" {
+  type        = string
+  description = "OPTIONAL: path used by load balancer to health check on the first application port. should return 200."
+  default     = "/"
+}
+
+variable "user_data" {
+  type        = string
+  description = "OPTIONAL: user data script to run on initialization"
+  default     = ""
+}
diff --git a/static_site/Readme.md b/cdn_site/Readme.md
similarity index 100%
rename from static_site/Readme.md
rename to cdn_site/Readme.md
diff --git a/cdn_site/main.tf b/cdn_site/main.tf
new file mode 100644
index 0000000..68aee03
--- /dev/null
+++ b/cdn_site/main.tf
@@ -0,0 +1,169 @@
+####
+# Main infrastructure to host a static website
+####
+
+terraform {
+  required_version = ">= 0.12"
+}
+
+locals {
+  site_url    = "${var.subdomain}.${var.base.domain_name}"
+  preview_url = "preview.${local.site_url}"
+
+  # If www then we need CloudFront to serve the apex domain as well
+  aliases = concat([local.site_url], var.aliases, var.subdomain == "www" ? [var.base.domain_name] : [])
+}
+
+# Setup DNS records for the static site
+
+resource "aws_route53_record" "subdomain" {
+  zone_id = var.base.external.zone_id
+  name    = var.subdomain
+  type    = "CNAME"
+  ttl     = "300"
+
+  records = [aws_cloudfront_distribution.s3_distribution.domain_name]
+}
+
+# # If we're setting www (e.g., www.example.com) then also direct the apex domain (example.com)
+resource "aws_route53_record" "apex_domain" {
+  count   = var.subdomain == "www" ? 1 : 0
+  zone_id = var.base.external.zone_id
+  name    = ""
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.s3_distribution.domain_name
+    zone_id                = aws_cloudfront_distribution.s3_distribution.hosted_zone_id
+    evaluate_target_health = false
+  }
+}
+
+# Create bucket to host the content
+
+resource "aws_s3_bucket" "content" {
+  bucket = local.site_url
+  acl    = "public-read"
+  policy = templatefile("${path.module}/policy.tmpl", { bucket = local.site_url })
+
+  # Serve index.html on errors to support client side routing, e.g. React Router
+  website {
+    index_document = "index.html"
+    error_document = "index.html"
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    name      = local.site_url
+  }
+}
+
+# Create CDN to serve the content and terminate TLS
+
+resource "aws_cloudfront_distribution" "s3_distribution" {
+  origin {
+    domain_name = aws_s3_bucket.content.bucket_regional_domain_name
+    origin_id   = "${var.subdomain}-${var.base.domain_name}"
+  }
+
+  enabled             = true
+  default_root_object = "index.html"
+
+  aliases = local.aliases
+
+  # Serve index.html on errors to support client side routing, e.g. React Router
+  custom_error_response {
+    error_code         = 403
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  custom_error_response {
+    error_code         = 404
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  default_cache_behavior {
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "${var.subdomain}-${var.base.domain_name}"
+
+    # Use gzip compression
+    compress = true
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "none"
+      }
+    }
+
+    viewer_protocol_policy = "redirect-to-https"
+    min_ttl                = 0
+    default_ttl            = 60
+    max_ttl                = 60
+  }
+
+  viewer_certificate {
+    acm_certificate_arn = var.base.wildcard.arn
+    ssl_support_method  = "sni-only"
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    name      = "cdn-${local.site_url}"
+  }
+}
+
+####
+# Create preview site to hold builds of PRs
+####
+
+resource "aws_route53_record" "preview" {
+  zone_id = var.base.external.zone_id
+  name    = "preview.${var.subdomain}"
+  type    = "CNAME"
+  ttl     = "300"
+
+  records = [aws_s3_bucket.preview.website_domain]
+}
+
+# Create bucket to host the content
+
+resource "aws_s3_bucket" "preview" {
+  bucket = local.preview_url
+  acl    = "public-read"
+  policy = templatefile("${path.module}/policy.tmpl", { bucket = local.preview_url })
+
+  # Serve index.html on errors to support client side routing, e.g. React Router
+  website {
+    index_document = "index.html"
+    error_document = "index.html"
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    name      = local.preview_url
+  }
+
+  lifecycle_rule {
+    id      = "expire previews"
+    enabled = true
+
+    expiration {
+      days = 45
+    }
+  }
+}
+
diff --git a/static_site/outputs.tf b/cdn_site/outputs.tf
similarity index 55%
rename from static_site/outputs.tf
rename to cdn_site/outputs.tf
index 58064a4..b8c161f 100644
--- a/static_site/outputs.tf
+++ b/cdn_site/outputs.tf
@@ -3,10 +3,10 @@ output "cdn_url" {
 }
 
 output "bucket_url" {
-  value = aws_s3_bucket.site_content_bucket.bucket_domain_name
+  value = aws_s3_bucket.content.bucket_domain_name
 }
 
 output "content_bucket" {
-  value = aws_s3_bucket.site_content_bucket.bucket
+  value = aws_s3_bucket.content.bucket
 }
 
diff --git a/cdn_site/policy.tmpl b/cdn_site/policy.tmpl
new file mode 100644
index 0000000..38ba02c
--- /dev/null
+++ b/cdn_site/policy.tmpl
@@ -0,0 +1,17 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "Stmt1516660482311",
+      "Effect": "Allow",
+      "Principal": "*",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::${bucket}/*"
+      ]
+    }
+  ]
+}
+
diff --git a/cdn_site/variables.tf b/cdn_site/variables.tf
new file mode 100644
index 0000000..51e88e0
--- /dev/null
+++ b/cdn_site/variables.tf
@@ -0,0 +1,15 @@
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
+}
+
+variable "subdomain" {
+  type        = string
+  default     = "www"
+  description = "OPTIONAL: the subdomain for the site. Defaults to www"
+}
+
+variable "aliases" {
+  type        = list(string)
+  description = "OPTIONAL: a list of domain aliases that CloudFront CDN should also serve"
+  default     = []
+}
diff --git a/command_console/README.md b/command_console/README.md
new file mode 100644
index 0000000..f56dfdb
--- /dev/null
+++ b/command_console/README.md
@@ -0,0 +1,3 @@
+### Command Console
+
+Runs a copy of a docker image loaded into a fargate cluster on a "regular" instance that engineers can SSH into in order to run task commands (e.g., rake), tail logs locally, interact with the database, etc.
diff --git a/command_console/data.tf b/command_console/data.tf
deleted file mode 100644
index 693e58e..0000000
--- a/command_console/data.tf
+++ /dev/null
@@ -1,53 +0,0 @@
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_caller_identity" "current" {
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_security_group" "ssh_proxies" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "teleport"
-    Name = "teleport-proxies"
-  }
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
-}
-
diff --git a/command_console/main.tf b/command_console/main.tf
index a96f2a9..aada66d 100644
--- a/command_console/main.tf
+++ b/command_console/main.tf
@@ -1,114 +1,34 @@
-resource "aws_instance" "console" {
-  ami           = data.aws_ami.base.id
-  instance_type = var.instance_size
-
-  iam_instance_profile = aws_iam_instance_profile.iam.name
-  user_data            = var.user_data
-  key_name             = var.key_pair
-
-  associate_public_ip_address = false
-
-  #distribute instances across AZs
-  subnet_id              = element(data.aws_subnet.application_subnet.*.id, count.index)
-  vpc_security_group_ids = [aws_security_group.sg.id]
-
-  lifecycle {
-    ignore_changes = [ami]
-  }
-
-  credit_specification {
-    cpu_credits = "unlimited"
-  }
-
-  tags = {
-    Name = "command-console-${var.env}"
-    app  = "command-console"
-    env  = var.env
-  }
+terraform {
+  required_version = ">= 0.12"
 }
 
-#####
-# Security group
-#####
-resource "aws_security_group" "sg" {
-  name_prefix = "console-"
-  vpc_id      = data.aws_vpc.vpc.id
+module "console" {
+  source = "../instance"
 
-  tags = {
-    app = "command-console"
-    env = var.env
-  }
-}
-
-# Allow all outbound, e.g. third-pary API endpoints, by default
-resource "aws_security_group_rule" "egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
+  base             = var.base
+  application_name = "${var.fargate_cluster.name}-command-console"
+  instance_size    = "t3.medium"
 
-  security_group_id = aws_security_group.sg.id
+  user_data = templatefile("${path.module}/user_data.tmpl", {
+    docker_image          = var.fargate_cluster.docker_image
+    environment_variables = var.environment_variables
+    command               = var.default_command
+  })
 }
 
-# Add rule to allow SSH proxies to connect
-resource "aws_security_group_rule" "proxy_ssh" {
-  type                     = "ingress"
-  from_port                = 3022
-  to_port                  = 3022
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.ssh_proxies.id
-
-  security_group_id = aws_security_group.sg.id
+resource "aws_iam_role_policy_attachment" "console_ecr" {
+  role       = module.console.instance_iam_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
 }
 
-resource "aws_security_group_rule" "jumpbox" {
+resource "aws_security_group_rule" "database" {
+  count                    = length(var.database) > 0 ? 1 : 0
   type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
+  from_port                = "5432"
+  to_port                  = "5432"
   protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.sg.id
-}
-
-#####
-# Base IAM instance profile
-#####
-resource "aws_iam_instance_profile" "iam" {
-  name = "${var.env}-command-console"
-  role = aws_iam_role.iam.name
-}
-
-# Auth instance profile and roles
-resource "aws_iam_role" "iam" {
-  name = "${var.env}-command-console"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {"Service": "ec2.amazonaws.com"},
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-
-}
-
-# Give it base teleport permissions
-resource "aws_iam_role_policy_attachment" "iam_teleport" {
-  role = aws_iam_role.iam.name
-  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.env}/teleport/${var.env}-instance-teleport-secrets"
-}
+  source_security_group_id = "${module.console.security_group.id}"
 
-resource "aws_kms_grant" "main" {
-  name = "command-console-${var.env}-main"
-  key_id = data.aws_kms_alias.main.target_key_arn
-  grantee_principal = aws_iam_role.iam.arn
-  operations = ["Decrypt"]
+  security_group_id = "${var.database.security_group.id}"
 }
 
diff --git a/command_console/outputs.tf b/command_console/outputs.tf
index b6fc223..c8e3e10 100644
--- a/command_console/outputs.tf
+++ b/command_console/outputs.tf
@@ -1,9 +1,5 @@
-output "sg_id" {
-  value = aws_security_group.sg.id
-}
-
 output "instance_iam_role" {
   description = "IAM role name for attaching additional policies to the instance with aws_iam_role_policy_attachment"
-  value       = aws_iam_role.iam.name
+  value       = module.console.instance_iam_role
 }
 
diff --git a/command_console/user_data.tmpl b/command_console/user_data.tmpl
new file mode 100644
index 0000000..6f64412
--- /dev/null
+++ b/command_console/user_data.tmpl
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+cat << 'DONE' > /home/ec2-user/console
+#!/usr/bin/env bash
+set -euo pipefail
+
+command="${command}"
+if [ $# -gt 0 ]; then
+    echo "Running alternate command: $@"
+    command="$@"
+fi
+
+eval $(aws ecr get-login --region=us-east-1 --no-include-email)
+
+docker pull ${docker_image}
+
+docker run -it --rm  \
+  --entrypoint "" \
+%{ for name, value in environment_variables ~}
+  -e ${name}="${value}"
+%{ endfor ~}
+  ${docker_image} \
+  $command
+DONE
+
+chown ec2-user:ec2-user /home/ec2-user/console
+chmod +x /home/ec2-user/console
diff --git a/command_console/variables.tf b/command_console/variables.tf
index fd90b93..c8c989a 100644
--- a/command_console/variables.tf
+++ b/command_console/variables.tf
@@ -1,19 +1,24 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
 }
 
-variable "instance_size" {
-  description = "OPTIONAL: ec2 instance type to be used for hosting the app"
-  default     = "t3.micro"
+variable "fargate_cluster" {
+  description = "object representing the fargate cluster that we want to create a command console version of"
 }
 
-variable "key_pair" {
-  description = "OPTIONAL: name of key pair to use with optional SSH jumpbox"
-  default     = "infrastructure"
+variable "database" {
+  description = "OPTIONAL: object representing the database that the console needs to connect to"
+  default     = {}
 }
 
-variable "user_data" {
-  description = "OPTIONAL: user data script to run on initialization"
-  default     = ""
+variable "environment_variables" {
+  type        = map
+  description = "OPTIONAL: map of environment variables to set by default when running the docker image"
+  default     = {}
 }
 
+variable "default_command" {
+  type        = string
+  description = "OPTIONAL: Default command to execute when running inside the docker container. Defaults to running a shell"
+  default     = "/bin/sh"
+}
diff --git a/command_console/versions.tf b/command_console/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/command_console/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/data.tf b/data.tf
new file mode 100644
index 0000000..5a7a2a4
--- /dev/null
+++ b/data.tf
@@ -0,0 +1,21 @@
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+data "aws_route53_zone" "external" {
+  name         = var.domain_name
+  private_zone = false
+}
+
+data "aws_ami" "base" {
+  most_recent = true
+  owners      = ["self"]
+
+  filter {
+    name   = "name"
+    values = ["adhoc_base*"]
+  }
+}
+
+data "aws_secretsmanager_secret" "cluster_token" {
+  name = "${var.env}/teleport/cluster_token"
+}
diff --git a/database/Readme.md b/database/Readme.md
index 7ebb291..f2a2e9a 100644
--- a/database/Readme.md
+++ b/database/Readme.md
@@ -1,5 +1,5 @@
 
-### Key feature comparision to prior Ad Hoc work
+### Key feature comparison to prior Ad Hoc work
 
 
 | Feature                          | Foundation | Soapbox Platform | ACO API | QPP Foundational | USCIS RFDS RFI |
@@ -9,4 +9,4 @@
 | Password as Variable             | X          | -                | -       | X                | X              |
 | Ignore Lifecycle Events          | X          | -                | X       | -                | X              |
 | Store Credentials in AWS Service | -          | -                | X       | -                | -              |
-| Encrypted Storage                | X          | -                | X       | -                | -              |
\ No newline at end of file
+| Encrypted Storage                | X          | -                | X       | -                | -              |
diff --git a/database/data.tf b/database/data.tf
deleted file mode 100644
index 3aa9845..0000000
--- a/database/data.tf
+++ /dev/null
@@ -1,39 +0,0 @@
-####
-# Pull in external data for use here
-####
-
-data "aws_route53_zone" "internal" {
-  name         = "${var.env}.local"
-  private_zone = true
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "data_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "data-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_kms_key" "main" {
-  key_id = "alias/${var.env}-main"
-}
-
diff --git a/database/main.tf b/database/main.tf
index c8c95e8..00ce136 100644
--- a/database/main.tf
+++ b/database/main.tf
@@ -1,37 +1,40 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
 ####
 # Setup database specific networking
 ####
 
 resource "aws_db_subnet_group" "db_subnet_group" {
-  name       = "${var.env}-${var.application_name}-rds-subnet-group"
-  subnet_ids = data.aws_subnet.data_subnet.*.id
+  name       = "${var.base.env}-${var.application.name}-rds-subnet-group"
+  subnet_ids = var.base.vpc.data[*].id
 }
 
-resource "aws_security_group" "db_sg" {
-  name        = "${var.env}-${var.application_name}-db-sg"
+resource "aws_security_group" "database" {
+  name        = "${var.base.env}-${var.application.name}-db-sg"
   description = "SG for database servers"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
 }
 
-resource "aws_security_group_rule" "app_ingress" {
+resource "aws_security_group_rule" "ingress" {
   type                     = "ingress"
   from_port                = 5432
   to_port                  = 5432
   protocol                 = "tcp"
-  source_security_group_id = var.app_sg
+  source_security_group_id = var.application.security_group.id
 
-  security_group_id = aws_security_group.db_sg.id
+  security_group_id = aws_security_group.database.id
 }
 
-# TODO(bob) confirm this can be locked to egress 5432 only
 resource "aws_security_group_rule" "egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
+  type                     = "egress"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  source_security_group_id = var.application.security_group.id
 
-  security_group_id = aws_security_group.db_sg.id
+  security_group_id = aws_security_group.database.id
 }
 
 ####
@@ -39,26 +42,26 @@ resource "aws_security_group_rule" "egress" {
 ####
 
 resource "aws_db_instance" "primary" {
-  identifier_prefix = "${var.env}-${var.application_name}-"
+  identifier_prefix = "${var.base.env}-${var.application.name}-"
 
   username = var.user
   password = var.password
 
   db_subnet_group_name   = aws_db_subnet_group.db_subnet_group.id
-  vpc_security_group_ids = [aws_security_group.db_sg.id]
+  vpc_security_group_ids = [aws_security_group.database.id]
   publicly_accessible    = false
   multi_az               = true
 
-  instance_class = "db.t2.small"
+  instance_class = var.instance_class
   engine         = "postgres"
   engine_version = "10.5"
   port           = 5432
 
   storage_type        = "gp2"
   skip_final_snapshot = true
-  allocated_storage   = 30
+  allocated_storage   = 120
   storage_encrypted   = true
-  kms_key_id          = data.aws_kms_key.main.arn
+  kms_key_id          = var.base.key.arn
 
   parameter_group_name            = aws_db_parameter_group.postgres.id
   enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
@@ -76,16 +79,16 @@ resource "aws_db_instance" "primary" {
   }
 
   tags = {
-    env       = var.env
-    app       = var.application_name
+    env       = var.base.env
+    app       = var.application.name
     terraform = "true"
-    name      = "${var.env}-db"
+    name      = "${var.base.env}-db"
   }
 }
 
 # Enable query logging
 resource "aws_db_parameter_group" "postgres" {
-  name_prefix = "${var.env}-${var.application_name}-"
+  name_prefix = "${var.base.env}-${var.application.name}-"
   family      = "postgres10"
 
   parameter {
@@ -134,8 +137,8 @@ resource "aws_db_parameter_group" "postgres" {
 ####
 
 resource "aws_route53_record" "rds_cname" {
-  zone_id = data.aws_route53_zone.internal.id
-  name    = "${var.application_name}-db-primary"
+  zone_id = var.base.vpc.internal_dns.zone_id
+  name    = "${var.application.name}-db-primary"
   type    = "CNAME"
   ttl     = 30
 
@@ -146,7 +149,7 @@ resource "aws_route53_record" "rds_cname" {
 # Create an IAM role to allow enhanced monitoring
 ##################################################
 resource "aws_iam_role" "monitoring" {
-  name = "${var.env}-${var.application_name}-rds-monitoring-role"
+  name = "${var.base.env}-${var.application.name}-rds-monitoring-role"
 
   assume_role_policy = <<EOF
 {
@@ -164,7 +167,7 @@ EOF
 }
 
 resource "aws_iam_role_policy_attachment" "monitoring" {
-  role = aws_iam_role.monitoring.name
+  role       = aws_iam_role.monitoring.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
 }
 
diff --git a/database/outputs.tf b/database/outputs.tf
index 864b7aa..56ac324 100644
--- a/database/outputs.tf
+++ b/database/outputs.tf
@@ -3,7 +3,7 @@ output "url" {
   value = aws_route53_record.rds_cname.fqdn
 }
 
-output "security_group_id" {
-  value = aws_security_group.db_sg.id
+output "security_group" {
+  description = "security group for the database"
+  value       = aws_security_group.database
 }
-
diff --git a/database/variables.tf b/database/variables.tf
index 2f47d42..3ba20a9 100644
--- a/database/variables.tf
+++ b/database/variables.tf
@@ -1,20 +1,25 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
+variable "base" {
+  description = "object with the outputs of the base module"
 }
 
-variable "application_name" {
-  description = "the name of the application that will access this database"
-  default     = "demo"
-}
-
-variable "app_sg" {
-  description = "the security group of the application that needs access to the database, probably from the module outputs"
+variable "application" {
+  description = "an object describing the application to allow access to this database"
 }
 
 variable "user" {
-  default = "dbuser"
+  type        = string
+  description = "OPTIONAL: the username for the Postgres user"
+  default     = "dbuser"
 }
 
 variable "password" {
+  type        = string
+  description = "the password for the Postgres user. NOTE: will be stored in Terraform state"
+}
+
+variable "instance_class" {
+  type        = string
+  description = "OPTIONAL: the instance class for the db."
+  default     = "db.t2.small"
 }
 
diff --git a/database/versions.tf b/database/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/database/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/encryptkey/data.tf b/encryptkey/data.tf
index d6fa1a8..9733c57 100644
--- a/encryptkey/data.tf
+++ b/encryptkey/data.tf
@@ -1,3 +1,2 @@
-data "aws_caller_identity" "current" {
-}
+data "aws_caller_identity" "current" {}
 
diff --git a/encryptkey/main.tf b/encryptkey/main.tf
index 2e6c80b..fe7c573 100644
--- a/encryptkey/main.tf
+++ b/encryptkey/main.tf
@@ -1,3 +1,11 @@
+#####
+# A shared encryption key for general use in the environment
+#####
+
+terraform {
+  required_version = ">= 0.12"
+}
+
 resource "aws_kms_key" "main" {
   description             = "Primary key for encrypting things in environment"
   deletion_window_in_days = 10
@@ -80,14 +88,14 @@ POLICY
 
 
   tags = {
-    env = var.env
+    env       = var.env
     terraform = "true"
-    name = "${var.env}-key-main"
+    name      = "${var.env}-key-main"
   }
 }
 
 resource "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
+  name          = "alias/${var.env}-main"
   target_key_id = aws_kms_key.main.key_id
 }
 
diff --git a/encryptkey/outputs.tf b/encryptkey/outputs.tf
index 41df35b..a127e82 100644
--- a/encryptkey/outputs.tf
+++ b/encryptkey/outputs.tf
@@ -1,4 +1,4 @@
-output "key_arn" {
+output "arn" {
   value = aws_kms_key.main.arn
 }
 
diff --git a/encryptkey/variables.tf b/encryptkey/variables.tf
index d7dbe4e..0a64f51 100644
--- a/encryptkey/variables.tf
+++ b/encryptkey/variables.tf
@@ -1,4 +1,5 @@
 variable "env" {
+  type        = string
   description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
 }
 
diff --git a/encryptkey/versions.tf b/encryptkey/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/encryptkey/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/fargate_cluster/container_task.tmpl b/fargate_cluster/container_task.tmpl
index b4905ca..0f658f6 100644
--- a/fargate_cluster/container_task.tmpl
+++ b/fargate_cluster/container_task.tmpl
@@ -1,9 +1,10 @@
 [
   {
-    "cpu": 1024,
+    "cpu": ${cpu_size},
     "essential": true,
     "image": "${image}",
     "environment": ${environment_variables},
+    "secrets": ${secrets},
     "logConfiguration": {
       "logDriver": "awslogs",
       "options": {
@@ -12,16 +13,10 @@
         "awslogs-stream-prefix": "${awslogs-stream-prefix}"
       }
     },
-    "memory": 2048,
+    "memory": ${memory_size},
     "mountPoints": [],
     "name": "${name}",
-    "portMappings": [
-      {
-        "containerPort": ${port},
-        "hostPort": ${port},
-        "protocol": "tcp"
-      }
-    ],
+    "portMappings": ${portMappings}, 
     "volumesFrom": []
   }
-]
\ No newline at end of file
+]
diff --git a/fargate_cluster/data.tf b/fargate_cluster/data.tf
deleted file mode 100644
index 6866cf2..0000000
--- a/fargate_cluster/data.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-data "aws_region" "current" {
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
diff --git a/fargate_cluster/ingress.tf b/fargate_cluster/ingress.tf
new file mode 100644
index 0000000..d832833
--- /dev/null
+++ b/fargate_cluster/ingress.tf
@@ -0,0 +1,69 @@
+#####
+# Target group in case it needs to be attached to an LB
+#####
+locals {
+  ingress_enabled = var.public ? 1 : 0
+}
+
+resource "aws_route53_record" "external" {
+  count   = local.ingress_enabled
+  zone_id = var.base.external.id
+  name    = var.application_name
+  type    = "CNAME"
+  ttl     = 30
+
+  records = ["ingress-${var.base.env}.${var.base.domain_name}"]
+}
+
+resource "aws_alb_target_group" "application" {
+  count = local.ingress_enabled
+  # max 6 characters for name prefix
+  name_prefix = "app-lb"
+  port        = var.application_ports[0]
+  protocol    = "HTTP"
+  vpc_id      = var.base.vpc.id
+  target_type = "ip" # Must use IP to support fargate
+
+  health_check {
+    interval            = 60
+    path                = var.health_check_path
+    port                = var.application_ports[0]
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    matcher             = "200-308"
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = var.application_name
+    name      = "app-lb-${var.application_name}-${var.application_ports[0]}"
+  }
+}
+
+resource "aws_alb_listener_rule" "applications" {
+  count        = local.ingress_enabled
+  listener_arn = var.base.ingress.listener.arn
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_alb_target_group.application[0].arn
+  }
+
+  condition {
+    field  = "host-header"
+    values = ["${var.application_name}.${var.base.domain_name}"]
+  }
+}
+
+# Allow ingress to talk to our primary port
+resource "aws_security_group_rule" "ingress" {
+  count                    = local.ingress_enabled
+  type                     = "ingress"
+  from_port                = var.application_ports[0]
+  to_port                  = var.application_ports[0]
+  protocol                 = "tcp"
+  source_security_group_id = var.base.ingress.security_group.id
+
+  security_group_id = aws_security_group.fargate.id
+}
diff --git a/fargate_cluster/main.tf b/fargate_cluster/main.tf
index f6e99df..9bc25e3 100644
--- a/fargate_cluster/main.tf
+++ b/fargate_cluster/main.tf
@@ -1,69 +1,70 @@
-module "fargate_base" {
-  source = "../app_base"
-
-  env               = var.env
-  domain_name       = var.domain_name
-  application_name  = var.application_name
-  application_port  = var.application_port
-  loadbalancer_port = var.loadbalancer_port
-  health_check_path = var.health_check_path
+terraform {
+  required_version = ">= 0.12"
 }
 
-# TODO(bob) May need a call to create a service linked role first:
-# aws iam create-service-linked-role --aws-service-name ecs.amazonaws.com
-# seems to be one-time only thing so maybe bootbox?
-
 resource "aws_ecs_cluster" "app" {
   name = var.application_name
 }
 
-# Must use template here to get ports as ints
-data "template_file" "task" {
-  template = file("${path.module}/container_task.tmpl")
-
-  vars = {
+resource "aws_ecs_task_definition" "app" {
+  family = "${var.base.env}-${var.application_name}"
+  container_definitions = templatefile("${path.module}/container_task.tmpl", {
     image                 = var.docker_image
     awslogs-group         = aws_cloudwatch_log_group.app.name
-    awslogs-region        = data.aws_region.current.name
-    awslogs-stream-prefix = "${var.env}-${var.application_name}"
+    awslogs-region        = var.base.region.name
+    awslogs-stream-prefix = "${var.base.env}-${var.application_name}"
     name                  = var.application_name
-    port                  = var.application_port
+    cpu_size              = local.cpu_size
+    memory_size           = local.memory_size
+    portMappings          = jsonencode([for p in var.application_ports : { "containerPort" = "${p}", "hostPort" = "${p}", "protocol" = "tcp" }])
     environment_variables = jsonencode(var.environment_variables)
-  }
-}
+    secrets               = jsonencode(var.secrets)
+  })
 
-resource "aws_ecs_task_definition" "app" {
-  family                = "${var.env}-${var.application_name}"
-  container_definitions = data.template_file.task.rendered
-  execution_role_arn    = aws_iam_role.ecs_execution.arn
+  execution_role_arn = aws_iam_role.ecs_execution.arn
 
   requires_compatibilities = ["FARGATE"]
   network_mode             = "awsvpc"
-  cpu                      = "2048" # 2 vCPU
-  memory                   = "4096" # 4 GiB
+  cpu                      = local.cpu_size
+  memory                   = local.memory_size
 }
 
+# locals {
+#   target_to_ports = zipmap([for t in aws_alb_target_group.application : t.arn], var.application_ports)
+# }
+
 resource "aws_ecs_service" "application" {
   name            = var.application_name
   cluster         = aws_ecs_cluster.app.id
   task_definition = aws_ecs_task_definition.app.arn
   launch_type     = "FARGATE"
-  desired_count   = 2
+  desired_count   = var.desired_count
 
   network_configuration {
-    subnets         = data.aws_subnet.application_subnet.*.id
-    security_groups = [module.fargate_base.app_sg_id]
+    subnets         = var.base.vpc.application[*].id
+    security_groups = [aws_security_group.fargate.id]
   }
 
   load_balancer {
-    target_group_arn = module.fargate_base.lb_tg_arn
+    target_group_arn = aws_alb_target_group.application[0].arn
     container_name   = var.application_name
-    container_port   = var.application_port
+    container_port   = var.application_ports[0]
   }
 
+
+  # Blocked pending support for multiple container ports
+  # dynamic "load_balancer" {
+  #   for_each = local.target_to_ports
+  #   content {
+  #     target_group_arn = load_balancer.key
+  #     container_name   = var.application_name
+  #     container_port   = load_balancer.value
+  #   }
+  # }
+
   depends_on = [
     aws_iam_role_policy.ecs_execution,
-    module.fargate_base,
+    aws_alb_target_group.application
   ]
 
   lifecycle {
@@ -71,61 +72,89 @@ resource "aws_ecs_service" "application" {
   }
 }
 
+#######
+# Security group for application
+#######
+
+resource "aws_security_group" "fargate" {
+  name_prefix = "${var.application_name}-app-"
+  vpc_id      = var.base.vpc.id
+
+  tags = {
+    app       = var.application_name
+    terraform = "true"
+    env       = var.base.env
+    role      = "fargate"
+  }
+}
+
+# Allow all outbound, e.g. third-pary API endpoints, by default
+resource "aws_security_group_rule" "egress" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.fargate.id
+}
+
+#####
+# Centralized logging
+#####
 resource "aws_cloudwatch_log_group" "app" {
-  name = "${var.env}-${var.application_name}"
+  name = "${var.base.env}-${var.application_name}"
 
   tags = {
-    Name        = "${var.env}-${var.application_name}"
-    environment = var.env
+    Name        = "${var.base.env}-${var.application_name}"
+    terraform   = "true"
+    environment = var.base.env
     app         = var.application_name
   }
 }
 
 resource "aws_iam_role" "ecs_execution" {
-  name = "${var.env}-${var.application_name}-ecs_task_execution"
+  name               = "${var.base.env}-${var.application_name}-ecs_task_execution"
+  assume_role_policy = local.assume_role_policy
 
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "ecs-tasks.amazonaws.com"
-      },
-      "Action": "sts:AssumeRole"
-    }
-  ]
 }
-EOF
 
+resource "aws_iam_role_policy" "ecs_execution" {
+  name   = "${var.base.env}-${var.application_name}-ecs_execution"
+  role   = aws_iam_role.ecs_execution.id
+  policy = data.aws_iam_policy_document.ecs_execution.json
 }
 
-resource "aws_iam_role_policy" "ecs_execution" {
-  name = "${var.env}-${var.application_name}-ecs_execution"
-  role = aws_iam_role.ecs_execution.id
 
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ecr:GetAuthorizationToken",
-        "ecr:BatchCheckLayerAvailability",
-        "ecr:GetDownloadUrlForLayer",
-        "ecr:BatchGetImage",
-        "ecs:StartTelemetrySession",
-        "logs:CreateLogStream",
-        "logs:PutLogEvents"
-      ],
-      "Resource": "*"
-    }
-  ]
+locals {
+  secret_arns = [for s in var.secrets : s["valueFrom"]]
 }
-EOF
 
+data "aws_iam_policy_document" "ecs_execution" {
+  statement {
+    actions = [
+      "ecr:GetAuthorizationToken",
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:GetDownloadUrlForLayer",
+      "ecr:BatchGetImage",
+      "ecs:StartTelemetrySession",
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    resources = [
+      "*",
+    ]
+  }
+
+  statement {
+    actions   = ["kms:Decrypt"]
+    resources = [var.base.key.arn]
+  }
+
+  statement {
+    actions   = ["secretsmanager:GetSecretValue"]
+    resources = local.secret_arns
+  }
 }
 
 ######
@@ -133,153 +162,170 @@ EOF
 ######
 
 resource "aws_appautoscaling_target" "service" {
-service_namespace  = "ecs"
-resource_id        = "service/${aws_ecs_cluster.app.name}/${aws_ecs_service.application.name}"
-scalable_dimension = "ecs:service:DesiredCount"
-max_capacity       = 8
-min_capacity       = 2
+  service_namespace  = "ecs"
+  resource_id        = "service/${aws_ecs_cluster.app.name}/${aws_ecs_service.application.name}"
+  scalable_dimension = "ecs:service:DesiredCount"
+  max_capacity       = var.max_count
+  min_capacity       = var.desired_count
 }
 
 # Alarms to trigger actions
 
 resource "aws_cloudwatch_metric_alarm" "cpu_utilization_high" {
-alarm_name          = "${var.env}-${var.application_name}-CPU-Utilization-High"
-comparison_operator = "GreaterThanOrEqualToThreshold"
-evaluation_periods  = "2"
-metric_name         = "CPUUtilization"
-namespace           = "AWS/ECS"
-period              = "300"
-statistic           = "Maximum"
-threshold           = 80
-
-dimensions = {
-ClusterName = aws_ecs_cluster.app.name
-ServiceName = aws_ecs_service.application.name
-}
+  alarm_name          = "${var.base.env}-${var.application_name}-CPU-Utilization-High"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "CPUUtilization"
+  namespace           = "AWS/ECS"
+  period              = "300"
+  statistic           = "Maximum"
+  threshold           = 80
+
+  dimensions = {
+    ClusterName = aws_ecs_cluster.app.name
+    ServiceName = aws_ecs_service.application.name
+  }
 
-alarm_description = "Scale up if maximum CPU Utilization is above 80% for two consecutive 5 minute periods"
-alarm_actions     = [aws_appautoscaling_policy.up.arn]
+  alarm_description = "Scale up if maximum CPU Utilization is above 80% for two consecutive 5 minute periods"
+  alarm_actions     = [aws_appautoscaling_policy.up.arn]
 
-lifecycle {
-create_before_destroy = true
-}
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "aws_cloudwatch_metric_alarm" "memory_utilization_high" {
-alarm_name          = "${var.env}-${var.application_name}-Memory-Utilization-High"
-comparison_operator = "GreaterThanOrEqualToThreshold"
-evaluation_periods  = "3"
-metric_name         = "MemoryUtilization"
-namespace           = "AWS/ECS"
-period              = "300"
-statistic           = "Maximum"
-threshold           = 90
-
-dimensions = {
-ClusterName = aws_ecs_cluster.app.name
-ServiceName = aws_ecs_service.application.name
-}
+  alarm_name          = "${var.base.env}-${var.application_name}-Memory-Utilization-High"
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  evaluation_periods  = "3"
+  metric_name         = "MemoryUtilization"
+  namespace           = "AWS/ECS"
+  period              = "300"
+  statistic           = "Maximum"
+  threshold           = 90
+
+  dimensions = {
+    ClusterName = aws_ecs_cluster.app.name
+    ServiceName = aws_ecs_service.application.name
+  }
 
-alarm_description = "Scale up if maximum Memory Reservation is above 90% for two consecutive 5 minute periods"
-alarm_actions     = [aws_appautoscaling_policy.up.arn]
+  alarm_description = "Scale up if maximum Memory Reservation is above 90% for two consecutive 5 minute periods"
+  alarm_actions     = [aws_appautoscaling_policy.up.arn]
 
-lifecycle {
-create_before_destroy = true
-}
+  lifecycle {
+    create_before_destroy = true
+  }
 
-# This is required to make cloudwatch alarms creation sequential, AWS doesn't
-# support modifying alarms concurrently.
-depends_on = [aws_cloudwatch_metric_alarm.cpu_utilization_high]
+  # This is required to make cloudwatch alarms creation sequential, AWS doesn't
+  # support modifying alarms concurrently.
+  depends_on = [aws_cloudwatch_metric_alarm.cpu_utilization_high]
 }
 
 resource "aws_cloudwatch_metric_alarm" "cpu_utilization_low" {
-alarm_name          = "${var.env}-${var.application_name}-CPU-Utilization-Low"
-comparison_operator = "LessThanThreshold"
-evaluation_periods  = "1"
-metric_name         = "CPUUtilization"
-namespace           = "AWS/ECS"
-period              = "300"
-statistic           = "Average"
-threshold           = 20
-
-dimensions = {
-ClusterName = aws_ecs_cluster.app.name
-ServiceName = aws_ecs_service.application.name
-}
+  alarm_name          = "${var.base.env}-${var.application_name}-CPU-Utilization-Low"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "CPUUtilization"
+  namespace           = "AWS/ECS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = 20
+
+  dimensions = {
+    ClusterName = aws_ecs_cluster.app.name
+    ServiceName = aws_ecs_service.application.name
+  }
 
-alarm_description = "Scale down if the CPU Utilitization is below 20% for 5 minutes"
-alarm_actions     = [aws_appautoscaling_policy.down.arn]
+  alarm_description = "Scale down if the CPU Utilitization is below 20% for 5 minutes"
+  alarm_actions     = [aws_appautoscaling_policy.down.arn]
 
-lifecycle {
-create_before_destroy = true
-}
+  lifecycle {
+    create_before_destroy = true
+  }
 
-# This is required to make cloudwatch alarms creation sequential, AWS doesn't
-# support modifying alarms concurrently.
-depends_on = [aws_cloudwatch_metric_alarm.memory_utilization_high]
+  # This is required to make cloudwatch alarms creation sequential, AWS doesn't
+  # support modifying alarms concurrently.
+  depends_on = [aws_cloudwatch_metric_alarm.memory_utilization_high]
 }
 
 resource "aws_cloudwatch_metric_alarm" "memory_utilization_low" {
-alarm_name          = "${var.env}-${var.application_name}-Memory-Utilization-Low"
-comparison_operator = "LessThanThreshold"
-evaluation_periods  = "1"
-metric_name         = "MemoryUtilization"
-namespace           = "AWS/ECS"
-period              = "300"
-statistic           = "Average"
-threshold           = 20
-
-dimensions = {
-ClusterName = aws_ecs_cluster.app.name
-ServiceName = aws_ecs_service.application.name
-}
+  alarm_name          = "${var.base.env}-${var.application_name}-Memory-Utilization-Low"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "MemoryUtilization"
+  namespace           = "AWS/ECS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = 20
+
+  dimensions = {
+    ClusterName = aws_ecs_cluster.app.name
+    ServiceName = aws_ecs_service.application.name
+  }
 
-alarm_description = "Scale down if the Memory Usage is below 20% for 5 minutes"
-alarm_actions     = [aws_appautoscaling_policy.down.arn]
+  alarm_description = "Scale down if the Memory Usage is below 20% for 5 minutes"
+  alarm_actions     = [aws_appautoscaling_policy.down.arn]
 
-lifecycle {
-create_before_destroy = true
-}
+  lifecycle {
+    create_before_destroy = true
+  }
 
-# This is required to make cloudwatch alarms creation sequential, AWS doesn't
-# support modifying alarms concurrently.
-depends_on = [aws_cloudwatch_metric_alarm.cpu_utilization_low]
+  # This is required to make cloudwatch alarms creation sequential, AWS doesn't
+  # support modifying alarms concurrently.
+  depends_on = [aws_cloudwatch_metric_alarm.cpu_utilization_low]
 }
 
 # Autoscaling actions
 resource "aws_appautoscaling_policy" "up" {
-name               = "app-scale-up"
-service_namespace  = aws_appautoscaling_target.service.service_namespace
-resource_id        = aws_appautoscaling_target.service.resource_id
-scalable_dimension = aws_appautoscaling_target.service.scalable_dimension
-
-step_scaling_policy_configuration {
-adjustment_type         = "ChangeInCapacity"
-cooldown                = 60
-metric_aggregation_type = "Average"
-
-step_adjustment {
-metric_interval_lower_bound = 0
-scaling_adjustment          = 1
-}
-}
+  name               = "app-scale-up"
+  service_namespace  = aws_appautoscaling_target.service.service_namespace
+  resource_id        = aws_appautoscaling_target.service.resource_id
+  scalable_dimension = aws_appautoscaling_target.service.scalable_dimension
+
+  step_scaling_policy_configuration {
+    adjustment_type         = "ChangeInCapacity"
+    cooldown                = 60
+    metric_aggregation_type = "Average"
+
+    step_adjustment {
+      metric_interval_lower_bound = 0
+      scaling_adjustment          = 2
+    }
+  }
 }
 
 resource "aws_appautoscaling_policy" "down" {
-name               = "app-scale-down"
-service_namespace  = aws_appautoscaling_target.service.service_namespace
-resource_id        = aws_appautoscaling_target.service.resource_id
-scalable_dimension = aws_appautoscaling_target.service.scalable_dimension
-
-step_scaling_policy_configuration {
-adjustment_type         = "ChangeInCapacity"
-cooldown                = 300
-metric_aggregation_type = "Average"
-
-step_adjustment {
-metric_interval_upper_bound = 0
-scaling_adjustment          = -1
-}
+  name               = "app-scale-down"
+  service_namespace  = aws_appautoscaling_target.service.service_namespace
+  resource_id        = aws_appautoscaling_target.service.resource_id
+  scalable_dimension = aws_appautoscaling_target.service.scalable_dimension
+
+  step_scaling_policy_configuration {
+    adjustment_type         = "ChangeInCapacity"
+    cooldown                = 300
+    metric_aggregation_type = "Average"
+
+    step_adjustment {
+      metric_interval_upper_bound = 0
+      scaling_adjustment          = -1
+    }
+  }
 }
+
+locals {
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "ecs-tasks.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
 }
+EOF
 
+}
diff --git a/fargate_cluster/outputs.tf b/fargate_cluster/outputs.tf
index d36a7a0..aadfb01 100644
--- a/fargate_cluster/outputs.tf
+++ b/fargate_cluster/outputs.tf
@@ -1,4 +1,19 @@
-output "app_sg_id" {
-  value = module.fargate_base.app_sg_id
+output "name" {
+  description = "name of the application this hosts"
+  value       = var.application_name
 }
 
+output "docker_image" {
+  description = "Images in the Docker Hub registry are available by default. You can also specify other repositories with either repository-url/image:tag or repository-url/image@digest"
+  value       = var.docker_image
+}
+
+output "security_group" {
+  description = "object with the application-specific security group. defaults to unrestricted egress"
+  value       = aws_security_group.fargate
+}
+
+output "ecs_execution_iam_role" {
+  description = "IAM role name for attaching additional policies to the instance with aws_iam_role_policy_attachment"
+  value       = aws_iam_role.ecs_execution
+}
diff --git a/fargate_cluster/variables.tf b/fargate_cluster/variables.tf
index 4a0d05b..88357ee 100644
--- a/fargate_cluster/variables.tf
+++ b/fargate_cluster/variables.tf
@@ -1,44 +1,78 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
 }
 
 variable "application_name" {
+  type        = string
   description = "name of the application to be hosted. must be unique in the environment."
 }
 
 variable "docker_image" {
+  type        = string
   description = "Images in the Docker Hub registry are available by default. You can also specify other repositories with either repository-url/image:tag or repository-url/image@digest"
 }
 
-variable "application_port" {
-  description = "port on which the application will be listening."
-  default     = "80"
+variable "container_size" {
+  type        = string
+  description = "OPTIONAL: Roughly tracks t2/t3 sizing for cpu and memory. Valid values: nano, micro, small, medium, large, xlarge"
+  default     = "micro"
 }
 
-variable "loadbalancer_port" {
-  description = "port on which the load balancer will be listening. it will terminate TLS on this port."
-  default     = "443"
+locals {
+  size_mapping = {
+    "nano"   = { cpu = 512, memory = 1024 },   # 0.5 vCPU,  1GB memory
+    "micro"  = { cpu = 1024, memory = 2048 },  #   1 vCPU,  2GB memory
+    "small"  = { cpu = 2048, memory = 2048 },  #   2 vCPU,  2GB memory
+    "medium" = { cpu = 2048, memory = 4096 },  #   2 vCPU,  4GB memory
+    "large"  = { cpu = 2048, memory = 8192 },  #   2 vCPU,  8GB memory
+    "xlarge" = { cpu = 4096, memory = 16384 }, #   4 vCPU, 16GB memory
+  }
+  cpu_size    = local.size_mapping[var.container_size].cpu
+  memory_size = local.size_mapping[var.container_size].memory
 }
 
-variable "environment_variables" {
-  type        = list(string)
-  description = "environment variables to inject into the docker containers. a list of maps."
-  default     = []
+variable "desired_count" {
+  type        = number
+  description = "OPTIONAL: minimum number of container copies to run before autoscaling kicks in."
+  default     = 2
+}
+
+variable "max_count" {
+  type        = number
+  description = "OPTIONAL: maximum number of container copies that autoscaling will spin up"
+  default     = 16
+}
+
+variable "public" {
+  type        = bool
+  description = "OPTIONAL: whether or not to expose the application publicly"
+  default     = true
+}
+
+# For now only first port will be operational until this is released:
+# https://github.com/aws/containers-roadmap/issues/12
+# https://github.com/aws/containers-roadmap/issues/104
+variable "application_ports" {
+  type        = list(number)
+  description = "OPTIONAL: port on which the application will be listening. The first port listed will be used for the health check"
+  default     = [80]
 }
 
 variable "health_check_path" {
-  description = "path used by load balancer to health check application. should return 200."
+  type        = string
+  description = "OPTIONAL: path used by load balancer to health check application. should return 200."
   default     = "/"
 }
 
-# Currently not supported by Fargate. Placeholder until it is.
-# https://docs.amazonaws.cn/en_us/AmazonECS/latest/developerguide/specifying-sensitive-data.html
-# variable "secrets" {
-#   type        = "list"
-#   description = "list of stored secrets to inject into the docker container. a list of maps."
-#   default     = []
-# }
+variable "environment_variables" {
+  type        = list(map(any))
+  description = "OPTIONAL: environment variables to inject into the docker containers. a list of maps with keys name and value."
+  default     = []
+}
+
+# https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html
+variable "secrets" {
+  type        = list(map(any))
+  description = "OPTIONAL: list of stored secrets in Secrets Manager to inject into the docker container. a list of maps with keys: name and valueFrom (ARN of the secret)."
+  default     = []
+}
diff --git a/fargate_cluster/versions.tf b/fargate_cluster/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/fargate_cluster/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/ingress/data.tf b/ingress/data.tf
deleted file mode 100644
index 0590440..0000000
--- a/ingress/data.tf
+++ /dev/null
@@ -1,71 +0,0 @@
-#######
-### Lookup resources already created by foundation
-#######
-data "aws_caller_identity" "current" {
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_subnet" "public" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "public-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_route53_zone" "external" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_route53_zone" "internal" {
-  name         = "${var.env}.local"
-  private_zone = true
-}
-
-data "aws_acm_certificate" "wildcard" {
-  domain      = var.domain_name
-  most_recent = true
-}
-
-data "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
-}
-
diff --git a/ingress/main.tf b/ingress/main.tf
index eec366e..919a0c8 100644
--- a/ingress/main.tf
+++ b/ingress/main.tf
@@ -1,524 +1,129 @@
 #######
-# Network load balancer that receives traffic from the internet
-# Terminates our TLS for HTTPS traffic
+# DNS Records for proxied site(s)
 #######
 
-resource "aws_lb" "nlb" {
-  name_prefix        = "in-nlb"
-  internal           = false
-  load_balancer_type = "network"
-  subnets            = data.aws_subnet.public.*.id
-
-  enable_cross_zone_load_balancing = true
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = "ingress"
-    Name      = "ingress-nlb"
-  }
+terraform {
+  required_version = ">= 0.12"
 }
 
-resource "aws_lb_listener" "http" {
-  load_balancer_arn = aws_lb.nlb.arn
-  port              = "80"
-  protocol          = "TCP"
+resource "aws_route53_record" "ingress" {
+  count   = var.public ? 1 : 0
+  zone_id = var.external_dns.id
+  name    = "ingress-${var.env}"
+  type    = "CNAME"
+  ttl     = 30
 
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.http.arn
-  }
+  records = [aws_alb.ingress.dns_name]
 }
 
-resource "aws_lb_target_group" "http" {
-  name_prefix = "inhttp"
-  port        = "80"
-  protocol    = "TCP"
-  vpc_id      = data.aws_vpc.vpc.id
 
-  target_type = "ip"
-
-  health_check {
-    protocol = "TCP"
-    port     = 200
-  }
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = "ingress"
-    Name      = "ingress-nlb-http"
-  }
-}
-
-# TODO
-resource "aws_lb_listener" "https" {
-  load_balancer_arn = aws_lb.nlb.arn
-  port              = "443"
-  protocol          = "TLS"
+#######
+# ALB in front of HTTP services
+#######
 
-  ssl_policy      = "ELBSecurityPolicy-FS-2018-06"
-  certificate_arn = data.aws_acm_certificate.wildcard.arn
+resource "aws_route53_record" "alb_cname" {
+  zone_id = var.internal_dns.zone_id
+  name    = "ingress-alb"
+  type    = "CNAME"
+  ttl     = 30
 
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.https.arn
-  }
+  records = [aws_alb.ingress.dns_name]
 }
 
-resource "aws_lb_target_group" "https" {
-  name_prefix = "in-tls"
-  port        = "443"
-  protocol    = "TLS"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  # Use IP to support Fargate clusters
-  target_type = "ip"
-
-  # Enable proxy protocol to get original source IP
-  proxy_protocol_v2 = true
+resource "aws_alb" "ingress" {
+  # max 6 characters for name prefix
+  name_prefix     = "in-alb"
+  internal        = ! var.public
+  security_groups = [aws_security_group.alb.id]
+  subnets         = var.public ? var.subnet_ids.public : var.subnet_ids.application
 
-  health_check {
-    protocol = "TCP"
-    port     = 200
-  }
+  ip_address_type = "ipv4"
 
   tags = {
     env       = var.env
     terraform = "true"
     app       = "ingress"
-    Name      = "ingress-nlb-https"
+    name      = "alb-ingress"
   }
 }
 
-resource "aws_alb_target_group_attachment" "http" {
-  count            = 1
-  target_group_arn = aws_lb_target_group.http.arn
-  target_id        = element(aws_instance.nginx.*.private_ip, count.index)
-}
-
-resource "aws_alb_target_group_attachment" "https" {
-  count            = 1
-  target_group_arn = aws_lb_target_group.https.arn
-  target_id        = element(aws_instance.nginx.*.private_ip, count.index)
-}
-
-#######
-# Nginx Reverse Proxy to send data to our backends
-#######
-
-# Create ECR repo for docker image and provide cross account access if needed
-resource "aws_ecr_repository" "nginx" {
-  name = "ingress-${var.env}"
-}
+# Redirect HTTP to HTTPS
+resource "aws_lb_listener" "http_to_https" {
+  load_balancer_arn = aws_alb.ingress.arn
+  port              = 80
+  protocol          = "HTTP"
 
-resource "aws_ecr_repository_policy" "cross_account_access" {
-  count      = length(var.other_accounts)
-  repository = aws_ecr_repository.nginx.name
+  default_action {
+    type = "redirect"
 
-  policy = <<EOF
-{
-  "Version": "2008-10-17",
-  "Statement": [
-    {
-      "Sid": "AllowCrossAccountAccess",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "arn:aws:iam::${element(var.other_accounts, count.index)}:root"
-      },
-      "Action": [
-        "ecr:GetDownloadUrlForLayer",
-        "ecr:BatchGetImage",
-        "ecr:BatchCheckLayerAvailability",
-        "ecr:PutImage",
-        "ecr:InitiateLayerUpload",
-        "ecr:UploadLayerPart",
-        "ecr:CompleteLayerUpload",
-        "ecr:DescribeRepositories"
-      ]
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
     }
-  ]
+  }
 }
-EOF
 
-}
+# Listen for application traffic
+resource "aws_alb_listener" "applications" {
+  load_balancer_arn = aws_alb.ingress.arn
+  port              = 443
+  protocol          = "HTTPS"
+  ssl_policy        = "ELBSecurityPolicy-FS-2018-06"
+  certificate_arn   = var.wildcard_arn
 
-data "aws_iam_policy_document" "cross_account_assume_role" {
-  statement {
-    effect = "Allow"
+  # If no matches for applications, send to apex domain as fallback
+  default_action {
+    type = "redirect"
 
-    principals {
-      type = "AWS"
-      identifiers = var.other_accounts
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      host        = "${var.domain_name}"
+      status_code = "HTTP_302"
     }
-
-    actions = ["sts:AssumeRole"]
   }
 }
 
-resource "aws_iam_role" "cross_account_assume_role" {
-  name = "ingress-cross-account-${var.env}"
-  assume_role_policy = data.aws_iam_policy_document.cross_account_assume_role.json
-}
-
-resource "aws_iam_role_policy_attachment" "cross_account_assume_role" {
-  role = aws_iam_role.cross_account_assume_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
-}
-
-resource "aws_instance" "nginx" {
-  count = 1
-  ami = data.aws_ami.base.id
-  instance_type = "t3.medium"
-
-  iam_instance_profile = aws_iam_instance_profile.iam.name
-
-  user_data = <<EOF
-#!/usr/bin/env bash
-set -euo pipefail
-
-eval $(aws ecr get-login --region=us-east-1 --no-include-email)
-
-docker pull ${aws_ecr_repository.nginx.repository_url}:latest
-docker run -d --restart=unless-stopped \
-  --name nginx \
-  -p 80:80 \
-  -p 200:200 \
-  -p 443:443 \
-  ${aws_ecr_repository.nginx.repository_url}:latest
-EOF
-
-
-key_name = "infrastructure"
-
-associate_public_ip_address = false
-
-#distribute instances across AZs
-subnet_id              = element(data.aws_subnet.application.*.id, count.index)
-vpc_security_group_ids = [aws_security_group.nginx.id]
-
-lifecycle {
-ignore_changes = [ami]
-}
-
-credit_specification {
-cpu_credits = "unlimited"
-}
-
-tags = {
-Name      = "ingress-nginx"
-terraform = "true"
-app       = "ingress"
-env       = var.env
-}
-}
-
-# Security group for nginx
-resource "aws_security_group" "nginx" {
-name_prefix = "ingress-nginx-"
-vpc_id      = data.aws_vpc.vpc.id
-
-tags = {
-env       = var.env
-terraform = "true"
-app       = "ingress-nginx"
-Name      = "ingress-nginx"
-}
-}
-
-resource "aws_security_group_rule" "nginx_http" {
-type        = "ingress"
-from_port   = "80"
-to_port     = "80"
-protocol    = "tcp"
-cidr_blocks = ["0.0.0.0/0"]
-
-security_group_id = aws_security_group.nginx.id
-}
-
-resource "aws_security_group_rule" "nginx_https" {
-type        = "ingress"
-from_port   = "443"
-to_port     = "443"
-protocol    = "tcp"
-cidr_blocks = ["0.0.0.0/0"]
-
-security_group_id = aws_security_group.nginx.id
-}
-
-resource "aws_security_group_rule" "nginx_healthcheck" {
-type        = "ingress"
-from_port   = "200"
-to_port     = "200"
-protocol    = "tcp"
-cidr_blocks = ["0.0.0.0/0"]
-
-security_group_id = aws_security_group.nginx.id
-}
-
-resource "aws_security_group_rule" "nginx_out" {
-type        = "egress"
-from_port   = 0
-to_port     = 0
-protocol    = "-1"
-cidr_blocks = ["0.0.0.0/0"]
-
-security_group_id = aws_security_group.nginx.id
-}
-
-resource "aws_security_group_rule" "jumpbox" {
-type                     = "ingress"
-from_port                = 22
-to_port                  = 22
-protocol                 = "tcp"
-source_security_group_id = data.aws_security_group.jumpbox.id
-
-security_group_id = aws_security_group.nginx.id
-}
-
-# Base IAM instance profile
-resource "aws_iam_instance_profile" "iam" {
-name = "${var.env}-ingress-nginx"
-role = aws_iam_role.iam.name
-}
-
-# Auth instance profile and roles
-resource "aws_iam_role" "iam" {
-name = "${var.env}-ingress-nginx"
-
-assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {"Service": "ec2.amazonaws.com"},
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-
-}
-
-resource "aws_iam_role_policy_attachment" "ecr" {
-role = aws_iam_role.iam.name
-policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
-}
-
-# Give it base teleport permissions
-# resource "aws_iam_role_policy_attachment" "iam_teleport" {
-#   role       = "${aws_iam_role.iam.name}"
-#   policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.env}/teleport/${var.env}-instance-teleport-secrets"
-# }
-
-resource "aws_kms_grant" "main" {
-name = "${var.env}-ingress-nginx-main"
-key_id = data.aws_kms_alias.main.target_key_arn
-grantee_principal = aws_iam_role.iam.arn
-operations = ["Decrypt"]
-}
-
-#######
-# DNS Records for proxied site
-#######
-
-resource "aws_route53_record" "external_cname" {
-zone_id = data.aws_route53_zone.external.id
-name = "helloworld"
-type = "CNAME"
-ttl = 30
-
-records = [aws_lb.nlb.dns_name]
-}
-
-resource "aws_route53_record" "people_staging" {
-zone_id = data.aws_route53_zone.external.id
-name = "people-staging"
-type = "CNAME"
-ttl = 30
-
-records = [aws_lb.nlb.dns_name]
-}
-
-#######
-# ALB in front of HTTP service
-#######
-
-resource "aws_route53_record" "alb_cname" {
-zone_id = data.aws_route53_zone.internal.id
-name = "ingress-alb"
-type = "CNAME"
-ttl = 30
-
-records = [aws_alb.application_alb.dns_name]
-}
-
-resource "aws_alb" "application_alb" {
-# max 6 characters for name prefix
-name_prefix = "app-lb"
-internal = true
-security_groups = [aws_security_group.application_alb_sg.id]
-subnets = data.aws_subnet.public.*.id
-
-ip_address_type = "ipv4"
-
-tags = {
-env = var.env
-terraform = "true"
-app = "helloworld"
-name = "alb-helloworld"
-}
-}
-
-resource "aws_alb_listener" "app_http" {
-load_balancer_arn = aws_alb.application_alb.arn
-port = "80"
-protocol = "HTTP"
-
-default_action {
-target_group_arn = aws_alb_target_group.application.arn
-type = "forward"
-}
-}
-
 # Security Group: world -> alb
-resource "aws_security_group" "application_alb_sg" {
-name_prefix = "app-alb-"
-vpc_id = data.aws_vpc.vpc.id
-
-tags = {
-env = var.env
-terraform = "true"
-app = "helloworld"
-name = "world->alb-sg-helloworld"
-}
-}
-
-// Allow inbound only to our listening port
-resource "aws_security_group_rule" "lb_ingress" {
-type = "ingress"
-from_port = "80"
-to_port = "80"
-protocol = "tcp"
-source_security_group_id = aws_security_group.nginx.id
-
-security_group_id = aws_security_group.application_alb_sg.id
-}
-
-// Allow all outbound by default
-resource "aws_security_group_rule" "lb_egress" {
-type = "egress"
-from_port = 0
-to_port = 0
-protocol = "-1"
-cidr_blocks = ["0.0.0.0/0"]
-
-security_group_id = aws_security_group.application_alb_sg.id
-}
-
-#######
-# Web server
-#######
-
-resource "aws_instance" "application" {
-ami = data.aws_ami.base.id
-instance_type = "t3.micro"
-
-user_data = <<EOF
-#!/usr/bin/env bash
-set -euo pipefail
-
-docker run -d --restart=unless-stopped \
-  --name nginx \
-  -p 80:80 \
-  nginxdemos/hello
-EOF
-
-
-  key_name = "infrastructure"
-
-  associate_public_ip_address = false
-
-  #distribute instances across AZs
-  subnet_id              = element(data.aws_subnet.application.*.id, 0)
-  vpc_security_group_ids = [aws_security_group.app_sg.id]
-
-  lifecycle {
-    ignore_changes = [ami]
-  }
-
-  credit_specification {
-    cpu_credits = "unlimited"
-  }
-
-  tags = {
-    Name = "helloworld-0"
-    app  = "helloworld"
-    env  = var.env
-  }
-}
-
-resource "aws_alb_target_group" "application" {
-  # max 6 characters for name prefix
-  name_prefix = "app-lb"
-  port        = "80"
-  protocol    = "HTTP"
-  vpc_id      = data.aws_vpc.vpc.id
-  target_type = "ip" # Must use IP to support fargate
-
-  health_check {
-    interval            = 60
-    path                = "/"
-    port                = "80"
-    healthy_threshold   = 2
-    unhealthy_threshold = 2
-  }
-
-  depends_on = [aws_alb.application_alb]
+resource "aws_security_group" "alb" {
+  name_prefix = "app-alb-"
+  vpc_id      = var.vpc_id
 
   tags = {
     env       = var.env
     terraform = "true"
-    app       = "helloworld"
-    name      = "alb-tg-helloworld:80"
+    app       = "ingress"
+    name      = "world->alb-ingress"
   }
 }
 
-resource "aws_alb_target_group_attachment" "application_targets" {
-  target_group_arn = aws_alb_target_group.application.arn
-  target_id        = aws_instance.application.private_ip
+locals {
+  alb_ingress_ports = [80, 443]
 }
 
-resource "aws_security_group" "app_sg" {
-  name_prefix = "helloworld-app-"
-  vpc_id      = data.aws_vpc.vpc.id
+// Allow inbound only to our listening port
+resource "aws_security_group_rule" "lb_ingress" {
+  count = length(local.alb_ingress_ports)
 
-  tags = {
-    app = "helloworld"
-    env = var.env
-  }
-}
+  type      = "ingress"
+  from_port = local.alb_ingress_ports[count.index]
+  to_port   = local.alb_ingress_ports[count.index]
+  protocol  = "tcp"
 
-// Allow inbound only to our application port
-resource "aws_security_group_rule" "app_ingress" {
-  type                     = "ingress"
-  from_port                = "80"
-  to_port                  = "80"
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.application_alb_sg.id
+  # If fronted by nginx, only accept traffic from inside the VPC
+  cidr_blocks = var.public ? ["0.0.0.0/0"] : ["${var.cidr_block}"]
 
-  security_group_id = aws_security_group.app_sg.id
+  security_group_id = aws_security_group.alb.id
 }
 
-// Allow all outbound, e.g. third-pary API endpoints, by default
-resource "aws_security_group_rule" "app_egress" {
+// Allow all outbound by default
+resource "aws_security_group_rule" "lb_egress" {
   type        = "egress"
   from_port   = 0
   to_port     = 0
   protocol    = "-1"
   cidr_blocks = ["0.0.0.0/0"]
 
-  security_group_id = aws_security_group.app_sg.id
+  security_group_id = aws_security_group.alb.id
 }
-
diff --git a/ingress/outputs.tf b/ingress/outputs.tf
new file mode 100644
index 0000000..5d7f5de
--- /dev/null
+++ b/ingress/outputs.tf
@@ -0,0 +1,9 @@
+output "listener" {
+  description = "an object describing the primary HTTPS listener for other services"
+  value       = aws_alb_listener.applications
+}
+
+output "security_group" {
+  description = "an object describing the primary HTTPS listener for other services"
+  value       = aws_security_group.alb
+}
diff --git a/ingress/variables.tf b/ingress/variables.tf
index adb489b..3003f33 100644
--- a/ingress/variables.tf
+++ b/ingress/variables.tf
@@ -1,14 +1,44 @@
+variable "vpc_id" {
+  type        = string
+  description = "id of the vpc into which to create the ingress"
+}
+
+variable "cidr_block" {
+  type        = string
+  description = "OPTIONAL: the CIDR block to provision for the VPC. it should be a /16 block"
+  default     = "10.1.0.0/16"
+}
+
+variable "subnet_ids" {
+  type        = object({ application = list(string), public = list(string) })
+  description = "object containing two lists of subnet ids"
+}
+
+variable "internal_dns" {
+  description = "object describing an Route53 zone for internal DNS entries"
+}
+
 variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
+  type        = string
+  description = "Name of the environment"
 }
 
 variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+  type        = string
+  description = "the TLD for the project"
 }
 
-variable "other_accounts" {
-  type        = list(string)
-  description = "OPTIONAL: Additional accounts to give access to the docker repository housing ingress images"
-  default     = []
+variable "external_dns" {
+  description = "object describing an Route53 zone for external DNS entries"
 }
 
+variable "wildcard_arn" {
+  type        = string
+  description = "ARN of a wildcard ACM certificate"
+}
+
+variable "public" {
+  type        = bool
+  description = "OPTIONAL: whether or not this is publicly exposed or expected to sit behind another proxy (e.g., nginx)"
+  default     = true
+}
diff --git a/ingress/versions.tf b/ingress/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/ingress/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/ingress_nginx/Readme.md b/ingress_nginx/Readme.md
new file mode 100644
index 0000000..18fa448
--- /dev/null
+++ b/ingress_nginx/Readme.md
@@ -0,0 +1,3 @@
+# Ingress
+
+This creates a single point of entry for external services. It allows for simpler, more cost-effective usage of our load balancing and L7 proxies to support a growing number of services.
\ No newline at end of file
diff --git a/ingress_nginx/main.tf b/ingress_nginx/main.tf
new file mode 100644
index 0000000..a686fbc
--- /dev/null
+++ b/ingress_nginx/main.tf
@@ -0,0 +1,111 @@
+#######
+# DNS Records for proxied site(s)
+#######
+
+terraform {
+  required_version = ">= 0.12"
+}
+
+resource "aws_route53_record" "ingress" {
+  zone_id = var.base.external.id
+  name    = "ingress-${var.base.env}"
+  type    = "CNAME"
+  ttl     = 30
+
+  records = [aws_lb.nlb.dns_name]
+}
+
+#######
+# Network load balancer that receives traffic from the internet
+# Terminates our TLS for HTTPS traffic
+#######
+
+resource "aws_lb" "nlb" {
+  name_prefix        = "in-nlb"
+  internal           = false
+  load_balancer_type = "network"
+  subnets            = var.base.vpc.public[*].id
+
+  enable_cross_zone_load_balancing = true
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = "ingress"
+    Name      = "ingress-nlb"
+  }
+}
+
+resource "aws_lb_listener" "http" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = "80"
+  protocol          = "TCP"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.http.arn
+  }
+}
+
+resource "aws_lb_target_group" "http" {
+  # max 6 characters for name prefix
+  name_prefix = "ingres"
+  port        = 80
+  protocol    = "TCP"
+  vpc_id      = var.base.vpc.id
+  target_type = "instance" # Must use IP to support fargate if required
+
+  health_check {
+    protocol = "TCP"
+    port     = 200
+  }
+
+  depends_on = [aws_lb.nlb]
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = "ingress-nginx"
+    name      = "ingress-nginx-http"
+  }
+}
+
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = "443"
+  protocol          = "TLS"
+
+  ssl_policy      = "ELBSecurityPolicy-FS-2018-06"
+  certificate_arn = var.base.wildcard.arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.https.arn
+  }
+}
+
+resource "aws_lb_target_group" "https" {
+  # max 6 characters for name prefix
+  name_prefix = "ingres"
+  port        = 443
+  protocol    = "TLS"
+  vpc_id      = var.base.vpc.id
+  target_type = "instance" # Must use IP to support fargate
+
+  # Enable proxy protocol to get original source IP
+  proxy_protocol_v2 = true
+
+  health_check {
+    protocol = "TCP"
+    port     = 200
+  }
+
+  depends_on = [aws_lb.nlb]
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = "ingress-nginx"
+    name      = "ingress-nginx-https"
+  }
+}
diff --git a/ingress_nginx/nginx.tf b/ingress_nginx/nginx.tf
new file mode 100644
index 0000000..d1f8640
--- /dev/null
+++ b/ingress_nginx/nginx.tf
@@ -0,0 +1,46 @@
+#######
+# Nginx Reverse Proxy to send data to our backends
+#######
+
+#####
+# Create auto-scaling group for nginx proxies
+#
+# We cannot use fargate until it supports multiple inbound ports
+#####
+
+data "aws_ami" "nginx" {
+  most_recent = true
+  owners      = ["self"]
+
+  filter {
+    name   = "name"
+    values = ["ingress_${var.base.env}*"]
+  }
+}
+
+locals {
+  ports = [200, 443, 80]
+}
+
+module "nginx" {
+  source = "../autoscaling"
+
+  base              = var.base
+  ami_id            = data.aws_ami.nginx.id
+  application_name  = "ingress_nginx"
+  application_ports = local.ports
+  public            = false
+  target_group_arns = [aws_lb_target_group.http.arn, aws_lb_target_group.https.arn]
+}
+
+#TODO(bob) this may be able to be restricted to our private CIDR b/c we use proxy_protocol
+resource "aws_security_group_rule" "nginx" {
+  count       = length(local.ports)
+  type        = "ingress"
+  from_port   = local.ports[count.index]
+  to_port     = local.ports[count.index]
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = module.nginx.security_group.id
+}
diff --git a/ingress_nginx/variables.tf b/ingress_nginx/variables.tf
new file mode 100644
index 0000000..bb3365b
--- /dev/null
+++ b/ingress_nginx/variables.tf
@@ -0,0 +1,3 @@
+variable "base" {
+  description = "object describing the base module for this ingress"
+}
diff --git a/instance/ingress.tf b/instance/ingress.tf
new file mode 100644
index 0000000..aa3584c
--- /dev/null
+++ b/instance/ingress.tf
@@ -0,0 +1,75 @@
+#####
+# Target group in case it needs to be attached to an LB
+#####
+locals {
+  ingress_enabled = var.public ? 1 : 0
+}
+
+resource "aws_route53_record" "external" {
+  count   = local.ingress_enabled
+  zone_id = var.base.external.id
+  name    = var.application_name
+  type    = "CNAME"
+  ttl     = 30
+
+  records = ["ingress-${var.base.env}.${var.base.domain_name}"]
+}
+
+resource "aws_alb_target_group" "application" {
+  count = local.ingress_enabled
+  # max 6 characters for name prefix
+  name_prefix = "app-lb"
+  port        = var.application_ports[0]
+  protocol    = "HTTP"
+  vpc_id      = var.base.vpc.id
+  target_type = "ip" # Must use IP to support fargate
+
+  health_check {
+    interval            = 60
+    path                = var.health_check_path
+    port                = var.application_ports[0]
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    matcher             = "200-308"
+  }
+
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = var.application_name
+    name      = "app-lb-${var.application_name}-${var.application_ports[0]}"
+  }
+}
+
+resource "aws_alb_target_group_attachment" "application" {
+  count            = (local.ingress_enabled) * length(aws_instance.box)
+  target_group_arn = aws_alb_target_group.application[0].arn
+  target_id        = aws_instance.box[count.index].private_ip
+}
+
+resource "aws_alb_listener_rule" "applications" {
+  count        = local.ingress_enabled
+  listener_arn = var.base.ingress.listener.arn
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_alb_target_group.application[0].arn
+  }
+
+  condition {
+    field  = "host-header"
+    values = ["${var.application_name}.${var.base.domain_name}"]
+  }
+}
+
+# Allow ingress to talk to our primary port
+resource "aws_security_group_rule" "ingress" {
+  count                    = local.ingress_enabled
+  type                     = "ingress"
+  from_port                = var.application_ports[0]
+  to_port                  = var.application_ports[0]
+  protocol                 = "tcp"
+  source_security_group_id = var.base.ingress.security_group.id
+
+  security_group_id = aws_security_group.app.id
+}
diff --git a/instance/main.tf b/instance/main.tf
new file mode 100644
index 0000000..d19eb3b
--- /dev/null
+++ b/instance/main.tf
@@ -0,0 +1,116 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
+resource "aws_instance" "box" {
+  count         = var.instance_count
+  ami           = var.base.ami.id
+  instance_type = var.instance_size
+
+  iam_instance_profile = aws_iam_instance_profile.iam.name
+  user_data            = var.user_data != "" ? var.user_data : null
+  key_name             = var.base.ssh_key
+
+  associate_public_ip_address = false
+
+  #distribute instances across AZs, use element for wrap around support
+  subnet_id = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["teleport_nodes"].id,
+    var.base.security_groups["jumpbox_nodes"].id,
+    aws_security_group.app.id
+  ]
+
+  lifecycle {
+    ignore_changes        = [ami]
+    create_before_destroy = true
+  }
+
+  credit_specification {
+    cpu_credits = "unlimited"
+  }
+
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = var.volume_size
+    delete_on_termination = true
+  }
+
+  tags = {
+    Name      = "${var.application_name}-${count.index}"
+    app       = var.application_name
+    terraform = "true"
+    env       = var.base.env
+  }
+}
+
+# Convenient internal DNS name for other items in VPC to use if needed
+resource "aws_route53_record" "box" {
+  zone_id = var.base.vpc.internal_dns.zone_id
+  name    = var.application_name
+  type    = "CNAME"
+  ttl     = 30
+
+  records = aws_instance.box[*].private_dns
+}
+
+#######
+# Security group for application
+#######
+
+resource "aws_security_group" "app" {
+  name_prefix = "${var.application_name}-app-"
+  vpc_id      = var.base.vpc.id
+
+  tags = {
+    app       = var.application_name
+    terraform = "true"
+    env       = var.base.env
+  }
+}
+
+# Allow all outbound, e.g. third-pary API endpoints, by default
+resource "aws_security_group_rule" "egress" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.app.id
+}
+
+
+#####
+# Base IAM instance profile
+#####
+resource "aws_iam_instance_profile" "iam" {
+  name = "${var.base.env}-plain-instance-${var.application_name}"
+  role = aws_iam_role.iam.name
+}
+
+# Auth instance profile and roles
+resource "aws_iam_role" "iam" {
+  name = "${var.base.env}-plain-instance-${var.application_name}"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {"Service": "ec2.amazonaws.com"},
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+EOF
+
+}
+
+# Give it base teleport permissions
+resource "aws_iam_role_policy_attachment" "iam_teleport" {
+  role       = aws_iam_role.iam.name
+  policy_arn = "arn:aws:iam::${var.base.account.account_id}:policy/${var.base.env}/teleport/${var.base.env}-instance-teleport-secrets"
+}
+
diff --git a/instance/outputs.tf b/instance/outputs.tf
new file mode 100644
index 0000000..634fcf1
--- /dev/null
+++ b/instance/outputs.tf
@@ -0,0 +1,14 @@
+output "name" {
+  description = "name of the application this hosts"
+  value       = var.application_name
+}
+
+output "security_group" {
+  description = "object with the application-specific security group. defaults to unrestricted egress"
+  value       = aws_security_group.app
+}
+
+output "instance_iam_role" {
+  description = "IAM role name for attaching additional policies to the instance with aws_iam_role_policy_attachment"
+  value       = aws_iam_role.iam
+}
diff --git a/instance/variables.tf b/instance/variables.tf
new file mode 100644
index 0000000..9de652d
--- /dev/null
+++ b/instance/variables.tf
@@ -0,0 +1,50 @@
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
+}
+
+variable "application_name" {
+  type        = string
+  description = "name of the application to be hosted. will be used as the subdomain if exposed via ingress"
+}
+
+variable "instance_size" {
+  type        = string
+  description = "OPTIONAL: ec2 instance type to be used for hosting the app"
+  default     = "t3.micro"
+}
+
+variable "instance_count" {
+  type        = number
+  description = "OPTIONAL: number of instances to create"
+  default     = 1
+}
+
+variable "public" {
+  type        = bool
+  description = "OPTIONAL: whether or not to expose the application publicly"
+  default     = true
+}
+
+variable "application_ports" {
+  type        = list(number)
+  description = "OPTIONAL: ports on which the application will be listening. the first listed port will be used for health checks"
+  default     = [80]
+}
+
+variable "health_check_path" {
+  type        = string
+  description = "OPTIONAL: path used by load balancer to health check on the first application port. should return 200."
+  default     = "/"
+}
+
+variable "user_data" {
+  type        = string
+  description = "OPTIONAL: user data script to run on initialization"
+  default     = ""
+}
+
+variable "volume_size" {
+  type        = number
+  description = "OPTIONAL: Size in GB for the EBS volume"
+  default     = 20
+}
diff --git a/lambda_cron/data.tf b/lambda_cron/data.tf
deleted file mode 100644
index fa36e85..0000000
--- a/lambda_cron/data.tf
+++ /dev/null
@@ -1,24 +0,0 @@
-data "aws_s3_bucket" "releases" {
-  bucket = "${var.domain_name}-${var.env}-lambda-releases"
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
-}
-
diff --git a/lambda_cron/main.tf b/lambda_cron/main.tf
index 744b42b..ae62ca9 100644
--- a/lambda_cron/main.tf
+++ b/lambda_cron/main.tf
@@ -1,3 +1,7 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
 locals {
   handler = coalesce(var.handler, var.job_name)
 }
@@ -6,7 +10,7 @@ resource "aws_lambda_function" "job" {
   function_name = var.job_name
   description   = "Terraform-managed cron job for ${var.job_name} that invokes ${local.handler}"
 
-  s3_bucket = data.aws_s3_bucket.releases.id
+  s3_bucket = var.base.lambda_releases.id
   s3_key    = "${var.job_name}.zip"
 
   handler = local.handler
@@ -23,15 +27,15 @@ resource "aws_lambda_function" "job" {
   }
 
   // Encrypts any environment variables
-  kms_key_arn = data.aws_kms_alias.main.target_key_arn
+  kms_key_arn = var.base.key.arn
 
   vpc_config {
-    subnet_ids         = data.aws_subnet.application_subnet.*.id
+    subnet_ids         = var.base.vpc.application[*].id
     security_group_ids = [aws_security_group.job.id]
   }
 
   tags = {
-    terraform = "True"
+    terraform = "true"
     app       = var.job_name
     handler   = local.handler
     type      = "cron"
@@ -43,11 +47,11 @@ resource "aws_lambda_function" "job" {
 #####
 resource "aws_security_group" "job" {
   name_prefix = "${var.job_name}-"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
 
   tags = {
-    env       = var.env
-    terraform = "True"
+    env       = var.base.env
+    terraform = "true"
     app       = var.job_name
     name      = "cron-${var.job_name}"
   }
@@ -79,13 +83,13 @@ resource "aws_security_group_rule" "lb_egress" {
 # Cron job setup
 ######
 resource "aws_cloudwatch_event_rule" "crontab" {
-  name                = "crontab-${var.env}-${var.job_name}"
+  name                = "crontab-${var.base.env}-${var.job_name}"
   description         = "Terraform-managed crontab for firing ${var.job_name}"
   schedule_expression = "cron(${var.cron_expression})"
 }
 
 resource "aws_cloudwatch_event_target" "crontab" {
-  target_id = "propman_sync_lambda_target"
+  target_id = "${var.base.env}-${var.job_name}-sync_lambda_target"
   rule      = aws_cloudwatch_event_rule.crontab.name
   arn       = aws_lambda_function.job.arn
 }
@@ -104,7 +108,7 @@ resource "aws_lambda_permission" "allow_cloudwatch_to_call_crontab" {
 #####
 
 resource "aws_iam_role" "job" {
-  name = "cronjob-${var.env}-${var.job_name}"
+  name = "cronjob-${var.base.env}-${var.job_name}"
 
   assume_role_policy = <<EOF
 {
@@ -128,12 +132,12 @@ EOF
 # The helper uses the main shared key, provide your own by attaching to the output
 # role if you have a more restricted key used in Secrets Manager
 resource "aws_iam_role_policy_attachment" "basic_exec_role" {
-  role = aws_iam_role.job.name
+  role       = aws_iam_role.job.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
 resource "aws_iam_role_policy_attachment" "vpc_access" {
-  role = aws_iam_role.job.name
+  role       = aws_iam_role.job.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
 }
 
@@ -148,20 +152,20 @@ data "aws_iam_policy_document" "secrets" {
 }
 
 resource "aws_iam_policy" "secrets" {
-  name = "${var.env}-${var.job_name}-secrets"
-  path = "/${var.env}/${var.job_name}/"
+  name   = "${var.base.env}-${var.job_name}-secrets"
+  path   = "/${var.base.env}/${var.job_name}/"
   policy = data.aws_iam_policy_document.secrets.json
 }
 
 resource "aws_iam_role_policy_attachment" "secrets" {
-  role = aws_iam_role.job.name
+  role       = aws_iam_role.job.name
   policy_arn = aws_iam_policy.secrets.arn
 }
 
 # Use of the shared KMS key for secrets decryption
 resource "aws_iam_policy" "shared_key_access" {
-  name = "${var.env}-${var.job_name}-key-access"
-  path = "/${var.env}/${var.job_name}/"
+  name        = "${var.base.env}-${var.job_name}-key-access"
+  path        = "/${var.base.env}/${var.job_name}/"
   description = "Allows function to use main KMS key for environment"
 
   policy = <<EOF
@@ -171,7 +175,7 @@ resource "aws_iam_policy" "shared_key_access" {
         {
             "Effect": "Allow",
             "Action": "kms:Decrypt",
-            "Resource": "${data.aws_kms_alias.main.target_key_arn}"
+            "Resource": "${var.base.key.arn}"
         }
     ]
 }
@@ -180,14 +184,6 @@ EOF
 }
 
 resource "aws_iam_role_policy_attachment" "shared_key_access" {
-role       = aws_iam_role.job.name
-policy_arn = aws_iam_policy.shared_key_access.arn
+  role       = aws_iam_role.job.name
+  policy_arn = aws_iam_policy.shared_key_access.arn
 }
-
-resource "aws_kms_grant" "primary" {
-name              = "${var.env}-cron-${var.job_name}"
-key_id            = data.aws_kms_alias.main.target_key_arn
-grantee_principal = aws_iam_role.job.arn
-operations        = ["Decrypt"]
-}
-
diff --git a/lambda_cron/outputs.tf b/lambda_cron/outputs.tf
index d3f73d0..f8bc719 100644
--- a/lambda_cron/outputs.tf
+++ b/lambda_cron/outputs.tf
@@ -1,5 +1,5 @@
 output "job_iam_role" {
   description = "IAM role name for attaching additional policies to the lambda function with aws_iam_role_policy_attachment"
-  value       = aws_iam_role.job.name
+  value       = aws_iam_role.job
 }
 
diff --git a/lambda_cron/variables.tf b/lambda_cron/variables.tf
index 3559b75..6ae1458 100644
--- a/lambda_cron/variables.tf
+++ b/lambda_cron/variables.tf
@@ -1,32 +1,33 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "object describing the outputs of the base module"
 }
 
 variable "job_name" {
+  type        = string
   description = "name of the job to be run. must be unique in the environment."
 }
 
 variable "cron_expression" {
+  type        = string
   description = "cron schedule expression. For example, \"0 12 * * ? *\" for daily at noon UTC. https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#CronExpressions"
 }
 
 variable "runtime" {
+  type        = string
   description = "OPTIONAL: which lambda runtime to use to invoke the function. Defaults to Go 1.x"
   default     = "go1.x"
 }
 
 variable "handler" {
+  type        = string
   description = "OPTIONAL: name of the handler for the lambda. Defaults to job_name"
   default     = ""
 }
 
 variable "memory_size" {
+  type        = number
   description = "OPTIONAL: memory to allocate to the lambda function. Defaults to 1024mb"
-  default     = "1024"
+  default     = 1024
 }
 
 variable "env_vars" {
diff --git a/lambda_cron/versions.tf b/lambda_cron/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/lambda_cron/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/main.tf b/main.tf
index 5d5fab2..fad5bd1 100644
--- a/main.tf
+++ b/main.tf
@@ -1,8 +1,16 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
+resource "aws_ebs_encryption_by_default" "on" {
+  enabled = true
+}
+
 module "vpc" {
   source = "./vpc"
 
   env  = var.env
-  cidr = var.cidr
+  cidr = var.cidr_block
 }
 
 #####
@@ -19,10 +27,31 @@ module "wildcard" {
   source = "./wildcard_cert"
 
   env         = var.env
-  root_domain = var.domain_name
-  domain      = var.domain_name
+  domain_name = var.domain_name
+  primary     = var.primary
 }
 
+module "ingress" {
+  source = "./ingress"
+
+  env         = var.env
+  domain_name = var.domain_name
+  public      = var.public_ingress
+  cidr_block  = var.cidr_block
+  vpc_id      = module.vpc.id
+  subnet_ids = {
+    application = module.vpc.application[*].id
+    public      = module.vpc.public[*].id
+  }
+  internal_dns = module.vpc.internal_dns
+  external_dns = data.aws_route53_zone.external
+  wildcard_arn = module.wildcard.arn
+}
+
+#####
+# Singleton resources referenced by child modules
+####
+
 resource "aws_s3_bucket" "lambda_releases" {
   bucket = "${var.domain_name}-${var.env}-lambda-releases"
   acl    = "private"
@@ -32,22 +61,40 @@ resource "aws_s3_bucket" "lambda_releases" {
   }
 
   tags = {
-    env         = var.env
-    domain_name = var.domain_name
-    terraform   = "True"
-    app         = "lambda-releases"
+    env       = var.env
+    terraform = "true"
+    app       = "lambda-releases"
   }
 }
 
-resource "aws_security_group" "jumpbox" {
-  name_prefix = "jumpbox-"
-  vpc_id      = module.vpc.id
+### Shared IAM role for instances running teleport
+resource "aws_iam_policy" "teleport_secrets" {
+  name        = "${var.env}-instance-teleport-secrets"
+  path        = "/${var.env}/teleport/"
+  description = "Allows nodes to run local teleport daemon"
+
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect" : "Allow",
+            "Action" : "ec2:DescribeTags",
+            "Resource" : "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": "secretsmanager:GetSecretValue",
+            "Resource": "${data.aws_secretsmanager_secret.cluster_token.arn}"
+        },
+        {
+            "Effect": "Allow",
+            "Action": "kms:Decrypt",
+            "Resource": "${module.encryptkey.arn}"
+        }
+    ]
+}
+EOF
 
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = "utilities"
-    Name      = "jumpbox"
-  }
 }
 
diff --git a/outputs.tf b/outputs.tf
index dedaf17..eba0511 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,5 +1,67 @@
-output "key_arn" {
-  description = "ARN of the primary encryption key tied to this environment"
-  value       = module.encryptkey.key_arn
+output "env" {
+  description = "name of the environment that we are creating"
+  value       = var.env
 }
 
+output "domain_name" {
+  description = "domain name we are using for resources hosted in this environment"
+  value       = var.domain_name
+}
+output "external" {
+  description = "object of the route53 zone for public DNS"
+  value       = data.aws_route53_zone.external
+}
+output "account" {
+  description = "account number of the current targeted AWS account"
+  value       = data.aws_caller_identity.current
+}
+
+output "ami" {
+  description = "custom ami base for the VPC"
+  value       = data.aws_ami.base
+}
+
+output "region" {
+  description = "current aws region"
+  value       = data.aws_region.current
+}
+
+output "vpc" {
+  description = "an object with the outputs of the vpc module"
+  value       = module.vpc
+}
+
+output "key" {
+  description = "the primary encryption key tied to this environment"
+  value       = module.encryptkey
+}
+
+output "ssh_key" {
+  description = "default ssh key pair to use for jumpbox and application instances"
+  value       = var.ssh_key
+}
+
+output "wildcard" {
+  description = "wildcard certificate for the primary domain_name"
+  value       = module.wildcard
+}
+
+output "ingress" {
+  description = "an ALB for applications to connect to in order to receive public traffic"
+  value       = module.ingress
+}
+
+output "security_groups" {
+  description = "a map of names to security groups that are shared throughout the vpc"
+  value = {
+    "teleport_proxies" = aws_security_group.teleport_proxies
+    "teleport_nodes"   = aws_security_group.teleport_nodes
+    "jumpbox"          = aws_security_group.jumpbox
+    "jumpbox_nodes"    = aws_security_group.jumpbox_nodes
+  }
+}
+
+output "lambda_releases" {
+  description = "object for the S3 bucket to hold lambda function release zips"
+  value       = aws_s3_bucket.lambda_releases
+}
diff --git a/plain_instance/data.tf b/plain_instance/data.tf
deleted file mode 100644
index 9e5a320..0000000
--- a/plain_instance/data.tf
+++ /dev/null
@@ -1,57 +0,0 @@
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_caller_identity" "current" {
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_security_group" "ssh_proxies" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "teleport"
-    Name = "teleport-proxies"
-  }
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_secretsmanager_secret" "cluster_token" {
-  name = "${var.env}/teleport/cluster_token"
-}
-
-data "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
-}
-
diff --git a/plain_instance/main.tf b/plain_instance/main.tf
deleted file mode 100644
index 31afd32..0000000
--- a/plain_instance/main.tf
+++ /dev/null
@@ -1,107 +0,0 @@
-module "base" {
-  source = "../app_base"
-
-  env               = var.env
-  domain_name       = var.domain_name
-  application_name  = var.application_name
-  application_port  = var.application_port
-  loadbalancer_port = var.loadbalancer_port
-}
-
-resource "aws_instance" "application" {
-  count         = var.instance_count
-  ami           = data.aws_ami.base.id
-  instance_type = var.instance_size
-
-  iam_instance_profile = aws_iam_instance_profile.iam.name
-  user_data            = var.user_data
-  key_name             = var.key_pair
-
-  associate_public_ip_address = false
-
-  #distribute instances across AZs
-  subnet_id              = element(data.aws_subnet.application_subnet.*.id, count.index)
-  vpc_security_group_ids = [module.base.app_sg_id]
-
-  lifecycle {
-    ignore_changes = [ami]
-  }
-
-  credit_specification {
-    cpu_credits = "unlimited"
-  }
-
-  tags = {
-    Name = "${var.application_name}-${count.index}"
-    app  = var.application_name
-    env  = var.env
-  }
-}
-
-resource "aws_alb_target_group_attachment" "application_targets" {
-  count            = var.instance_count
-  target_group_arn = module.base.lb_tg_arn
-  target_id        = element(aws_instance.application.*.private_ip, count.index)
-}
-
-# Add rule to allow SSH proxies to connect
-resource "aws_security_group_rule" "proxy_ssh" {
-  type                     = "ingress"
-  from_port                = 3022
-  to_port                  = 3022
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.ssh_proxies.id
-
-  security_group_id = module.base.app_sg_id
-}
-
-resource "aws_security_group_rule" "jumpbox" {
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = module.base.app_sg_id
-}
-
-#####
-# Base IAM instance profile
-#####
-resource "aws_iam_instance_profile" "iam" {
-  name = "${var.env}-plain-instance"
-  role = aws_iam_role.iam.name
-}
-
-# Auth instance profile and roles
-resource "aws_iam_role" "iam" {
-  name = "${var.env}-plain-instance"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {"Service": "ec2.amazonaws.com"},
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-
-}
-
-# Give it base teleport permissions
-resource "aws_iam_role_policy_attachment" "iam_teleport" {
-  role = aws_iam_role.iam.name
-  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.env}/teleport/${var.env}-instance-teleport-secrets"
-}
-
-resource "aws_kms_grant" "main" {
-  name = "${var.env}-${var.application_name}-main"
-  key_id = data.aws_kms_alias.main.target_key_arn
-  grantee_principal = aws_iam_role.iam.arn
-  operations = ["Decrypt"]
-}
-
diff --git a/plain_instance/outputs.tf b/plain_instance/outputs.tf
deleted file mode 100644
index 7f35bb8..0000000
--- a/plain_instance/outputs.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-output "app_sg_id" {
-  value = module.base.app_sg_id
-}
-
-output "instance_iam_role" {
-  description = "IAM role name for attaching additional policies to the instance with aws_iam_role_policy_attachment"
-  value       = aws_iam_role.iam.name
-}
-
diff --git a/plain_instance/variables.tf b/plain_instance/variables.tf
deleted file mode 100644
index 6ceb2d0..0000000
--- a/plain_instance/variables.tf
+++ /dev/null
@@ -1,42 +0,0 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
-}
-
-variable "application_name" {
-  description = "name of the application to be hosted. must be unique in the environment."
-}
-
-variable "instance_size" {
-  description = "OPTIONAL: ec2 instance type to be used for hosting the app"
-  default     = "t3.micro"
-}
-
-variable "instance_count" {
-  description = "OPTIONAL: number of instances to create"
-  default     = "1"
-}
-
-variable "application_port" {
-  description = "OPTIONAL: port on which the application will be listening."
-  default     = "80"
-}
-
-variable "loadbalancer_port" {
-  description = "OPTIONAL: port on which the load balancer will be listening. it will terminate TLS on this port."
-  default     = "443"
-}
-
-variable "key_pair" {
-  description = "OPTIONAL: name of key pair to use with optional SSH jumpbox"
-  default     = "infrastructure"
-}
-
-variable "user_data" {
-  description = "OPTIONAL: user data script to run on initialization"
-  default     = ""
-}
-
diff --git a/plain_instance/versions.tf b/plain_instance/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/plain_instance/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/security_groups.tf b/security_groups.tf
new file mode 100644
index 0000000..f19a92d
--- /dev/null
+++ b/security_groups.tf
@@ -0,0 +1,144 @@
+
+#######
+# Security group for teleport proxy instances
+#######
+
+resource "aws_security_group" "teleport_proxies" {
+  name_prefix = "tp-proxies-"
+  vpc_id      = module.vpc.id
+
+  tags = {
+    env       = var.env
+    terraform = "true"
+    app       = "teleport"
+    Name      = "teleport-proxies"
+  }
+}
+
+resource "aws_security_group_rule" "proxy_webui" {
+  type        = "ingress"
+  from_port   = 3080
+  to_port     = 3080
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.teleport_proxies.id
+}
+
+resource "aws_security_group_rule" "proxy_ssh" {
+  type        = "ingress"
+  from_port   = 3023
+  to_port     = 3023
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.teleport_proxies.id
+}
+
+resource "aws_security_group_rule" "proxy_cluster" {
+  type        = "ingress"
+  from_port   = 3024
+  to_port     = 3024
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.teleport_proxies.id
+}
+# Must allow talking to the world to call out to AWS APIs
+resource "aws_security_group_rule" "proxy_egress" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.teleport_proxies.id
+}
+
+#######
+# Security group for teleport nodes 
+#######
+
+resource "aws_security_group" "teleport_nodes" {
+  name_prefix = "tp-nodes-"
+  vpc_id      = module.vpc.id
+
+  tags = {
+    env       = var.env
+    terraform = "true"
+    app       = "teleport"
+    Name      = "teleport-nodes"
+  }
+}
+
+# Must allow talking to the world to call out to AWS APIs
+resource "aws_security_group_rule" "proxy_to_nodes" {
+  type                     = "ingress"
+  from_port                = 3022
+  to_port                  = 3022
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.teleport_proxies.id
+
+  security_group_id = aws_security_group.teleport_nodes.id
+}
+
+#######
+# Security group for jumpbox to access the nodes 
+#######
+
+resource "aws_security_group" "jumpbox" {
+  name_prefix = "jumpbox-"
+  vpc_id      = module.vpc.id
+
+  tags = {
+    env       = var.env
+    terraform = "true"
+    app       = "utilities"
+    Name      = "jumpbox"
+  }
+}
+
+resource "aws_security_group_rule" "jumpbox_ssh" {
+  type        = "ingress"
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.jumpbox.id
+}
+
+resource "aws_security_group_rule" "jump_into_vpc" {
+  type        = "egress"
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = [module.vpc.cidr_block]
+
+  security_group_id = aws_security_group.jumpbox.id
+}
+
+#######
+# Security group for jumpbox to access the nodes 
+#######
+
+resource "aws_security_group" "jumpbox_nodes" {
+  name_prefix = "jumpbox-nodes-"
+  vpc_id      = module.vpc.id
+
+  tags = {
+    env       = var.env
+    terraform = "true"
+    app       = "utilities"
+    Name      = "jumpbox-nodes"
+  }
+}
+resource "aws_security_group_rule" "jumpbox_to_nodes" {
+  type                     = "ingress"
+  from_port                = 22
+  to_port                  = 22
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.jumpbox.id
+
+  security_group_id = aws_security_group.jumpbox_nodes.id
+}
diff --git a/static_site/data.tf b/static_site/data.tf
deleted file mode 100644
index 4fa087b..0000000
--- a/static_site/data.tf
+++ /dev/null
@@ -1,11 +0,0 @@
-# Pull in data from outside terraform (the public zone and certificate must already exist in the account)
-data "aws_route53_zone" "domain" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_acm_certificate" "wildcard" {
-  domain      = var.domain_name
-  most_recent = true
-}
-
diff --git a/static_site/main.tf b/static_site/main.tf
deleted file mode 100644
index 650747e..0000000
--- a/static_site/main.tf
+++ /dev/null
@@ -1,186 +0,0 @@
-####
-# Main infrastructure to host a static website
-####
-
-# Setup DNS records for the static site
-
-resource "aws_route53_record" "subdomain" {
-  zone_id = data.aws_route53_zone.domain.zone_id
-  name    = var.subdomain
-  type    = "CNAME"
-  ttl     = "300"
-
-  records = [aws_cloudfront_distribution.s3_distribution.domain_name]
-}
-
-# # If we're setting, www (e.g., www.example.com) then also direct the apex domain (example.com)
-resource "aws_route53_record" "apex_domain" {
-  count   = var.subdomain == "www" ? 1 : 0
-  zone_id = data.aws_route53_zone.domain.zone_id
-  name    = ""
-  type    = "A"
-
-  alias {
-    name                   = aws_cloudfront_distribution.s3_distribution.domain_name
-    zone_id                = aws_cloudfront_distribution.s3_distribution.hosted_zone_id
-    evaluate_target_health = false
-  }
-}
-
-# Create bucket to host the content
-
-resource "aws_s3_bucket" "site_content_bucket" {
-  bucket = "${var.subdomain}.${var.domain_name}"
-  acl    = "public-read"
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "Stmt1516660482311",
-      "Effect": "Allow",
-      "Principal": "*",
-      "Action": [
-        "s3:GetObject"
-      ],
-      "Resource": [
-        "arn:aws:s3:::${var.subdomain}.${var.domain_name}/*"
-      ]
-    }
-  ]
-}
-POLICY
-
-
-  # Serve index.html on errors to support client side routing, e.g. React Router
-  website {
-    index_document = "index.html"
-    error_document = "index.html"
-  }
-
-  tags = {
-    env = var.env
-    terraform = "true"
-    name = "${var.subdomain}.${var.domain_name}"
-  }
-}
-
-# Create CDN to serve the content and terminate TLS
-
-resource "aws_cloudfront_distribution" "s3_distribution" {
-  origin {
-    domain_name = aws_s3_bucket.site_content_bucket.bucket_domain_name
-    origin_id = "${var.subdomain}-${var.domain_name}"
-  }
-
-  enabled = true
-  default_root_object = "index.html"
-
-  aliases = ["${var.subdomain}.${var.domain_name}"]
-
-  # Serve index.html on errors to support client side routing, e.g. React Router
-  custom_error_response {
-    error_code = 403
-    response_code = 200
-    response_page_path = "/index.html"
-  }
-
-  custom_error_response {
-    error_code = 404
-    response_code = 200
-    response_page_path = "/index.html"
-  }
-
-  default_cache_behavior {
-    allowed_methods = ["GET", "HEAD", "OPTIONS"]
-    cached_methods = ["GET", "HEAD"]
-    target_origin_id = "${var.subdomain}-${var.domain_name}"
-
-    # Use gzip compression
-    compress = true
-
-    forwarded_values {
-      query_string = false
-
-      cookies {
-        forward = "none"
-      }
-    }
-
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl = 0
-    default_ttl = 60
-    max_ttl = 60
-  }
-
-  viewer_certificate {
-    acm_certificate_arn = data.aws_acm_certificate.wildcard.arn
-    ssl_support_method = "sni-only"
-  }
-
-  restrictions {
-    geo_restriction {
-      restriction_type = "none"
-    }
-  }
-
-  tags = {
-    env = var.env
-    terraform = "true"
-    name = "cdn-${var.subdomain}.${var.domain_name}"
-  }
-}
-
-####
-# Create preview site to hold builds of PRs
-####
-
-resource "aws_route53_record" "preview" {
-  zone_id = data.aws_route53_zone.domain.zone_id
-  name = "preview.${var.subdomain}"
-  type = "CNAME"
-  ttl = "300"
-
-  records = [aws_s3_bucket.preview.website_endpoint]
-}
-
-# Create bucket to host the content
-
-resource "aws_s3_bucket" "preview" {
-  bucket = "preview.${var.subdomain}.${var.domain_name}"
-  acl = "public-read"
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "Stmt1516660482311",
-      "Effect": "Allow",
-      "Principal": "*",
-      "Action": [
-        "s3:GetObject"
-      ],
-      "Resource": [
-        "arn:aws:s3:::preview.${var.subdomain}.${var.domain_name}/*"
-      ]
-    }
-  ]
-}
-POLICY
-
-
-# Serve index.html on errors to support client side routing, e.g. React Router
-website {
-index_document = "index.html"
-error_document = "index.html"
-}
-
-tags = {
-env       = var.env
-terraform = "true"
-name      = "preview.${var.subdomain}.${var.domain_name}"
-}
-}
-
diff --git a/static_site/variables.tf b/static_site/variables.tf
deleted file mode 100644
index 7ea19de..0000000
--- a/static_site/variables.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "subdomain" {
-  default = "www"
-}
-
-variable "domain_name" {
-  default = ""
-}
-
diff --git a/static_site/versions.tf b/static_site/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/static_site/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/test/all.tf b/test/all.tf
index 8ef36c7..b1851bd 100644
--- a/test/all.tf
+++ b/test/all.tf
@@ -6,9 +6,13 @@ variable "region" {
   default = "us-east-1"
 }
 
+terraform {
+  required_version = ">= 0.12"
+}
+
 provider "aws" {
   region  = var.region
-  version = "~> 2.13.0"
+  version = "~> 2.19.0"
 }
 
 locals {
@@ -16,7 +20,7 @@ locals {
   domain_name = "example.com"
 }
 
-module "base" {
+module "dev" {
   source = "../"
 
   env         = local.env
@@ -26,61 +30,73 @@ module "base" {
 module "utilities" {
   source = "../utilities"
 
-  env         = local.env
-  domain_name = local.domain_name
-}
-
-module "ingress" {
-  source = "../ingress"
-
-  env         = local.env
-  domain_name = local.domain_name
+  base = module.dev
 }
 
 module "static" {
-  source = "../static_site"
+  source = "../cdn_site"
 
-  env         = local.env
-  domain_name = local.domain_name
-  subdomain   = "pizza"
+  base      = module.dev
+  subdomain = "pizza"
 }
 
 module "demo" {
-  source = "../plain_instance"
+  source = "../instance"
 
-  env              = local.env
-  domain_name      = local.domain_name
+  base             = module.dev
   application_name = "demo"
 }
 
+module "postgres" {
+  source = "../database"
+
+  base        = module.dev
+  application = module.demo
+  password    = "neverdothis"
+}
+
 module "fargate" {
   source = "../fargate_cluster"
 
-  env              = local.env
-  domain_name      = local.domain_name
+  base             = module.dev
   application_name = "web"
   docker_image     = "nginx:latest"
+  environment_variables = [
+    {
+      "name"  = "DB_USER"
+      "value" = "something"
+    },
+    {
+      "name"  = "ENVIRONMENT"
+      "value" = "development"
+    },
+  ]
+  secrets = [
+    {
+      "name"      = "DB_PASSWORD"
+      "valueFrom" = "arn:aws:secretsmanager:region:${var.region}::secret:dev/db_password-v4GYs6"
+    },
+    {
+      "name"      = "API_KEY"
+      "valueFrom" = "arn:aws:secretsmanager:region:${var.region}::secret:dev/api_key-v4GYs7"
+    },
+  ]
 }
 
-variable "db_password" {
-  description = "Normally this would be left blank"
-  default     = "neverdothis"
-}
-
-module "postgres" {
-  source = "../database"
+module "console" {
+  source = "../command_console"
 
-  env              = local.env
-  application_name = "demo"
-  app_sg           = module.demo.app_sg_id
-  password         = "{$var.db_password}"
+  base            = module.dev
+  fargate_cluster = module.fargate
+  database        = module.postgres
 }
 
+
 module "lambda_cron" {
+
   source = "../lambda_cron"
 
-  env             = local.env
-  domain_name     = local.domain_name
+  base            = module.dev
   job_name        = "crontab"
   cron_expression = "* * ? * * *"
 
@@ -98,15 +114,30 @@ module "lambda_cron" {
 module "production" {
   source = "../"
 
-  env         = "prod"
-  domain_name = local.domain_name
+  env            = "prod"
+  domain_name    = local.domain_name
+  public_ingress = false
+  primary        = false
+}
+
+module "ingress_nginx" {
+  source = "../ingress_nginx"
+
+  base = module.production
 }
 
+module "demo_asg" {
+  source = "../autoscaling"
+
+  base             = module.production
+  application_name = "asg"
+}
+
+
 module "teleport_subcluster" {
   source = "../utilities/teleport_subcluster"
 
-  env          = "prod"
-  domain_name  = local.domain_name
+  base         = module.production
   main_cluster = local.env
 }
 
diff --git a/test/versions.tf b/test/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/test/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/utilities/jenkins/data.tf b/utilities/jenkins/data.tf
index 8dd3b15..eaefffd 100644
--- a/utilities/jenkins/data.tf
+++ b/utilities/jenkins/data.tf
@@ -1,89 +1,19 @@
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_subnet" "public_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "public-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_route53_zone" "external" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_route53_zone" "internal" {
-  name         = "${var.env}.local"
-  private_zone = true
-}
-
-data "aws_acm_certificate" "wildcard" {
-  domain      = var.domain_name
-  most_recent = true
-}
-
-data "aws_secretsmanager_secret" "cluster_token" {
-  name = "${var.env}/teleport/cluster_token"
-}
-
 data "aws_secretsmanager_secret_version" "github_client_id" {
-  secret_id = "${var.env}/jenkins/github_client_id"
+  secret_id = "${var.base.env}/jenkins/github_client_id"
 }
 
 data "aws_secretsmanager_secret_version" "github_client_secret" {
-  secret_id = "${var.env}/jenkins/github_client_secret"
+  secret_id = "${var.base.env}/jenkins/github_client_secret"
 }
 
 data "aws_secretsmanager_secret_version" "github_password" {
-  secret_id = "${var.env}/jenkins/github_password"
+  secret_id = "${var.base.env}/jenkins/github_password"
 }
 
 data "aws_secretsmanager_secret_version" "slack_token" {
-  secret_id = "${var.env}/jenkins/slack_token"
+  secret_id = "${var.base.env}/jenkins/slack_token"
 }
 
 data "aws_secretsmanager_secret_version" "docker_password" {
-  secret_id = "${var.env}/jenkins/docker_password"
-}
-
-data "aws_kms_alias" "main" {
-  name = "alias/${var.env}-main"
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
+  secret_id = "${var.base.env}/jenkins/docker_password"
 }
-
diff --git a/utilities/jenkins/main.tf b/utilities/jenkins/main.tf
index 259b82f..64ecb09 100644
--- a/utilities/jenkins/main.tf
+++ b/utilities/jenkins/main.tf
@@ -2,321 +2,103 @@
 # ALB that provides the public front for Jenkins
 # It terminates TLS and redirects HTTP to HTTPS for secure access.
 #######
-
-locals {
-  url = "jenkins.${var.domain_name}"
-}
-
-resource "aws_alb" "jenkins" {
-  name            = "jenkins-load-balancer"
-  internal        = false
-  security_groups = [aws_security_group.alb.id]
-  subnets         = data.aws_subnet.public_subnet.*.id
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    Name      = "jenkins-load-balancer"
-    app       = "jenkins"
-  }
-}
-
-resource "aws_alb_target_group" "primary" {
-  name     = "alb-jenkins-target"
-  vpc_id   = data.aws_vpc.vpc.id
-  port     = "8080"
-  protocol = "HTTP"
-
-  health_check {
-    path                = "/login"
-    port                = "8080"
-    protocol            = "HTTP"
-    healthy_threshold   = 2
-    unhealthy_threshold = 2
-    interval            = 5
-    timeout             = 4
-    matcher             = "200-308"
-  }
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    Name      = "jenkins-load-balancer"
-    app       = "jenkins"
-  }
-}
-
-resource "aws_lb_listener" "redirect_to_https" {
-  load_balancer_arn = aws_alb.jenkins.arn
-  port              = "80"
-  protocol          = "HTTP"
-
-  default_action {
-    type = "redirect"
-
-    redirect {
-      port        = "443"
-      protocol    = "HTTPS"
-      status_code = "HTTP_301"
-    }
-  }
-}
-
-# Assign domain name
-resource "aws_route53_record" "alb" {
-  zone_id = data.aws_route53_zone.external.id
-  name    = local.url
-  type    = "CNAME"
-  ttl     = 30
-
-  records = [aws_alb.jenkins.dns_name]
-}
-
-resource "aws_alb_listener" "https" {
-  load_balancer_arn = aws_alb.jenkins.arn
-  port              = "443"
-  protocol          = "HTTPS"
-  ssl_policy        = "ELBSecurityPolicy-2016-08"
-  certificate_arn   = data.aws_acm_certificate.wildcard.arn
-
-  default_action {
-    target_group_arn = aws_alb_target_group.primary.arn
-    type             = "forward"
-  }
-}
-
-# Security group
-resource "aws_security_group" "alb" {
-  name_prefix = "$jenkins-alb-"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  tags = {
-    env       = var.env
-    terraform = "true"
-    app       = "jenkins"
-    role      = "alb"
-  }
-}
-
-resource "aws_security_group_rule" "alb_tls" {
-  type        = "ingress"
-  from_port   = 443
-  to_port     = 443
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.alb.id
-}
-
-resource "aws_security_group_rule" "alb_http" {
-  type        = "ingress"
-  from_port   = 80
-  to_port     = 80
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.alb.id
+terraform {
+  required_version = ">= 0.12"
 }
 
-resource "aws_security_group_rule" "alb_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.alb.id
+locals {
+  url = "jenkins.${var.base.domain_name}"
 }
 
 #######
-### Jenkins primary instance that hosts Web UI
+# Jenkins primary instance that hosts Web UI
 #######
-
-resource "aws_instance" "jenkins_primary" {
-  ami           = data.aws_ami.base.id
-  instance_type = "t3.small"
-  key_name      = "infrastructure"
-
-  associate_public_ip_address = false
-  subnet_id                   = data.aws_subnet.application_subnet[1].id
-  vpc_security_group_ids      = [aws_security_group.jenkins_primary.id]
-
-  iam_instance_profile = aws_iam_instance_profile.primary.name
-
-  user_data = <<-EOF
-              #!/usr/bin/env bash
-              docker run -d --restart always \
-                -v jenkins_home:/var/jenkins_home \
-                --name jenkins \
-                -p 8080:8080 \
-                -p 50000:50000 \
-                -e github_client_id="${data.aws_secretsmanager_secret_version.github_client_id.secret_string}" \
-                -e github_client_secret="${data.aws_secretsmanager_secret_version.github_client_secret.secret_string}" \
-                -e jenkins_url="https://${local.url}" \
-                -e github_user="${var.github_user}" \
-                -e github_password="${data.aws_secretsmanager_secret_version.github_password.secret_string}" \
-                -e docker_user="${var.docker_user}" \
-                -e docker_password="${data.aws_secretsmanager_secret_version.docker_password.secret_string}" \
-                -e slack_token="${data.aws_secretsmanager_secret_version.slack_token.secret_string}" \
-                ${var.jenkins_image}
-EOF
-
-
-  root_block_device {
-    volume_type = "gp2"
-    volume_size = 20
-    delete_on_termination = true
-  }
-
-  lifecycle {
-    ignore_changes = [ami]
-  }
-
-  tags = {
-    env = var.env
-    terraform = "true"
-    Name = "jenkins-primary"
-    app = "jenkins"
-    role = "primary"
-  }
-}
-
-# Convenient internal DNS name for other items in VPC to use if needed
-resource "aws_route53_record" "primary" {
-  zone_id = data.aws_route53_zone.internal.id
-  name = "primary.jenkins"
-  type = "CNAME"
-  ttl = 30
-
-  records = [aws_instance.jenkins_primary.private_dns]
-}
-
-resource "aws_lb_target_group_attachment" "primary" {
-  target_group_arn = aws_alb_target_group.primary.arn
-  target_id = aws_instance.jenkins_primary.id
-  port = 8080
-}
-
-resource "aws_security_group" "jenkins_primary" {
-  name_prefix = "$jenkins-primary-"
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env = var.env
-    terraform = "true"
-    app = "jenkins"
-    role = "primary"
-  }
-}
-
-resource "aws_security_group_rule" "primary_proxy_ssh" {
-  type = "ingress"
-  from_port = 3022
-  to_port = 3022
-  protocol = "tcp"
-  source_security_group_id = var.ssh_proxy_sg
-
-  security_group_id = aws_security_group.jenkins_primary.id
-}
-
-resource "aws_security_group_rule" "primary_ssh_ingress" {
-  type = "ingress"
-  from_port = 22
-  to_port = 22
-  protocol = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.jenkins_primary.id
-}
-
-resource "aws_security_group_rule" "alb_to_primary" {
-  type = "ingress"
-  from_port = 8080
-  to_port = 8080
-  protocol = "tcp"
-  source_security_group_id = aws_security_group.alb.id
-
-  security_group_id = aws_security_group.jenkins_primary.id
-}
-
-resource "aws_security_group_rule" "worker_to_primary_http" {
-  type = "ingress"
-  from_port = 8080
-  to_port = 8080
-  protocol = "tcp"
-  source_security_group_id = aws_security_group.jenkins_worker.id
-
-  security_group_id = aws_security_group.jenkins_primary.id
+module "primary" {
+  source = "../../instance"
+
+  base              = var.base
+  instance_size     = "t3.small"
+  application_name  = "jenkins"
+  application_ports = [8080]
+  health_check_path = "/login"
+  user_data = templatefile("${path.module}/primary.tmpl", {
+    github_client_id     = "${data.aws_secretsmanager_secret_version.github_client_id.secret_string}"
+    github_client_secret = "${data.aws_secretsmanager_secret_version.github_client_secret.secret_string}"
+    jenkins_url          = "https://${local.url}"
+    github_user          = "${var.github_user}"
+    github_password      = "${data.aws_secretsmanager_secret_version.github_password.secret_string}"
+    docker_user          = "${var.docker_user}"
+    docker_password      = "${data.aws_secretsmanager_secret_version.docker_password.secret_string}"
+    slack_token          = "${data.aws_secretsmanager_secret_version.slack_token.secret_string}"
+    jenkins_image        = "adhocteam/jenkins:${var.image_tag}"
+  })
 }
 
 resource "aws_security_group_rule" "worker_to_primary_jnlp" {
-  type = "ingress"
-  from_port = 50000
-  to_port = 50000
-  protocol = "tcp"
-  source_security_group_id = aws_security_group.jenkins_worker.id
+  type                     = "ingress"
+  from_port                = 50000
+  to_port                  = 50000
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.worker.id
 
-  security_group_id = aws_security_group.jenkins_primary.id
+  security_group_id = module.primary.security_group.id
 }
 
-resource "aws_security_group_rule" "primary_egress" {
-  type = "egress"
-  from_port = 0
-  to_port = 0
-  protocol = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
+resource "aws_security_group_rule" "worker_to_primary_web" {
+  type                     = "ingress"
+  from_port                = 8080
+  to_port                  = 8080
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.worker.id
 
-  security_group_id = aws_security_group.jenkins_primary.id
+  security_group_id = module.primary.security_group.id
 }
 
 #######
 ### Jenkins workers who actually execute the work
 #######
 
-data "template_file" "jenkins_worker" {
-  count = length(var.workers)
-  template = file("${path.module}/worker.tmpl")
-
-  vars = {
-    count = count.index
-    master = "http://${aws_route53_record.primary.fqdn}:8080"
-    label = element(split(",", element(var.workers, count.index)), 0)
-    username = var.github_user
-    password = data.aws_secretsmanager_secret_version.github_password.secret_string
-    executors = element(split(",", element(var.workers, count.index)), 2)
-  }
-}
-
+# Can't use the module because we have to vary the instance types
 resource "aws_instance" "jenkins_worker" {
-  count = length(var.workers)
-  ami = data.aws_ami.base.id
-  instance_type = element(split(",", element(var.workers, count.index)), 1)
-  key_name = "infrastructure"
+  count         = length(var.workers)
+  ami           = var.base.ami.id
+  instance_type = var.workers[count.index].instance_type
+  key_name      = var.base.ssh_key
 
   iam_instance_profile = aws_iam_instance_profile.worker.name
-  user_data = element(data.template_file.jenkins_worker.*.rendered, count.index)
+
+  user_data = templatefile("${path.module}/worker.tmpl", {
+    count     = count.index
+    master    = "http://jenkins.${var.base.vpc.internal_dns.name}:8080"
+    label     = var.workers[count.index].label
+    username  = var.github_user
+    password  = data.aws_secretsmanager_secret_version.github_password.secret_string
+    executors = var.workers[count.index].executors
+  })
 
   associate_public_ip_address = false
-  subnet_id = element(data.aws_subnet.application_subnet.*.id, count.index) #distribute workers across AZs
-  vpc_security_group_ids = [aws_security_group.jenkins_worker.id]
+  subnet_id                   = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["teleport_nodes"].id,
+    var.base.security_groups["jumpbox_nodes"].id,
+    aws_security_group.worker.id
+  ]
 
   root_block_device {
-    volume_type = "gp2"
-    volume_size = 120
+    volume_type           = "gp2"
+    volume_size           = 120
     delete_on_termination = true
   }
 
   tags = {
-    env = var.env
+    env       = var.base.env
     terraform = "true"
-    Name = "jenkins-${element(split(",", element(var.workers, count.index)), 0)}-${count.index}"
-    app = "jenkins"
-    label = element(split(",", element(var.workers, count.index)), 0)
-    role = "worker"
+    Name      = "jenkins-${var.workers[count.index].label}-${count.index}"
+    app       = "jenkins"
+    label     = var.workers[count.index].label
+    role      = "worker"
   }
 
-  depends_on = [aws_instance.jenkins_primary]
-
   lifecycle {
     ignore_changes = [ami]
   }
@@ -324,103 +106,52 @@ resource "aws_instance" "jenkins_worker" {
 
 # Internal DNS references to each worker node
 resource "aws_route53_record" "worker" {
-  count = length(var.workers)
-  zone_id = data.aws_route53_zone.internal.id
-  name = "${element(split(",", element(var.workers, count.index)), 0)}-${count.index}.jenkins"
-  type = "CNAME"
-  ttl = 30
+  count   = length(var.workers)
+  zone_id = var.base.vpc.internal_dns.zone_id
+  name    = "${var.workers[count.index].label}-${count.index}.jenkins"
+  type    = "CNAME"
+  ttl     = 30
 
-  records = [element(aws_instance.jenkins_worker.*.private_dns, count.index)]
+  records = [aws_instance.jenkins_worker[count.index].private_dns]
 }
 
-resource "aws_security_group" "jenkins_worker" {
+resource "aws_security_group" "worker" {
   name_prefix = "$jenkins-worker-"
-  vpc_id = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
 
   tags = {
-    env = var.env
+    env       = var.base.env
     terraform = "true"
-    app = "jenkins"
-    role = "worker"
+    app       = "jenkins"
+    role      = "worker"
   }
 }
 
-resource "aws_security_group_rule" "worker_proxy_ssh" {
-  type = "ingress"
-  from_port = 3022
-  to_port = 3022
-  protocol = "tcp"
-  source_security_group_id = var.ssh_proxy_sg
-
-  security_group_id = aws_security_group.jenkins_worker.id
-}
-
-resource "aws_security_group_rule" "worker_ssh_ingress" {
-  type = "ingress"
-  from_port = 22
-  to_port = 22
-  protocol = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.jenkins_worker.id
-}
-
 resource "aws_security_group_rule" "worker_egress" {
-  type = "egress"
-  from_port = 0
-  to_port = 0
-  protocol = "-1"
+  type        = "egress"
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
   cidr_blocks = ["0.0.0.0/0"]
 
-  security_group_id = aws_security_group.jenkins_worker.id
+  security_group_id = aws_security_group.worker.id
 }
 
 #######
 # IAM accesses
 #######
 
-### Primary
-resource "aws_iam_instance_profile" "primary" {
-  name = "${var.env}-jenkins-primary"
-  role = aws_iam_role.primary.name
-}
-
-# Auth instance profile and roles
-resource "aws_iam_role" "primary" {
-  name = "${var.env}-jenkins-primary"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Principal": {"Service": "ec2.amazonaws.com"},
-            "Action": "sts:AssumeRole"
-        }
-    ]
-}
-EOF
-
-}
-
-# Give it base teleport permissions
-resource "aws_iam_role_policy_attachment" "primary_teleport" {
-role       = aws_iam_role.primary.name
-policy_arn = aws_iam_policy.teleport_secrets.arn
-}
-
 ### Worker
 resource "aws_iam_instance_profile" "worker" {
-name = "${var.env}-jenkins-worker"
-role = aws_iam_role.worker.name
+  name = "${var.base.env}-jenkins-worker"
+  role = aws_iam_role.worker.name
 }
 
 # Auth instance profile and roles
 resource "aws_iam_role" "worker" {
-name = "${var.env}-jenkins-worker"
+  name = "${var.base.env}-jenkins-worker"
 
-assume_role_policy = <<EOF
+  assume_role_policy = <<EOF
 {
     "Version": "2012-10-17",
     "Statement": [
@@ -436,53 +167,8 @@ EOF
 }
 
 # Give it base teleport permissions
-resource "aws_iam_role_policy_attachment" "worker_teleport" {
-role = aws_iam_role.worker.name
-policy_arn = aws_iam_policy.teleport_secrets.arn
-}
-
-### Shared IAM role for teleport
-resource "aws_iam_policy" "teleport_secrets" {
-name = "jenkins-teleport-secrets"
-path = "/${var.env}/jenkins/"
-description = "Allows nodes to run local teleport daemon"
-
-policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect" : "Allow",
-            "Action" : "ec2:DescribeTags",
-            "Resource" : "*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "secretsmanager:GetSecretValue",
-            "Resource": "${data.aws_secretsmanager_secret.cluster_token.arn}"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "kms:Decrypt",
-            "Resource": "${data.aws_kms_alias.main.target_key_arn}"
-        }
-    ]
-}
-EOF
-
-}
-
-resource "aws_kms_grant" "primary" {
-  name              = "jenkins-primary-main"
-  key_id            = data.aws_kms_alias.main.target_key_arn
-  grantee_principal = aws_iam_role.primary.arn
-  operations        = ["Decrypt"]
-}
-
-resource "aws_kms_grant" "worker" {
-  name              = "jenkins-worker-main"
-  key_id            = data.aws_kms_alias.main.target_key_arn
-  grantee_principal = aws_iam_role.worker.arn
-  operations        = ["Decrypt"]
+resource "aws_iam_role_policy_attachment" "iam_teleport" {
+  role       = aws_iam_role.worker.name
+  policy_arn = "arn:aws:iam::${var.base.account.account_id}:policy/${var.base.env}/teleport/${var.base.env}-instance-teleport-secrets"
 }
 
diff --git a/utilities/jenkins/primary.tmpl b/utilities/jenkins/primary.tmpl
new file mode 100644
index 0000000..87cc5f6
--- /dev/null
+++ b/utilities/jenkins/primary.tmpl
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+ docker run -d --restart always \
+    -v jenkins_home:/var/jenkins_home \
+    --name jenkins \
+    -p 8080:8080 \
+    -p 50000:50000 \
+    -e github_client_id="${github_client_id}" \
+    -e github_client_secret="${github_client_secret}" \
+    -e jenkins_url="${jenkins_url}" \
+    -e github_user="${github_user}" \
+    -e github_password="${github_password}" \
+    -e docker_user="${docker_user}" \
+    -e docker_password="${docker_password}" \
+    -e slack_token="${slack_token}" \
+    ${jenkins_image}
+
diff --git a/utilities/jenkins/variables.tf b/utilities/jenkins/variables.tf
index dabd4c1..dc8cd5c 100644
--- a/utilities/jenkins/variables.tf
+++ b/utilities/jenkins/variables.tf
@@ -1,36 +1,33 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "object with the outputs of the base module"
 }
 
 variable "workers" {
-  description = "A list of strings describing workers. Lists are of the form: label,instance_type,number_of_executors}"
+  type        = list(object({ label = string, instance_type = string, executors = number }))
+  description = "OPTIONAL: A list of objects describing workers."
 
   default = [
-    "general,t3.medium,6",
-    "general,t3.medium,6",
+    {
+      label         = "general",
+      instance_type = "t3.medium",
+      executors     = 6
+    }
   ]
 }
 
 variable "github_user" {
-  description = "GitHub account to use for Jenkins admin features (e.g., setting up hooks) and posting messages"
+  type        = string
+  description = "OPTIONAL: GitHub account to use for Jenkins admin features (e.g., setting up hooks) and posting messages"
   default     = "jenkins-adhoc-team"
 }
 
 variable "docker_user" {
-  description = "Docker Hub account to use for publishing public images"
+  type        = string
+  description = "OPTIONAL: Docker Hub account to use for publishing public images"
   default     = "adhocjenkins"
 }
 
-variable "ssh_proxy_sg" {
-  description = "OPTIONAL: the security group of the Teleport proxies"
-  default     = ""
-}
-
-variable "jenkins_image" {
+variable "image_tag" {
   type        = string
   description = "OPTIONAL: the image tag for the adhocteam/jenkins container to use for the primary"
   default     = "latest"
diff --git a/utilities/jenkins/versions.tf b/utilities/jenkins/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/utilities/jenkins/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/utilities/jumpbox/data.tf b/utilities/jumpbox/data.tf
index 06f61c9..d8ba8d1 100644
--- a/utilities/jumpbox/data.tf
+++ b/utilities/jumpbox/data.tf
@@ -1,38 +1,3 @@
-#######
-### Lookup resources already created by foundation
-#######
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "public_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "public-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_route53_zone" "external" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
 data "aws_ami" "amazon_linux_2" {
   most_recent = true
   owners      = ["amazon"]
diff --git a/utilities/jumpbox/main.tf b/utilities/jumpbox/main.tf
index 0797333..7e90d05 100644
--- a/utilities/jumpbox/main.tf
+++ b/utilities/jumpbox/main.tf
@@ -6,6 +6,10 @@
 # Once complete, this should be set back to 0 to remove the jumpbox
 #######
 
+terraform {
+  required_version = ">= 0.12"
+}
+
 #######
 # Jumpbox instances
 #######
@@ -21,11 +25,11 @@ resource "aws_instance" "jumpbox" {
   instance_type = "t3.nano"
 
   # TODO(bob) use https://github.com/widdix/aws-ec2-ssh to control access here?
-  key_name = var.key_pair
+  key_name = var.base.ssh_key
 
   associate_public_ip_address = true
-  subnet_id                   = element(data.aws_subnet.public_subnet.*.id, count.index)
-  vpc_security_group_ids      = [data.aws_security_group.jumpbox.id]
+  subnet_id                   = var.base.vpc.public[count.index].id
+  vpc_security_group_ids      = [var.base.security_groups["jumpbox"].id]
 
   lifecycle {
     ignore_changes = [ami]
@@ -38,35 +42,11 @@ resource "aws_instance" "jumpbox" {
   tags = {
     Name      = "jumpbox"
     app       = "utilities"
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
   }
 }
 
-#######
-# Security group for jumpbox alreeady exists
-# This just adds the configuration
-#######
-
-resource "aws_security_group_rule" "jumpbox_ssh" {
-  type        = "ingress"
-  from_port   = 22
-  to_port     = 22
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = data.aws_security_group.jumpbox.id
-}
-
-resource "aws_security_group_rule" "jump_into_vpc" {
-  type        = "egress"
-  from_port   = 22
-  to_port     = 22
-  protocol    = "tcp"
-  cidr_blocks = [data.aws_vpc.vpc.cidr_block]
-
-  security_group_id = data.aws_security_group.jumpbox.id
-}
 
 # TODO(bob) If using https://github.com/widdix/aws-ec2-ssh
 # then will need to open this up
@@ -86,8 +66,8 @@ resource "aws_security_group_rule" "jump_into_vpc" {
 
 resource "aws_route53_record" "jumpbox" {
   count   = local.enabled
-  zone_id = data.aws_route53_zone.external.id
-  name    = "jumpbox.${var.env}"
+  zone_id = var.base.external.id
+  name    = "jumpbox.${var.base.env}"
   type    = "CNAME"
   ttl     = 30
 
diff --git a/utilities/jumpbox/variables.tf b/utilities/jumpbox/variables.tf
index 20052ef..abb315c 100644
--- a/utilities/jumpbox/variables.tf
+++ b/utilities/jumpbox/variables.tf
@@ -1,17 +1,9 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
-}
-
-variable "key_pair" {
-  description = "OPTIONAL: the name of the key pair that provides access to the jumpbox, defaults to infrastructure"
-  default     = "infrastructure"
+variable "base" {
+  description = "object reflecting the outputs of the base module"
 }
 
 variable "enabled" {
+  type        = bool
   description = "OPTIONAL: set to true to enable jumpbox"
   default     = false
 }
diff --git a/utilities/jumpbox/versions.tf b/utilities/jumpbox/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/utilities/jumpbox/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/utilities/main.tf b/utilities/main.tf
index 6e5a688..ed1e54f 100644
--- a/utilities/main.tf
+++ b/utilities/main.tf
@@ -3,28 +3,26 @@ terraform {
 }
 
 module "jumpbox" {
-  source      = "./jumpbox"
-  env         = var.env
-  domain_name = var.domain_name
+  source = "./jumpbox"
 
+  base = var.base
   # Turned off by default
   enabled = var.jumpbox_enabled
 }
 
 module "teleport" {
-  source      = "./teleport"
-  env         = var.env
-  domain_name = var.domain_name
-  gh_team     = var.teleport_github_team
+  source = "./teleport"
+
+  base    = var.base
+  gh_team = var.teleport_github_team
 }
 
 module "jenkins" {
-  source        = "./jenkins"
-  env           = var.env
-  domain_name   = var.domain_name
-  ssh_proxy_sg  = module.teleport.security_group
-  workers       = var.jenkins_workers
-  jenkins_image = var.jenkins_image
-  github_user   = var.jenkins_github_user
+  source = "./jenkins"
+
+  base        = var.base
+  workers     = var.jenkins_workers
+  image_tag   = var.jenkins_image
+  github_user = var.jenkins_github_user
 }
 
diff --git a/utilities/teleport/README.md b/utilities/teleport/README.md
index ef7b931..b9d5cee 100644
--- a/utilities/teleport/README.md
+++ b/utilities/teleport/README.md
@@ -4,8 +4,8 @@ actual value as passed into the module.
 ## Before applying this module
 Before using this module you must setup a GitHub OAuth following [their instructions](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/).
 Use the following values substituting your variables manually:
-- Homepage URL: `https://teleport.<env>.<domain_name>/`
-- Callback URL: `https://teleport.<env>.<domain_name>/v1/webapi/github/callback`
+- Homepage URL: `https://teleport.<domain_name>/`
+- Callback URL: `https://teleport.<domain_name>/v1/webapi/github/callback`
 
 and store the resulting Client ID and Secret in AWS Secrets Manager with names as follows:
 
@@ -14,8 +14,8 @@ and store the resulting Client ID and Secret in AWS Secrets Manager with names a
 
 Example, if your `<domain_name>` is `adhocdemo.com` and `<env>` is `main` then the values would be:
 
-- Homepage URL: `https://teleport.main.adhocdemo.com/`
-- Callback URL: `https://teleport.main.adhocdemo.com/v1/webapi/github/callback`
+- Homepage URL: `https://teleport.adhocdemo.com/`
+- Callback URL: `https://teleport.adhocdemo.com/v1/webapi/github/callback`
 - Client ID stored in `main/teleport/github_client_id`
 - Secret store in `main/teleport/github_secret`
 
@@ -23,7 +23,7 @@ Example, if your `<domain_name>` is `adhocdemo.com` and `<env>` is `main` then t
 
 ### Via the webui
 
-Visit `https://teleport.<env>.<domain_name>/` and use the login with Github button. Approve the oauth request for the app on github. Then select the node to ssh into from the webui.
+Visit `https://teleport.<domain_name>/` and use the login with Github button. Approve the oauth request for the app on github. Then select the node to ssh into from the webui.
 
 ### Via the command line
 
@@ -32,7 +32,7 @@ You can download the client from [Gravitational](https://gravitational.com/telep
 Decompress and put the `tsh` someplace on your `$PATH`. There's an included `install` script that'll handle that but will also copy over the unneeded `teleport` and `tctl` binaries.
 
 **Always do**
-Login using `tsh login --proxy=teleport.<env>.<domain_name>:443` which should open a browser window and complete the login via GitHub automatically
+Login using `tsh login --proxy=teleport.<domain_name>:443` which should open a browser window and complete the login via GitHub automatically
 
 #### Then either:
 
@@ -46,7 +46,7 @@ Setup SSH proxying in your `$HOME/.ssh/config` with the snippet after replacing
 
 ```
 Host teleport
-    HostName teleport.<env>.<domain_name>
+    HostName teleport.<domain_name>
     Port 3023
 
 Host <10.1.>*
diff --git a/utilities/teleport/auth.tf b/utilities/teleport/auth.tf
index bd7f8cd..cc24bb9 100644
--- a/utilities/teleport/auth.tf
+++ b/utilities/teleport/auth.tf
@@ -8,16 +8,16 @@
 #######
 
 resource "aws_lb" "auth" {
-  name_prefix                      = "telep-"
+  name_prefix                      = "tp-aut"
   internal                         = true
   load_balancer_type               = "network"
-  subnets                          = data.aws_subnet.application_subnet.*.id
+  subnets                          = var.base.vpc.application[*].id
   enable_cross_zone_load_balancing = true
 
   ip_address_type = "ipv4"
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     name      = "lb-teleport-auth-internal"
@@ -30,13 +30,13 @@ resource "aws_lb_target_group" "auth" {
   name_prefix = "telep-"
   port        = 3025
   protocol    = "TCP"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
   target_type = "ip"
 
   depends_on = [aws_lb.auth]
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "lb-tg-telport-auth"
@@ -58,50 +58,53 @@ resource "aws_lb_listener" "auth" {
 # Auth instances
 #######
 
-data "template_file" "auth_user_data" {
-  count    = var.auth_count
-  template = file("${path.module}/auth-user-data.tmpl")
+resource "aws_instance" "auths" {
+  count         = var.auth_count
+  ami           = var.base.ami.id
+  instance_type = "t3.nano"
+  key_name      = var.base.ssh_key
 
-  vars = {
+  iam_instance_profile = aws_iam_instance_profile.auth.name
+  user_data = templatefile("${path.module}/auth-user-data.tmpl", {
     nodename                 = "teleport-auth-${count.index}"
-    cluster_token            = random_string.cluster_token.result
-    region                   = data.aws_region.current.name
+    cluster_token            = data.aws_secretsmanager_secret_version.cluster_token.secret_string
+    region                   = var.base.region.name
     dynamo_table_name        = aws_dynamodb_table.teleport_state.name
     dynamo_events_table_name = aws_dynamodb_table.teleport_events.name
     s3_bucket                = aws_s3_bucket.recordings.id
-    cluster_name             = var.env
+    cluster_name             = var.base.env
     client_id                = data.aws_secretsmanager_secret_version.github_client_id.secret_string
     client_secret            = data.aws_secretsmanager_secret_version.github_secret.secret_string
     proxy_domain             = aws_route53_record.public.fqdn
     gh_team                  = var.gh_team
-  }
-}
-
-resource "aws_instance" "auths" {
-  count         = var.auth_count
-  ami           = data.aws_ami.base.id
-  instance_type = "t3.nano"
-  key_name      = var.key_pair
-
-  iam_instance_profile = aws_iam_instance_profile.auth.name
-  user_data            = element(data.template_file.auth_user_data.*.rendered, count.index)
+  })
 
   associate_public_ip_address = false
-  subnet_id                   = element(data.aws_subnet.application_subnet.*.id, count.index) #distribute instances across AZs
-  vpc_security_group_ids      = [aws_security_group.auths.id]
+  subnet_id                   = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["jumpbox_nodes"].id,
+    aws_security_group.auths.id
+  ]
 
   lifecycle {
-    ignore_changes = [ami]
+    ignore_changes        = [ami]
+    create_before_destroy = true
   }
 
   credit_specification {
     cpu_credits = "unlimited"
   }
 
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = 20
+    delete_on_termination = true
+  }
+
   tags = {
     Name      = "teleport-auth-${count.index}"
     app       = "teleport"
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
   }
 }
@@ -111,7 +114,7 @@ resource "aws_instance" "auths" {
 resource "aws_lb_target_group_attachment" "auth" {
   count            = var.auth_count
   target_group_arn = aws_lb_target_group.auth.arn
-  target_id        = element(aws_instance.auths.*.private_ip, count.index)
+  target_id        = aws_instance.auths[count.index].private_ip
 }
 
 #######
@@ -120,10 +123,10 @@ resource "aws_lb_target_group_attachment" "auth" {
 
 resource "aws_security_group" "auths" {
   name_prefix = "teleport-auth-"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth"
@@ -135,7 +138,7 @@ resource "aws_security_group_rule" "auth_webui" {
   from_port   = 3025
   to_port     = 3025
   protocol    = "tcp"
-  cidr_blocks = [data.aws_vpc.vpc.cidr_block]
+  cidr_blocks = [var.base.vpc.cidr_block]
 
   security_group_id = aws_security_group.auths.id
 }
@@ -151,32 +154,23 @@ resource "aws_security_group_rule" "auth_egress" {
   security_group_id = aws_security_group.auths.id
 }
 
-# Support for emergency jumpbox
-resource "aws_security_group_rule" "jumpbox_auth" {
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.auths.id
-}
-
 #######
 # DynamoDB table to store cluster state and audit events
 # TODO(bob) enable autoscaling of dynamodb capacity
 # cf. https://github.com/gravitational/teleport/blob/master/examples/aws/terraform/dynamo.tf
 #######
 
-// Dynamodb is used as a backend for auth servers,
-// and only auth servers need access to the tables
-// all other components are stateless.
+# Dynamodb is used as a backend for auth servers,
+# and only auth servers need access to the tables
+# all other components are stateless.
 resource "aws_dynamodb_table" "teleport_state" {
-  name           = "${var.env}-teleport-state"
-  read_capacity  = 5
-  write_capacity = 5
-  hash_key       = "HashKey"
-  range_key      = "FullPath"
+  name             = "${var.base.env}-teleport-state"
+  read_capacity    = 5
+  write_capacity   = 5
+  hash_key         = "HashKey"
+  range_key        = "FullPath"
+  stream_enabled   = true
+  stream_view_type = "NEW_IMAGE"
 
   server_side_encryption {
     enabled = true
@@ -205,7 +199,7 @@ resource "aws_dynamodb_table" "teleport_state" {
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth-state"
@@ -214,7 +208,7 @@ resource "aws_dynamodb_table" "teleport_state" {
 
 // Dynamodb events table stores events
 resource "aws_dynamodb_table" "teleport_events" {
-  name           = "${var.env}-teleport-events"
+  name           = "${var.base.env}-teleport-events"
   read_capacity  = 5
   write_capacity = 5
   hash_key       = "SessionID"
@@ -266,7 +260,7 @@ resource "aws_dynamodb_table" "teleport_events" {
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth-audit"
@@ -282,21 +276,22 @@ resource "random_id" "unique_bucket" {
 }
 
 resource "aws_s3_bucket" "recordings" {
-  bucket        = "${var.env}-teleport-${lower(random_id.unique_bucket.hex)}"
+  bucket        = "${var.base.env}-teleport-${lower(random_id.unique_bucket.hex)}"
   acl           = "private"
   force_destroy = true
 
   server_side_encryption_configuration {
     rule {
       apply_server_side_encryption_by_default {
-        kms_master_key_id = data.aws_kms_key.main.arn #TODO(bob) switch to unique, restricted key here?
-        sse_algorithm     = "aws:kms"
+        kms_master_key_id = var.base.key.arn
+        #TODO(bob) switch to unique, restricted key here?
+        sse_algorithm = "aws:kms"
       }
     }
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
   }
@@ -307,13 +302,13 @@ resource "aws_s3_bucket" "recordings" {
 #######
 
 resource "aws_iam_instance_profile" "auth" {
-  name = "${var.env}-teleport-auth"
+  name = "${var.base.env}-teleport-auth"
   role = aws_iam_role.auth.name
 }
 
 // Auth instance profile and roles
 resource "aws_iam_role" "auth" {
-  name = "${var.env}-teleport-auth"
+  name = "${var.base.env}-teleport-auth"
 
   assume_role_policy = <<EOF
 {
@@ -332,7 +327,7 @@ EOF
 
 // Auth server uses DynamoDB as a backend, and this is to allow read/write from the dynamo tables
 resource "aws_iam_role_policy" "auth_dynamo" {
-  name = "${var.env}-teleport-auth-dynamo"
+  name = "${var.base.env}-teleport-auth-dynamo"
   role = aws_iam_role.auth.id
 
   policy = <<EOF
@@ -344,7 +339,13 @@ resource "aws_iam_role_policy" "auth_dynamo" {
             "Effect": "Allow",
             "Action": "dynamodb:*",
             "Resource": "${aws_dynamodb_table.teleport_state.arn}"
-        },
+        },  
+        {
+            "Sid": "AllActionsOnTeleportDBStreams",
+            "Effect": "Allow",
+            "Action": "dynamodb:*",
+            "Resource": "${aws_dynamodb_table.teleport_state.arn}/*"
+        },  
         {
             "Sid": "AllActionsOnTeleportEventsDB",
             "Effect": "Allow",
@@ -365,10 +366,10 @@ EOF
 
 // S3 for publishing session recordings to S3 encrypted bucket
 resource "aws_iam_role_policy" "auth_s3" {
-name = "${var.env}-teleport-auth-s3"
-role = aws_iam_role.auth.id
+  name = "${var.base.env}-teleport-auth-s3"
+  role = aws_iam_role.auth.id
 
-policy = <<EOF
+  policy = <<EOF
 {
    "Version": "2012-10-17",
    "Statement": [
@@ -392,7 +393,7 @@ policy = <<EOF
             "kms:Decrypt",
             "kms:GenerateDataKey"
         ],
-        "Resource": ["${data.aws_kms_key.main.arn}"]
+        "Resource": ["${var.base.key.arn}"]
      }
    ]
  }
diff --git a/utilities/teleport/data.tf b/utilities/teleport/data.tf
index 6f6fd03..32fb8b5 100644
--- a/utilities/teleport/data.tf
+++ b/utilities/teleport/data.tf
@@ -1,79 +1,14 @@
 #######
 ### Lookup resources already created by foundation
 #######
-
-data "aws_region" "current" {
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_subnet" "public_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "public-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_acm_certificate" "wildcard" {
-  domain      = "${var.domain_name}"
-  most_recent = true
-}
-
-data "aws_route53_zone" "external" {
-  name         = var.domain_name
-  private_zone = false
-}
-
-data "aws_kms_key" "main" {
-  key_id = "alias/${var.env}-main"
+data "aws_secretsmanager_secret_version" "cluster_token" {
+  secret_id = "${var.base.env}/teleport/cluster_token"
 }
 
 data "aws_secretsmanager_secret_version" "github_client_id" {
-  secret_id = "${var.env}/teleport/github_client_id"
+  secret_id = "${var.base.env}/teleport/github_client_id"
 }
 
 data "aws_secretsmanager_secret_version" "github_secret" {
-  secret_id = "${var.env}/teleport/github_secret"
-}
-
-data "aws_secretsmanager_secret" "cluster_token" {
-  name = "${var.env}/teleport/cluster_token"
-}
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
+  secret_id = "${var.base.env}/teleport/github_secret"
 }
-
diff --git a/utilities/teleport/main.tf b/utilities/teleport/main.tf
index c1dd32d..7c2cdc0 100644
--- a/utilities/teleport/main.tf
+++ b/utilities/teleport/main.tf
@@ -3,27 +3,31 @@
 # provides SSH bastion services to connect to rest of infrastructure
 #######
 
+terraform {
+  required_version = ">= 0.12"
+}
+
 # Public DNS name for client use to connect to proxies
 resource "aws_route53_record" "public" {
-  zone_id = data.aws_route53_zone.external.id
+  zone_id = var.base.external.id
   name    = "teleport"
   type    = "CNAME"
   ttl     = 30
 
-  records = [aws_elb.proxy.dns_name]
+  records = [aws_lb.nlb.dns_name]
 }
 
 # Private DNS name inside VPC for auth nodes as light-weight service discovery
 resource "aws_route53_zone" "teleport" {
   name    = "teleport.local"
-  comment = "${var.env} Teleport internal DNS"
+  comment = "${var.base.env} Teleport internal DNS"
 
   vpc {
-    vpc_id = data.aws_vpc.vpc.id
+    vpc_id = var.base.vpc.id
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     Name      = "teleport-dns"
   }
@@ -38,45 +42,3 @@ resource "aws_route53_record" "auth_internal" {
   records = [aws_lb.auth.dns_name]
 }
 
-# A create a random cluster token at creation time. No rotation as of now.
-resource "random_string" "cluster_token" {
-  length  = 32
-  special = false
-}
-
-resource "aws_secretsmanager_secret_version" "cluster_token" {
-  secret_id     = "${var.env}/teleport/cluster_token"
-  secret_string = random_string.cluster_token.result
-}
-
-### Shared IAM role for instances running teleport
-resource "aws_iam_policy" "teleport_secrets" {
-  name        = "${var.env}-instance-teleport-secrets"
-  path        = "/${var.env}/teleport/"
-  description = "Allows nodes to run local teleport daemon"
-
-  policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect" : "Allow",
-            "Action" : "ec2:DescribeTags",
-            "Resource" : "*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "secretsmanager:GetSecretValue",
-            "Resource": "${data.aws_secretsmanager_secret.cluster_token.arn}"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "kms:Decrypt",
-            "Resource": "${data.aws_kms_key.main.arn}"
-        }
-    ]
-}
-EOF
-
-}
-
diff --git a/utilities/teleport/outputs.tf b/utilities/teleport/outputs.tf
deleted file mode 100644
index c0369c6..0000000
--- a/utilities/teleport/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "security_group" {
-  value = aws_security_group.proxies.id
-}
-
diff --git a/utilities/teleport/proxy.tf b/utilities/teleport/proxy.tf
index 6d88bf6..528448a 100644
--- a/utilities/teleport/proxy.tf
+++ b/utilities/teleport/proxy.tf
@@ -5,161 +5,208 @@
 #######
 
 #######
-# Load balancer for web traffic
+# Network load balancer that receives traffic from the internet
+# Terminates our TLS for HTTPS traffic
 #######
 
-resource "aws_elb" "proxy" {
-  name_prefix     = "telep-"
-  internal        = false
-  security_groups = [aws_security_group.proxy_lb.id]
-  subnets         = data.aws_subnet.public_subnet.*.id
+resource "aws_lb" "nlb" {
+  name_prefix        = "tp-nlb"
+  internal           = false
+  load_balancer_type = "network"
+  subnets            = var.base.vpc.public[*].id
 
-  # Allow connections to idle for an hour
-  idle_timeout = 3600
+  enable_cross_zone_load_balancing = true
 
-  listener {
-    instance_port     = 3023
-    instance_protocol = "tcp"
-    lb_port           = 3023
-    lb_protocol       = "tcp"
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = "teleport"
+    Name      = "teleport-proxy-nlb"
   }
+}
 
-  listener {
-    instance_port     = 3024
-    instance_protocol = "tcp"
-    lb_port           = 3024
-    lb_protocol       = "tcp"
-  }
+# HTTPS ports
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = 443
+  protocol          = "TLS"
 
-  listener {
-    instance_port      = 3080
-    instance_protocol  = "tcp"
-    lb_port            = 443
-    lb_protocol        = "ssl"
-    ssl_certificate_id = data.aws_acm_certificate.wildcard.arn
+  ssl_policy      = "ELBSecurityPolicy-FS-2018-06"
+  certificate_arn = var.base.wildcard.arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.https.arn
   }
+}
+
+resource "aws_lb_listener" "https_native" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = 3080
+  protocol          = "TLS"
 
-  listener {
-    instance_port      = 3080
-    instance_protocol  = "tcp"
-    lb_port            = 3080
-    lb_protocol        = "ssl"
-    ssl_certificate_id = data.aws_acm_certificate.wildcard.arn
+  ssl_policy      = "ELBSecurityPolicy-FS-2018-06"
+  certificate_arn = var.base.wildcard.arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.https.arn
   }
+}
+
+resource "aws_lb_target_group" "https" {
+  name_prefix = "in-tls"
+  port        = 3080
+  protocol    = "TCP"
+  vpc_id      = var.base.vpc.id
+
+  # Use IP to support Fargate clusters
+  target_type = "ip"
 
   health_check {
-    healthy_threshold   = 2
-    unhealthy_threshold = 2
-    timeout             = 3
-    target              = "HTTP:3080/v1/webapi/ping"
-    interval            = 30
+    protocol = "TCP"
+    port     = 3080
   }
 
+  depends_on = [aws_lb.nlb]
+
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
-    name      = "elb-teleport-proxy"
+    Name      = "teleport-proxy-https"
   }
 }
 
-######
-# Security groups for Load Balancer
-#######
+# SSH inbound proxy
+resource "aws_lb_listener" "proxy" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = 3023
+  protocol          = "TCP"
 
-# Security Group: world -> proxy
-resource "aws_security_group" "proxy_lb" {
-  name_prefix = "teleport-proxy-lb-"
-  vpc_id      = data.aws_vpc.vpc.id
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.proxy.arn
+  }
+}
+
+resource "aws_lb_target_group" "proxy" {
+  name_prefix = "in-tls"
+  port        = 3023
+  protocol    = "TCP"
+  vpc_id      = var.base.vpc.id
+
+  # Use IP to support Fargate clusters
+  target_type = "ip"
+
+  # Health check only on web port to prevent logs filling with connection resets
+  health_check {
+    protocol = "TCP"
+    port     = 3080
+  }
+
+  depends_on = [aws_lb.nlb]
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
-    Name      = "world->teleport-proxy"
+    Name      = "teleport-proxy-inbound-proxy"
   }
 }
 
-resource "aws_security_group_rule" "lb_webui_ingress" {
-  type        = "ingress"
-  from_port   = 443
-  to_port     = 443
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
+# SSH outbound reverse tunnel proxy
+resource "aws_lb_listener" "tunnel" {
+  load_balancer_arn = aws_lb.nlb.arn
+  port              = 3024
+  protocol          = "TCP"
 
-  security_group_id = aws_security_group.proxy_lb.id
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.tunnel.arn
+  }
 }
 
-resource "aws_security_group_rule" "lb_client_ingress" {
-  type        = "ingress"
-  from_port   = 3080
-  to_port     = 3080
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
+resource "aws_lb_target_group" "tunnel" {
+  name_prefix = "in-tls"
+  port        = 3024
+  protocol    = "TCP"
+  vpc_id      = var.base.vpc.id
 
-  security_group_id = aws_security_group.proxy_lb.id
-}
+  # Use IP to support Fargate clusters
+  target_type = "ip"
 
-resource "aws_security_group_rule" "lb_ssh_ingress" {
-  type        = "ingress"
-  from_port   = 3023
-  to_port     = 3023
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
+  # Health check only on web port to prevent logs filling with connection resets
+  health_check {
+    protocol = "TCP"
+    port     = 3080
+  }
 
-  security_group_id = aws_security_group.proxy_lb.id
-}
+  depends_on = [aws_lb.nlb]
 
-resource "aws_security_group_rule" "lb_cluster_ingress" {
-  type        = "ingress"
-  from_port   = 3024
-  to_port     = 3024
-  protocol    = "tcp"
-  cidr_blocks = ["0.0.0.0/0"]
+  tags = {
+    env       = var.base.env
+    terraform = "true"
+    app       = "teleport"
+    Name      = "teleport-proxy-reverse-tunnel"
+  }
+}
 
-  security_group_id = aws_security_group.proxy_lb.id
+resource "aws_lb_target_group_attachment" "https" {
+  count            = length(aws_instance.proxies[*].private_ip)
+  target_group_arn = aws_lb_target_group.https.arn
+  target_id        = aws_instance.proxies[count.index].private_ip
 }
 
-resource "aws_security_group_rule" "lb_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
+resource "aws_lb_target_group_attachment" "proxy" {
+  count            = length(aws_instance.proxies[*].private_ip)
+  target_group_arn = aws_lb_target_group.proxy.arn
+  target_id        = aws_instance.proxies[count.index].private_ip
+}
 
-  security_group_id = aws_security_group.proxy_lb.id
+resource "aws_lb_target_group_attachment" "tunnel" {
+  count            = length(aws_instance.proxies[*].private_ip)
+  target_group_arn = aws_lb_target_group.tunnel.arn
+  target_id        = aws_instance.proxies[count.index].private_ip
 }
 
 #######
 # Proxy instances
 #######
-data "template_file" "user_data" {
-  count    = var.proxy_count
-  template = file("${path.module}/proxy-user-data.tmpl")
-
-  vars = {
-    nodename      = "teleport-proxy-${count.index}"
-    cluster_token = random_string.cluster_token.result
-    proxy_domain  = aws_route53_record.public.fqdn
-  }
-}
 
 resource "aws_instance" "proxies" {
   count         = var.proxy_count
-  ami           = data.aws_ami.base.id
+  ami           = var.base.ami.id
   instance_type = "t3.micro"
-  key_name      = var.key_pair
+  key_name      = var.base.ssh_key
 
-  user_data = element(data.template_file.user_data.*.rendered, count.index)
+  user_data = templatefile("${path.module}/proxy-user-data.tmpl", {
+    nodename      = "teleport-proxy-${count.index}"
+    cluster_token = data.aws_secretsmanager_secret_version.cluster_token.secret_string
+    proxy_domain  = aws_route53_record.public.fqdn
+  })
 
   associate_public_ip_address = false
-  subnet_id                   = element(data.aws_subnet.application_subnet.*.id, count.index) #distribute instances across AZs
-  vpc_security_group_ids      = [aws_security_group.proxies.id]
+
+  subnet_id = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["jumpbox_nodes"].id,
+    var.base.security_groups["teleport_proxies"].id,
+  ]
 
   lifecycle {
-    ignore_changes = [ami]
+    ignore_changes        = [ami]
+    create_before_destroy = true
   }
 
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = 20
+    delete_on_termination = true
+  }
+
+  depends_on = [aws_instance.auths]
+
   credit_specification {
     cpu_credits = "unlimited"
   }
@@ -167,84 +214,7 @@ resource "aws_instance" "proxies" {
   tags = {
     Name      = "teleport-proxy-${count.index}"
     app       = "teleport"
-    env       = var.env
-    terraform = "true"
-  }
-}
-
-# Add to target group to attach to LB
-
-resource "aws_elb_attachment" "proxy_ssh" {
-  count    = var.proxy_count
-  elb      = aws_elb.proxy.id
-  instance = element(aws_instance.proxies.*.id, count.index)
-}
-
-#######
-### Security group for proxy instances
-#######
-
-resource "aws_security_group" "proxies" {
-  name_prefix = "teleport-proxies-"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
-    app       = "teleport"
-    Name      = "teleport-proxies"
   }
 }
-
-resource "aws_security_group_rule" "proxy_webui" {
-  type                     = "ingress"
-  from_port                = 3080
-  to_port                  = 3080
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.proxy_lb.id
-
-  security_group_id = aws_security_group.proxies.id
-}
-
-resource "aws_security_group_rule" "proxy_ssh" {
-  type                     = "ingress"
-  from_port                = 3023
-  to_port                  = 3023
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.proxy_lb.id
-
-  security_group_id = aws_security_group.proxies.id
-}
-
-resource "aws_security_group_rule" "proxy_cluster" {
-  type                     = "ingress"
-  from_port                = 3024
-  to_port                  = 3024
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.proxy_lb.id
-
-  security_group_id = aws_security_group.proxies.id
-}
-
-# Must allow talking to the world to call out to AWS APIs
-resource "aws_security_group_rule" "proxy_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.proxies.id
-}
-
-# Support for emergency jumpbox
-resource "aws_security_group_rule" "jumpbox_proxy" {
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.proxies.id
-}
-
diff --git a/utilities/teleport/variables.tf b/utilities/teleport/variables.tf
index 921c910..f862f9a 100644
--- a/utilities/teleport/variables.tf
+++ b/utilities/teleport/variables.tf
@@ -1,27 +1,21 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
 }
 
 variable "proxy_count" {
-  description = "number of proxy instances to create, for HA use 3 to spread across AZs"
-  default     = "1"
+  type        = number
+  description = "OPTIONAL: number of proxy instances to create, for HA use 3 to spread across AZs"
+  default     = 1
 }
 
 variable "auth_count" {
-  description = "number of proxy instances to create, for HA use 3 to spread across AZs"
-  default     = "1"
-}
-
-variable "key_pair" {
-  description = "the name of the key pair that provides access to the nodes if jumpbox is used"
-  default     = "infrastructure"
+  type        = number
+  description = "OPTIONAL: number of proxy instances to create, for HA use 3 to spread across AZs"
+  default     = 1
 }
 
 variable "gh_team" {
+  type        = string
   description = "OPTIONAL: the Github team to provide access to via Teleport"
   default     = "infrastructure-team"
 }
diff --git a/utilities/teleport/versions.tf b/utilities/teleport/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/utilities/teleport/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/utilities/teleport_subcluster/auth-user-data.tmpl b/utilities/teleport_subcluster/auth-user-data.tmpl
index 16ec854..a5ebcb4 100644
--- a/utilities/teleport_subcluster/auth-user-data.tmpl
+++ b/utilities/teleport_subcluster/auth-user-data.tmpl
@@ -63,7 +63,7 @@ spec:
 EOF
 
 # Sleep to allow time for the authentication service to start up and then retry a few times
-sleep 60
-for i in {1..5}; do sudo -u teleport /usr/local/bin/tctl create /var/lib/teleport/cluster.yaml && break || sleep 60; done
+sleep 120
+for i in {1..15}; do sudo -u teleport /usr/local/bin/tctl create /var/lib/teleport/cluster.yaml && break || sleep 60; done
 
 echo "Teleport install complete"
diff --git a/utilities/teleport_subcluster/auth.tf b/utilities/teleport_subcluster/auth.tf
index 31a5ef1..906a02c 100644
--- a/utilities/teleport_subcluster/auth.tf
+++ b/utilities/teleport_subcluster/auth.tf
@@ -8,16 +8,16 @@
 #######
 
 resource "aws_lb" "auth" {
-  name_prefix                      = "telep-"
+  name_prefix                      = "tp-aut"
   internal                         = true
   load_balancer_type               = "network"
-  subnets                          = data.aws_subnet.application_subnet.*.id
+  subnets                          = var.base.vpc.application[*].id
   enable_cross_zone_load_balancing = true
 
   ip_address_type = "ipv4"
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     name      = "lb-teleport-auth-internal"
@@ -30,13 +30,13 @@ resource "aws_lb_target_group" "auth" {
   name_prefix = "telep-"
   port        = 3025
   protocol    = "TCP"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
   target_type = "ip"
 
   depends_on = [aws_lb.auth]
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "lb-tg-telport-auth"
@@ -58,49 +58,52 @@ resource "aws_lb_listener" "auth" {
 # Auth instances
 #######
 
-data "template_file" "auth_user_data" {
-  count    = var.auth_count
-  template = file("${path.module}/auth-user-data.tmpl")
+resource "aws_instance" "auths" {
+  count         = var.auth_count
+  ami           = var.base.ami.id
+  instance_type = "t3.nano"
+  key_name      = var.base.ssh_key
 
-  vars = {
+  iam_instance_profile = aws_iam_instance_profile.auth.name
+  user_data = templatefile("${path.module}/auth-user-data.tmpl", {
     nodename                 = "teleport-auth-${count.index}"
-    cluster_token            = random_string.cluster_token.result
-    region                   = data.aws_region.current.name
+    cluster_token            = data.aws_secretsmanager_secret_version.cluster_token.secret_string
+    region                   = var.base.region.name
     dynamo_table_name        = aws_dynamodb_table.teleport_state.name
     dynamo_events_table_name = aws_dynamodb_table.teleport_events.name
     s3_bucket                = aws_s3_bucket.recordings.id
-    cluster_name             = var.env
+    cluster_name             = var.base.env
     main_cluster             = var.main_cluster
     main_cluster_token       = data.aws_secretsmanager_secret_version.main_cluster_token.secret_string
-    main_cluster_url         = "teleport.${var.domain_name}"
-  }
-}
-
-resource "aws_instance" "auths" {
-  count         = var.auth_count
-  ami           = data.aws_ami.base.id
-  instance_type = "t3.nano"
-  key_name      = var.key_pair
-
-  iam_instance_profile = aws_iam_instance_profile.auth.name
-  user_data            = element(data.template_file.auth_user_data.*.rendered, count.index)
+    main_cluster_url         = "teleport.${var.base.domain_name}"
+  })
 
   associate_public_ip_address = false
-  subnet_id                   = element(data.aws_subnet.application_subnet.*.id, count.index) #distribute instances across AZs
-  vpc_security_group_ids      = [aws_security_group.auths.id]
+  subnet_id                   = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["jumpbox_nodes"].id,
+    aws_security_group.auths.id
+  ]
 
   lifecycle {
-    ignore_changes = [ami]
+    ignore_changes        = [ami]
+    create_before_destroy = true
   }
 
   credit_specification {
     cpu_credits = "unlimited"
   }
 
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = 20
+    delete_on_termination = true
+  }
+
   tags = {
     Name      = "teleport-auth-${count.index}"
     app       = "teleport"
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
   }
 }
@@ -110,7 +113,7 @@ resource "aws_instance" "auths" {
 resource "aws_lb_target_group_attachment" "auth" {
   count            = var.auth_count
   target_group_arn = aws_lb_target_group.auth.arn
-  target_id        = element(aws_instance.auths.*.private_ip, count.index)
+  target_id        = aws_instance.auths[count.index].private_ip
 }
 
 #######
@@ -119,10 +122,10 @@ resource "aws_lb_target_group_attachment" "auth" {
 
 resource "aws_security_group" "auths" {
   name_prefix = "teleport-auth-"
-  vpc_id      = data.aws_vpc.vpc.id
+  vpc_id      = var.base.vpc.id
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth"
@@ -134,7 +137,7 @@ resource "aws_security_group_rule" "auth_webui" {
   from_port   = 3025
   to_port     = 3025
   protocol    = "tcp"
-  cidr_blocks = [data.aws_vpc.vpc.cidr_block]
+  cidr_blocks = [var.base.vpc.cidr_block]
 
   security_group_id = aws_security_group.auths.id
 }
@@ -150,17 +153,6 @@ resource "aws_security_group_rule" "auth_egress" {
   security_group_id = aws_security_group.auths.id
 }
 
-# Support for emergency jumpbox
-resource "aws_security_group_rule" "jumpbox_auth" {
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.auths.id
-}
-
 #######
 # DynamoDB table to store cluster state and audit events
 # TODO(bob) enable autoscaling of dynamodb capacity
@@ -171,11 +163,13 @@ resource "aws_security_group_rule" "jumpbox_auth" {
 // and only auth servers need access to the tables
 // all other components are stateless.
 resource "aws_dynamodb_table" "teleport_state" {
-  name           = "${var.env}-teleport-state"
-  read_capacity  = 5
-  write_capacity = 5
-  hash_key       = "HashKey"
-  range_key      = "FullPath"
+  name             = "${var.base.env}-teleport-state"
+  read_capacity    = 5
+  write_capacity   = 5
+  hash_key         = "HashKey"
+  range_key        = "FullPath"
+  stream_enabled   = true
+  stream_view_type = "NEW_IMAGE"
 
   server_side_encryption {
     enabled = true
@@ -204,7 +198,7 @@ resource "aws_dynamodb_table" "teleport_state" {
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth-state"
@@ -213,7 +207,7 @@ resource "aws_dynamodb_table" "teleport_state" {
 
 // Dynamodb events table stores events
 resource "aws_dynamodb_table" "teleport_events" {
-  name           = "${var.env}-teleport-events"
+  name           = "${var.base.env}-teleport-events"
   read_capacity  = 5
   write_capacity = 5
   hash_key       = "SessionID"
@@ -265,7 +259,7 @@ resource "aws_dynamodb_table" "teleport_events" {
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
     Name      = "teleport-auth-audit"
@@ -281,21 +275,21 @@ resource "random_id" "unique_bucket" {
 }
 
 resource "aws_s3_bucket" "recordings" {
-  bucket        = "${var.env}-teleport-${lower(random_id.unique_bucket.hex)}"
+  bucket        = "${var.base.env}-teleport-${lower(random_id.unique_bucket.hex)}"
   acl           = "private"
   force_destroy = true
 
   server_side_encryption_configuration {
     rule {
       apply_server_side_encryption_by_default {
-        kms_master_key_id = data.aws_kms_key.main.arn #TODO(bob) switch to unique, restricted key here?
+        kms_master_key_id = var.base.key.arn #TODO(bob) switch to unique, restricted key here?
         sse_algorithm     = "aws:kms"
       }
     }
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     app       = "teleport"
   }
@@ -306,13 +300,13 @@ resource "aws_s3_bucket" "recordings" {
 #######
 
 resource "aws_iam_instance_profile" "auth" {
-  name = "${var.env}-teleport-auth"
+  name = "${var.base.env}-teleport-auth"
   role = aws_iam_role.auth.name
 }
 
 // Auth instance profile and roles
 resource "aws_iam_role" "auth" {
-  name = "${var.env}-teleport-auth"
+  name = "${var.base.env}-teleport-auth"
 
   assume_role_policy = <<EOF
 {
@@ -331,7 +325,7 @@ EOF
 
 // Auth server uses DynamoDB as a backend, and this is to allow read/write from the dynamo tables
 resource "aws_iam_role_policy" "auth_dynamo" {
-  name = "${var.env}-teleport-auth-dynamo"
+  name = "${var.base.env}-teleport-auth-dynamo"
   role = aws_iam_role.auth.id
 
   policy = <<EOF
@@ -344,6 +338,12 @@ resource "aws_iam_role_policy" "auth_dynamo" {
             "Action": "dynamodb:*",
             "Resource": "${aws_dynamodb_table.teleport_state.arn}"
         },
+        {
+              "Sid": "AllActionsOnTeleportDBStreams",
+              "Effect": "Allow",
+              "Action": "dynamodb:*",
+              "Resource": "${aws_dynamodb_table.teleport_state.arn}/*"
+        },
         {
             "Sid": "AllActionsOnTeleportEventsDB",
             "Effect": "Allow",
@@ -364,10 +364,10 @@ EOF
 
 // S3 for publishing session recordings to S3 encrypted bucket
 resource "aws_iam_role_policy" "auth_s3" {
-name = "${var.env}-teleport-auth-s3"
-role = aws_iam_role.auth.id
+  name = "${var.base.env}-teleport-auth-s3"
+  role = aws_iam_role.auth.id
 
-policy = <<EOF
+  policy = <<EOF
 {
    "Version": "2012-10-17",
    "Statement": [
@@ -391,7 +391,7 @@ policy = <<EOF
             "kms:Decrypt",
             "kms:GenerateDataKey"
         ],
-        "Resource": ["${data.aws_kms_key.main.arn}"]
+        "Resource": ["${var.base.key.arn}"]
      }
    ]
  }
diff --git a/utilities/teleport_subcluster/data.tf b/utilities/teleport_subcluster/data.tf
index b53dceb..3d7f5af 100644
--- a/utilities/teleport_subcluster/data.tf
+++ b/utilities/teleport_subcluster/data.tf
@@ -1,55 +1,10 @@
 #######
 ### Lookup resources already created by foundation
 #######
-
-data "aws_region" "current" {
-}
-
-data "aws_vpc" "vpc" {
-  tags = {
-    env = var.env
-  }
-}
-
-data "aws_subnet" "application_subnet" {
-  count  = 3
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    name = "app-sub-${count.index}"
-    env  = var.env
-  }
-}
-
-data "aws_kms_key" "main" {
-  key_id = "alias/${var.env}-main"
-}
-
-data "aws_secretsmanager_secret" "cluster_token" {
-  name = "${var.env}/teleport/cluster_token"
+data "aws_secretsmanager_secret_version" "cluster_token" {
+  secret_id = "${var.base.env}/teleport/cluster_token"
 }
 
 data "aws_secretsmanager_secret_version" "main_cluster_token" {
   secret_id = "${var.main_cluster}/teleport/cluster_token"
 }
-
-data "aws_security_group" "jumpbox" {
-  vpc_id = data.aws_vpc.vpc.id
-
-  tags = {
-    env  = var.env
-    app  = "utilities"
-    Name = "jumpbox"
-  }
-}
-
-data "aws_ami" "base" {
-  most_recent = true
-  owners      = ["self"]
-
-  filter {
-    name   = "name"
-    values = ["adhoc_base*"]
-  }
-}
-
diff --git a/utilities/teleport_subcluster/main.tf b/utilities/teleport_subcluster/main.tf
index b0ef0b1..7ae3a01 100644
--- a/utilities/teleport_subcluster/main.tf
+++ b/utilities/teleport_subcluster/main.tf
@@ -7,17 +7,21 @@
 # environments where you do not want to have a public endpoint open.
 #######
 
+terraform {
+  required_version = ">= 0.12"
+}
+
 # Private DNS name inside VPC for auth nodes as light-weight service discovery
 resource "aws_route53_zone" "teleport" {
   name    = "teleport.local"
-  comment = "${var.env} Teleport internal DNS"
+  comment = "${var.base.env} Teleport internal DNS"
 
   vpc {
-    vpc_id = data.aws_vpc.vpc.id
+    vpc_id = var.base.vpc.id
   }
 
   tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
     Name      = "teleport-dns"
   }
@@ -31,47 +35,3 @@ resource "aws_route53_record" "auth_internal" {
 
   records = [aws_lb.auth.dns_name]
 }
-
-# A create a random cluster token at creation time. No rotation as of now.
-# The secret must exist prior to running this but the value will be overwritten
-resource "random_string" "cluster_token" {
-  length  = 32
-  special = false
-}
-
-resource "aws_secretsmanager_secret_version" "cluster_token" {
-  secret_id     = "${var.env}/teleport/cluster_token"
-  secret_string = random_string.cluster_token.result
-}
-
-### Shared IAM role for instances running teleport
-resource "aws_iam_policy" "teleport_secrets" {
-  name        = "${var.env}-instance-teleport-secrets"
-  path        = "/${var.env}/teleport/"
-  description = "Allows nodes to run local teleport daemon"
-
-  policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect" : "Allow",
-            "Action" : "ec2:DescribeTags",
-            "Resource" : "*"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "secretsmanager:GetSecretValue",
-            "Resource": "${data.aws_secretsmanager_secret.cluster_token.arn}"
-        },
-        {
-            "Effect": "Allow",
-            "Action": "kms:Decrypt",
-            "Resource": "${data.aws_kms_key.main.arn}"
-        }
-    ]
-}
-EOF
-
-}
-
diff --git a/utilities/teleport_subcluster/outputs.tf b/utilities/teleport_subcluster/outputs.tf
deleted file mode 100644
index c0369c6..0000000
--- a/utilities/teleport_subcluster/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "security_group" {
-  value = aws_security_group.proxies.id
-}
-
diff --git a/utilities/teleport_subcluster/proxy.tf b/utilities/teleport_subcluster/proxy.tf
index f740b86..bc16e16 100644
--- a/utilities/teleport_subcluster/proxy.tf
+++ b/utilities/teleport_subcluster/proxy.tf
@@ -7,30 +7,35 @@
 #######
 # Proxy instances
 #######
-data "template_file" "user_data" {
-  count    = var.proxy_count
-  template = file("${path.module}/proxy-user-data.tmpl")
-
-  vars = {
-    nodename      = "teleport-proxy-${count.index}"
-    cluster_token = random_string.cluster_token.result
-  }
-}
-
 resource "aws_instance" "proxies" {
   count         = var.proxy_count
-  ami           = data.aws_ami.base.id
+  ami           = var.base.ami.id
   instance_type = "t3.micro"
-  key_name      = var.key_pair
+  key_name      = var.base.ssh_key
 
-  user_data = element(data.template_file.user_data.*.rendered, count.index)
+  user_data = templatefile("${path.module}/proxy-user-data.tmpl", {
+    nodename      = "teleport-proxy-${count.index}"
+    cluster_token = data.aws_secretsmanager_secret_version.cluster_token.secret_string
+  })
 
   associate_public_ip_address = false
-  subnet_id                   = element(data.aws_subnet.application_subnet.*.id, count.index) #distribute instances across AZs
-  vpc_security_group_ids      = [aws_security_group.proxies.id]
+  subnet_id                   = element(var.base.vpc.application[*].id, count.index)
+  vpc_security_group_ids = [
+    var.base.security_groups["jumpbox_nodes"].id,
+    var.base.security_groups["teleport_proxies"].id,
+  ]
 
   lifecycle {
-    ignore_changes = [ami]
+    ignore_changes        = [ami]
+    create_before_destroy = true
+  }
+
+  depends_on = [aws_instance.auths]
+
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = 20
+    delete_on_termination = true
   }
 
   credit_specification {
@@ -40,47 +45,7 @@ resource "aws_instance" "proxies" {
   tags = {
     Name      = "teleport-proxy-${count.index}"
     app       = "teleport"
-    env       = var.env
-    terraform = "true"
-  }
-}
-
-#######
-### Security group for proxy instances
-#######
-
-resource "aws_security_group" "proxies" {
-  name_prefix = "teleport-proxies-"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  tags = {
-    env       = var.env
+    env       = var.base.env
     terraform = "true"
-    app       = "teleport"
-    Name      = "teleport-proxies"
   }
 }
-
-# Must allow talking to the world to call out to AWS APIs
-# and main cluster
-resource "aws_security_group_rule" "proxy_egress" {
-  type        = "egress"
-  from_port   = 0
-  to_port     = 0
-  protocol    = "-1"
-  cidr_blocks = ["0.0.0.0/0"]
-
-  security_group_id = aws_security_group.proxies.id
-}
-
-# Support for emergency jumpbox
-resource "aws_security_group_rule" "jumpbox_proxy" {
-  type                     = "ingress"
-  from_port                = 22
-  to_port                  = 22
-  protocol                 = "tcp"
-  source_security_group_id = data.aws_security_group.jumpbox.id
-
-  security_group_id = aws_security_group.proxies.id
-}
-
diff --git a/utilities/teleport_subcluster/variables.tf b/utilities/teleport_subcluster/variables.tf
index f11c333..4d711a4 100644
--- a/utilities/teleport_subcluster/variables.tf
+++ b/utilities/teleport_subcluster/variables.tf
@@ -1,33 +1,22 @@
-variable "env" {
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf re  po"
 }
 
 variable "proxy_count" {
+  type        = number
   description = "number of proxy instances to create, for HA use 3 to spread across AZs"
-  default     = "1"
+  default     = 1
 }
 
 variable "auth_count" {
+  type        = number
   description = "number of proxy instances to create, for HA use 3 to spread across AZs"
-  default     = "1"
-}
-
-variable "key_pair" {
-  description = "the name of the key pair that provides access to the nodes if jumpbox is used"
-  default     = "infrastructure"
-}
-
-variable "gh_team" {
-  description = "OPTIONAL: the Github team to provide access to via Teleport"
-  default     = "infrastructure-team"
+  default     = 1
 }
 
 variable "main_cluster" {
-  description = "The cluster_name (generally env) of the main cluster. Defaults to dev"
+  type        = string
+  description = "OPTIONAL: The cluster_name (generally env) of the main cluster. Defaults to dev"
   default     = "dev"
 }
 
diff --git a/utilities/teleport_subcluster/versions.tf b/utilities/teleport_subcluster/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/utilities/teleport_subcluster/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/utilities/variables.tf b/utilities/variables.tf
index f3ba4ef..008080e 100644
--- a/utilities/variables.tf
+++ b/utilities/variables.tf
@@ -1,11 +1,5 @@
-variable "env" {
-  type        = string
-  description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
-}
-
-variable "domain_name" {
-  type        = string
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+variable "base" {
+  description = "an object representing the outputs of the base module from the tf repo"
 }
 
 variable "jumpbox_enabled" {
@@ -15,26 +9,32 @@ variable "jumpbox_enabled" {
 }
 
 variable "jenkins_workers" {
-  description = "A list of strings describing workers. Lists are of the form: label,instance_type,number_of_executors}"
-
+  type        = list(object({ label = string, instance_type = string, executors = number }))
+  description = "OPTIONAL: A list of objects describing workers."
   default = [
-    "general,t3.medium,6",
-    "general,t3.medium,6",
+    {
+      label         = "general",
+      instance_type = "t3.medium",
+      executors     = 6
+    }
   ]
 }
 
 variable "jenkins_image" {
-  description = "OPTIONAL: the image name for the container to use for the jenkins primary"
-  default     = "adhocteam/jenkins:latest"
+  type        = string
+  description = "OPTIONAL: the tag for adhocteam/jenkins to use for the primary"
+  default     = "latest"
 }
 
 variable "jenkins_github_user" {
-  description = "GitHub account to use for Jenkins admin features (e.g., setting up hooks) and posting messages"
+  type        = string
+  description = "OPTIONAL: GitHub account to use for Jenkins admin features (e.g., setting up hooks) and posting messages"
   default     = "jenkins-adhoc-team"
 }
 
 variable "teleport_github_team" {
-  description = "GitHub team who can SSH via Teleport proxy"
+  type        = string
+  description = "OPTIONAL: GitHub team who can SSH via Teleport proxy"
   default     = "infrastructure-team"
 }
 
diff --git a/variables.tf b/variables.tf
index cfe16f3..61ac3fb 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1,18 +1,39 @@
 variable "env" {
+  type        = string
   description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
 }
 
 variable "domain_name" {
-  description = "the external domain name for reaching the public resources. must have a certificate in ACM associated with it."
+  type        = string
+  description = "the external domain name for reaching the public resources."
 }
 
-variable "cidr" {
-  description = "the CIDR block to provision for the VPC. it should be a /16 block"
+variable "cidr_block" {
+  type        = string
+  description = "OPTIONAL: the CIDR block to provision for the VPC. it should be a /16 block"
   default     = "10.1.0.0/16"
 }
 
 variable "region" {
-  description = "the preferred AWS region for resources."
+  type        = string
+  description = "OPTIONAL: the preferred AWS region for resources."
   default     = "us-east-1"
 }
 
+variable "ssh_key" {
+  type        = string
+  description = "OPTIONAL: the name of an AWS key pair to use for jumpbox and instance access"
+  default     = "infrastructure"
+}
+
+variable "public_ingress" {
+  type        = bool
+  description = "OPTIONAL: whether or not to expose the ingress publicly. If not, must provide a reverse proxy to it."
+  default     = true
+}
+
+variable "primary" {
+  type        = bool
+  description = "OPTIONAL: whether or not this is the primary environment (e.g., the first created). normally this will be the dev environment"
+  default     = true
+}
diff --git a/versions.tf b/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/vpc/data.tf b/vpc/data.tf
index 7a076bd..95183d6 100644
--- a/vpc/data.tf
+++ b/vpc/data.tf
@@ -1,3 +1,3 @@
-data "aws_availability_zones" "available" {
-}
+data "aws_region" "current" {}
+data "aws_availability_zones" "available" {}
 
diff --git a/vpc/main.tf b/vpc/main.tf
index f601d16..f5f62fa 100644
--- a/vpc/main.tf
+++ b/vpc/main.tf
@@ -5,6 +5,11 @@
 ###  - Internet Gateways
 ###  - Elastic IPs
 ###  - NAT Instances
+###  - VPC Endpoints
+
+terraform {
+  required_version = ">= 0.12"
+}
 
 ####
 # VPC with internal DNS support
@@ -117,7 +122,7 @@ resource "aws_route_table" "public_igw" {
 
 resource "aws_route_table_association" "public_with_igw" {
   count          = 3
-  subnet_id      = element(aws_subnet.public.*.id, count.index)
+  subnet_id      = aws_subnet.public[count.index].id
   route_table_id = aws_route_table.public_igw.id
 }
 
@@ -129,7 +134,8 @@ resource "aws_eip" "nats" {
   count = 3
   vpc   = true
 
-  # Note: EIP may require IGW to exist prior to association. Use depends_on to set an explicit dependency on the IGW.
+  # Note: EIP may require IGW to exist prior to association.
+  # Use depends_on to set an explicit dependency on the IGW.
   # https://www.terraform.io/docs/providers/aws/r/eip.html
   depends_on = [aws_internet_gateway.igw]
 
@@ -142,8 +148,8 @@ resource "aws_eip" "nats" {
 
 resource "aws_nat_gateway" "nats" {
   count         = 3
-  allocation_id = element(aws_eip.nats.*.id, count.index)
-  subnet_id     = element(aws_subnet.public.*.id, count.index)
+  allocation_id = aws_eip.nats[count.index].id
+  subnet_id     = aws_subnet.public[count.index].id
 
   tags = {
     env       = var.env
@@ -158,7 +164,7 @@ resource "aws_route_table" "nats" {
 
   route {
     cidr_block     = "0.0.0.0/0"
-    nat_gateway_id = element(aws_nat_gateway.nats.*.id, count.index)
+    nat_gateway_id = aws_nat_gateway.nats[count.index].id
   }
 
   tags = {
@@ -170,7 +176,21 @@ resource "aws_route_table" "nats" {
 
 resource "aws_route_table_association" "app_with_nat" {
   count          = 3
-  subnet_id      = element(aws_subnet.application.*.id, count.index)
-  route_table_id = element(aws_route_table.nats.*.id, count.index)
+  subnet_id      = aws_subnet.application[count.index].id
+  route_table_id = aws_route_table.nats[count.index].id
+}
+
+######
+# VPC Endpoints
+######
+
+locals {
+  route_tables = concat([aws_route_table.public_igw], aws_route_table.nats)
+}
+
+resource "aws_vpc_endpoint" "s3" {
+  vpc_id          = aws_vpc.primary.id
+  service_name    = "com.amazonaws.${data.aws_region.current.name}.s3"
+  route_table_ids = local.route_tables[*].id
 }
 
diff --git a/vpc/outputs.tf b/vpc/outputs.tf
index 057ff56..189228d 100644
--- a/vpc/outputs.tf
+++ b/vpc/outputs.tf
@@ -1,4 +1,35 @@
 output "id" {
-  value = aws_vpc.primary.id
+  description = "id of the primary VPC created by the module"
+  value       = aws_vpc.primary.id
+}
+
+output "cidr_block" {
+  description = "the CIDR block to provisioned in the VPC. it is a /16 block"
+  value       = var.cidr
+}
+
+output "availability_zones" {
+  description = "the three availability zones in which this VPC has subnets"
+  value       = slice(data.aws_availability_zones.available.names, 0, 2)
+}
+
+output "internal_dns" {
+  description = "the internal dns zone for the vpc"
+  value       = aws_route53_zone.internal
+}
+
+output "application" {
+  description = "list of application subnets in the VPC"
+  value       = aws_subnet.application[*]
+}
+
+output "public" {
+  description = "list of public subnets in the VPC"
+  value       = aws_subnet.public[*]
+}
+
+output "data" {
+  description = "list of database subnets in the VPC"
+  value       = aws_subnet.data[*]
 }
 
diff --git a/vpc/variables.tf b/vpc/variables.tf
index b8c566a..8b0ec94 100644
--- a/vpc/variables.tf
+++ b/vpc/variables.tf
@@ -1,9 +1,11 @@
 variable "env" {
+  type        = string
   description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
 }
 
 variable "cidr" {
-  description = "the CIDR block to provision for the VPC. it should be a /16 block"
+  type        = string
+  description = "OPTIONAL: the CIDR block to provision for the VPC. it should be a /16 block"
   default     = "10.1.0.0/16"
 }
 
diff --git a/vpc/versions.tf b/vpc/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/vpc/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}
diff --git a/wildcard_cert/data.tf b/wildcard_cert/data.tf
index a66feaf..b906325 100644
--- a/wildcard_cert/data.tf
+++ b/wildcard_cert/data.tf
@@ -3,7 +3,11 @@
 #######
 
 data "aws_route53_zone" "external" {
-  name         = var.root_domain
+  name         = var.domain_name
   private_zone = false
 }
 
+data "aws_acm_certificate" "primary" {
+  count  = var.primary ? 0 : 1
+  domain = var.domain_name
+}
diff --git a/wildcard_cert/main.tf b/wildcard_cert/main.tf
index 1c4b983..5fe50ac 100644
--- a/wildcard_cert/main.tf
+++ b/wildcard_cert/main.tf
@@ -2,16 +2,21 @@
 # Creates a DNS CNAME record for a subdomain and a certificate that is valid for it.
 #######
 
+terraform {
+  required_version = ">= 0.12"
+}
+
 resource "aws_acm_certificate" "domain" {
-  domain_name               = var.domain
-  subject_alternative_names = ["*.${var.domain}"]
+  count                     = var.primary ? 1 : 0
+  domain_name               = var.domain_name
+  subject_alternative_names = ["*.${var.domain_name}"]
 
   validation_method = "DNS"
 
   tags = {
     terraform = "true"
     env       = var.env
-    Name      = "wildcard-${var.domain}"
+    Name      = "wildcard-${var.domain_name}"
   }
 
   lifecycle {
@@ -20,17 +25,18 @@ resource "aws_acm_certificate" "domain" {
 }
 
 resource "aws_acm_certificate_validation" "domain" {
-  certificate_arn         = aws_acm_certificate.domain.arn
-  validation_record_fqdns = aws_route53_record.validation.*.fqdn
+  count                   = var.primary ? 1 : 0
+  certificate_arn         = aws_acm_certificate.domain[0].arn
+  validation_record_fqdns = aws_route53_record.validation[*].fqdn
 }
 
 # Only need to validate the first record because the wildcard entry will use the same DNS record
 resource "aws_route53_record" "validation" {
-  count   = "2"
-  name    = aws_acm_certificate.domain.domain_validation_options[count.index]["resource_record_name"]
-  type    = aws_acm_certificate.domain.domain_validation_options[count.index]["resource_record_type"]
+  count   = var.primary ? 1 : 0
+  name    = aws_acm_certificate.domain[0].domain_validation_options[0]["resource_record_name"]
+  type    = aws_acm_certificate.domain[0].domain_validation_options[0]["resource_record_type"]
   zone_id = data.aws_route53_zone.external.id
-  records = [aws_acm_certificate.domain.domain_validation_options[count.index]["resource_record_value"]]
+  records = [aws_acm_certificate.domain[0].domain_validation_options[0]["resource_record_value"]]
   ttl     = 60
 }
 
diff --git a/wildcard_cert/outputs.tf b/wildcard_cert/outputs.tf
index fa1df3d..6c901d3 100644
--- a/wildcard_cert/outputs.tf
+++ b/wildcard_cert/outputs.tf
@@ -1,4 +1,8 @@
+
+locals {
+  arn = var.primary ? aws_acm_certificate.domain[0].arn : data.aws_acm_certificate.primary[0].arn
+}
 output "arn" {
-  value = aws_acm_certificate.domain.arn
+  value = local.arn
 }
 
diff --git a/wildcard_cert/variables.tf b/wildcard_cert/variables.tf
index 9878819..306bded 100644
--- a/wildcard_cert/variables.tf
+++ b/wildcard_cert/variables.tf
@@ -1,12 +1,15 @@
 variable "env" {
+  type        = string
   description = "the name of the environment, e.g. \"testing\". it must be unique in the account."
 }
 
-variable "root_domain" {
+variable "domain_name" {
+  type        = string
   description = "the external domain name for reaching the public resources, e.g. domain.name. must already be in route53"
 }
 
-variable "domain" {
-  description = "the Fully Qualified Domain Name for the new cert, e.g., beta.api.domain.name. Use .fqdn attribute from an aws_route53_record"
+variable "primary" {
+  type        = bool
+  description = "OPTIONAL: if true create a certificate, otherwise find an existing one"
+  default     = true
 }
-
diff --git a/wildcard_cert/versions.tf b/wildcard_cert/versions.tf
deleted file mode 100644
index ac97c6a..0000000
--- a/wildcard_cert/versions.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-
-terraform {
-  required_version = ">= 0.12"
-}