diff --git a/.github/workflows/infrastructure.yml b/.github/workflows/infrastructure.yml
index 1148ac47..1bfb1326 100644
--- a/.github/workflows/infrastructure.yml
+++ b/.github/workflows/infrastructure.yml
@@ -109,12 +109,12 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
-      - name: Terraform apply
-        if: github.ref == 'refs/heads/production'
-        run: terraform apply prod.plan
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      # - name: Terraform apply
+      #   if: github.ref == 'refs/heads/production'
+      #   run: terraform apply prod.plan
+      #   env:
+      #     AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      #     AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - if: ${{ always() }}
         run: rm prod.plan || true
diff --git a/infrastructure/api_gateway_alarms.tf b/infrastructure/api_gateway_alarms.tf
deleted file mode 100644
index 2c04484e..00000000
--- a/infrastructure/api_gateway_alarms.tf
+++ /dev/null
@@ -1,20 +0,0 @@
-resource "aws_cloudwatch_metric_alarm" "api_error_rate" {
-  alarm_name          = "${var.log_metric_api_error_rate}-alarm"
-  alarm_description   = "The percentage of API calls returning a 5xx error exceeds 5%"
-  metric_name         = "5XXError"
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  period              = 60
-  evaluation_periods  = 2
-  threshold           = 0.05
-  statistic           = "Average"
-  unit                = "Count"
-  treat_missing_data  = "notBreaching"
-  namespace           = var.log_metric_namespace
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_medium
-  }
-}
diff --git a/infrastructure/cloudtrail.tf b/infrastructure/cloudtrail.tf
deleted file mode 100644
index 798e51c8..00000000
--- a/infrastructure/cloudtrail.tf
+++ /dev/null
@@ -1,141 +0,0 @@
-
-resource "aws_cloudtrail" "all-events" {
-  name                       = var.cloudtrail_name
-  s3_bucket_name             = var.cloudtrail_bucket_name
-  kms_key_id                 = aws_kms_key.key.arn
-  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*"
-  cloud_watch_logs_role_arn  = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.cloudtrail_role_name}"
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-  event_selector {
-    read_write_type           = "All"
-    include_management_events = true
-    data_resource {
-      type   = "AWS::S3::Object"
-      values = ["arn:aws:s3"]
-    }
-    data_resource {
-      type   = "AWS::Lambda::Function"
-      values = ["arn:aws:lambda"]
-    }
-  }
-  enable_log_file_validation = true
-  is_multi_region_trail      = true
-}
-
-resource "aws_s3_bucket" "cloudtrail_bucket" {
-  bucket        = var.cloudtrail_bucket_name
-  force_destroy = true
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_cloudwatch_log_group" "cloudtrail" {
-  name              = var.cloudtrail_log_group_name
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "cloudtrail_bucket" {
-  bucket = aws_s3_bucket.cloudtrail_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_versioning" "cloudtrail_bucket" {
-  bucket = aws_s3_bucket.cloudtrail_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_logging" "cloudtrail_bucket" {
-  bucket        = aws_s3_bucket.cloudtrail_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "cloudtrail_bucket/"
-}
-
-resource "aws_s3_bucket_policy" "cloudtrail_bucket" {
-  bucket = aws_s3_bucket.cloudtrail_bucket.id
-  policy = data.template_file.cloudtrail_bucket_policy.rendered
-}
-
-resource "aws_iam_role" "cloudtrail_role" {
-  name = var.cloudtrail_role_name
-  assume_role_policy = jsonencode({
-    Version : "2012-10-17",
-    Statement : [
-      {
-        Action : "sts:AssumeRole",
-        Principal : {
-          Service : [
-            "cloudtrail.amazonaws.com"
-          ]
-        },
-        Effect : "Allow",
-        Sid : "CloudTrailServiceRole"
-      }
-    ]
-  })
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-data "template_file" "cloudtrail_bucket_policy" {
-  template = file("cloudtrail_bucket_policy.tpl")
-  vars = {
-    bucketName = var.cloudtrail_bucket_name
-    accountId  = data.aws_caller_identity.current.account_id
-  }
-}
-
-# Attach policies to the IAM role allowing access to the S3 bucket and Cloudwatch
-resource "aws_iam_role_policy" "cloudtrail_s3_policy" {
-  name_prefix = "crossfeed-cloudtrail-s3-${var.stage}"
-  role        = aws_iam_role.cloudtrail_role.id
-  policy = jsonencode({
-    Version = "2012-10-17",
-    Statement = [{
-      Action = [
-        "s3:PutObject",
-        "s3:GetBucketAcl",
-        "s3:ListBucket"
-      ],
-      Effect = "Allow",
-      Resource = [
-        aws_s3_bucket.cloudtrail_bucket.arn,
-        "${aws_s3_bucket.cloudtrail_bucket.arn}/*"
-      ]
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "cloudtrail_cloudwatch_policy" {
-  name_prefix = "crossfeed-cloudtrail-cloudwatch-${var.stage}"
-  role        = aws_iam_role.cloudtrail_role.id
-  policy = jsonencode({
-    Version = "2012-10-17",
-    Statement = [{
-      Action = [
-        "logs:CreateLogGroup",
-        "logs:CreateLogStream",
-        "logs:PutLogEvents"
-      ],
-      Effect   = "Allow",
-      Resource = "arn:aws:logs:*"
-    }]
-  })
-}
diff --git a/infrastructure/cloudtrail_bucket_policy.tpl b/infrastructure/cloudtrail_bucket_policy.tpl
deleted file mode 100644
index 5067a5c4..00000000
--- a/infrastructure/cloudtrail_bucket_policy.tpl
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "AWSCloudTrailAclCheck20121017",
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "cloudtrail.amazonaws.com"
-      },
-      "Action": ["s3:GetBucketAcl"],
-      "Resource": ["arn:aws:s3:::${bucketName}"]
-    },
-    {
-      "Sid": "AWSCloudTrailWrite20121017",
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "cloudtrail.amazonaws.com"
-      },
-      "Action": ["s3:PutObject"],
-      "Resource": [
-        "arn:aws:s3:::${bucketName}/AWSLogs/${accountId}",
-        "arn:aws:s3:::${bucketName}/AWSLogs/${accountId}/*"
-      ],
-      "Condition": {
-        "StringEquals": {
-          "s3:x-amz-acl": "bucket-owner-full-control"
-        }
-      }
-    },
-    {
-      "Sid": "RequireSSLRequests",
-      "Action": "s3:*",
-      "Effect": "Deny",
-      "Principal": "*",
-      "Resource": [
-        "arn:aws:s3:::${bucketName}",
-        "arn:aws:s3:::${bucketName}/*"
-      ],
-      "Condition": {
-        "Bool": {
-          "aws:SecureTransport": "false"
-        }
-      }
-    }
-  ]
-}
diff --git a/infrastructure/cloudwatch.tf b/infrastructure/cloudwatch.tf
deleted file mode 100644
index c6677e3e..00000000
--- a/infrastructure/cloudwatch.tf
+++ /dev/null
@@ -1,90 +0,0 @@
-resource "aws_s3_bucket" "cloudwatch_bucket" {
-  bucket = var.cloudwatch_bucket_name
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-# TODO: update retention_in_days based on developing requirements
-resource "aws_cloudwatch_log_group" "cloudwatch_bucket" {
-  name              = var.cloudwatch_log_group_name
-  retention_in_days = 365
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_policy" "cloudwatch_bucket" {
-  bucket = aws_s3_bucket.cloudwatch_bucket.id
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [
-      {
-        "Sid" : "AWSLogDeliveryGetBucketACL",
-        "Effect" : "Allow",
-        "Principal" : {
-          "Service" : "logs.amazonaws.com"
-        },
-        "Action" : "s3:GetBucketAcl",
-        "Resource" : aws_s3_bucket.cloudwatch_bucket.arn
-      },
-      {
-        "Sid" : "AWSLogDeliveryWrite",
-        "Effect" : "Allow",
-        "Principal" : {
-          "Service" : "logs.amazonaws.com"
-        },
-        "Action" : "s3:PutObject",
-        "Resource" : [
-          aws_s3_bucket.cloudwatch_bucket.arn,
-          "${aws_s3_bucket.cloudwatch_bucket.arn}/*"
-        ],
-        "Condition" : {
-          "StringEquals" : {
-            "s3:x-amz-acl" : "bucket-owner-full-control"
-          }
-        }
-      },
-      {
-        "Sid" : "RequireSSLRequests",
-        "Action" : "s3:*",
-        "Effect" : "Deny",
-        "Principal" : "*",
-        "Resource" : [
-          aws_s3_bucket.cloudwatch_bucket.arn,
-          "${aws_s3_bucket.cloudwatch_bucket.arn}/*"
-        ],
-        "Condition" : {
-          "Bool" : {
-            "aws:SecureTransport" : "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
-resource "aws_s3_bucket_logging" "cloudwatch_bucket" {
-  bucket        = aws_s3_bucket.cloudwatch_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "cloudwatch_bucket/"
-}
-
-resource "aws_s3_bucket_versioning" "cloudwatch_bucket" {
-  bucket = aws_s3_bucket.cloudwatch_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "cloudwatch_bucket" {
-  bucket = aws_s3_bucket.cloudwatch_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
diff --git a/infrastructure/database.tf b/infrastructure/database.tf
deleted file mode 100644
index c0a1b8ac..00000000
--- a/infrastructure/database.tf
+++ /dev/null
@@ -1,392 +0,0 @@
-data "aws_ssm_parameter" "db_password" { name = var.ssm_db_password }
-data "aws_ssm_parameter" "db_username" { name = var.ssm_db_username }
-
-resource "aws_db_subnet_group" "default" {
-  name       = var.db_group_name
-  subnet_ids = [aws_subnet.db_1.id, aws_subnet.db_2.id]
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_db_parameter_group" "default" {
-  name   = "crossfeed-${var.stage}-postgres15"
-  family = "postgres15"
-
-  parameter {
-    name  = "rds.force_ssl"
-    value = "0"
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_db_instance" "db" {
-  identifier                          = var.db_name
-  instance_class                      = var.db_instance_class
-  allocated_storage                   = 1000
-  max_allocated_storage               = 10000
-  storage_type                        = "gp2"
-  engine                              = "postgres"
-  engine_version                      = "15.5"
-  allow_major_version_upgrade         = false
-  skip_final_snapshot                 = true
-  availability_zone                   = data.aws_availability_zones.available.names[0]
-  multi_az                            = false
-  backup_retention_period             = 35
-  storage_encrypted                   = true
-  iam_database_authentication_enabled = true
-  enabled_cloudwatch_logs_exports     = ["postgresql", "upgrade"]
-
-  // database information
-  db_name  = var.db_table_name
-  username = data.aws_ssm_parameter.db_username.value
-  password = data.aws_ssm_parameter.db_password.value
-  port     = var.db_port
-
-  db_subnet_group_name = aws_db_subnet_group.default.name
-  parameter_group_name = aws_db_parameter_group.default.name
-
-  vpc_security_group_ids = [aws_security_group.allow_internal.id]
-
-  tags = {
-    Project = "Crossfeed"
-  }
-}
-
-data "aws_ami" "ubuntu" {
-
-  most_recent = true
-
-  filter {
-    name   = "name"
-    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
-  }
-
-  filter {
-    name   = "virtualization-type"
-    values = ["hvm"]
-  }
-
-  # Canonical
-  owners = ["099720109477"]
-}
-
-# DB Accessor EC2
-resource "aws_instance" "db_accessor" {
-  count                       = var.create_db_accessor_instance ? 1 : 0
-  ami                         = data.aws_ami.ubuntu.id
-  instance_type               = var.db_accessor_instance_class
-  associate_public_ip_address = false
-
-  tags = {
-    Name    = "${var.project}-${var.stage}-db-accessor"
-    Project = var.project
-    Stage   = var.stage
-  }
-
-  root_block_device {
-    volume_size = 1000
-  }
-
-  vpc_security_group_ids = [aws_security_group.allow_internal.id]
-  subnet_id              = aws_subnet.backend.id
-
-  iam_instance_profile = aws_iam_instance_profile.db_accessor.id
-  user_data            = file("./ssm-agent-install.sh")
-
-  lifecycle {
-    # prevent_destroy = true
-    ignore_changes = [ami]
-  }
-}
-
-resource "aws_iam_role" "db_accessor" {
-  name               = "crossfeed-db-accessor-${var.stage}"
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-#Instance Profile
-resource "aws_iam_instance_profile" "db_accessor" {
-  name = "crossfeed-db-accessor-${var.stage}"
-  role = aws_iam_role.db_accessor.id
-}
-
-#Attach Policies to Instance Role
-resource "aws_iam_policy_attachment" "db_accessor_1" {
-  name       = "crossfeed-db-accessor-${var.stage}"
-  roles      = [aws_iam_role.db_accessor.id]
-  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
-}
-
-resource "aws_iam_policy_attachment" "db_accessor_2" {
-  name       = "crossfeed-db-accessor-${var.stage}"
-  roles      = [aws_iam_role.db_accessor.id]
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
-}
-
-resource "aws_iam_role_policy" "db_accessor_s3_policy" {
-  name_prefix = "crossfeed-db-accessor-s3-${var.stage}"
-  role        = aws_iam_role.db_accessor.id
-  policy      = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "s3:*"
-      ],
-      "Resource": ["${aws_s3_bucket.reports_bucket.arn}", "${aws_s3_bucket.reports_bucket.arn}/*", "${aws_s3_bucket.pe_db_backups_bucket.arn}", "${aws_s3_bucket.pe_db_backups_bucket.arn}/*"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "lambda:InvokeFunction"
-      ],
-      "Resource": ["*"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ecs:ListTasks",
-        "ecs:DescribeTasks",
-        "ecs:ListClusters",
-        "ecs:DescribeClusters"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "sqs_send_message_policy" {
-  name_prefix = "ec2-send-sqs-message-${var.stage}"
-  role        = aws_iam_role.db_accessor.id
-  policy = jsonencode({
-    Version = "2012-10-17",
-    Statement = [
-      {
-        Action = [
-          "sqs:SendMessage",
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ListQueues",
-          "sqs:GetQueueUrl"
-        ],
-        Effect   = "Allow",
-        Resource = "*"
-      }
-    ]
-  })
-}
-
-# Lambda and Fargate SSM Parameters
-resource "aws_ssm_parameter" "lambda_sg_id" {
-  name      = var.ssm_lambda_sg
-  type      = "String"
-  value     = aws_security_group.allow_internal.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "lambda_subnet_id" {
-  name      = var.ssm_lambda_subnet
-  type      = "String"
-  value     = aws_subnet.backend.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "worker_sg_id" {
-  name      = var.ssm_worker_sg
-  type      = "String"
-  value     = aws_security_group.worker.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "worker_subnet_id" {
-  name      = var.ssm_worker_subnet
-  type      = "String"
-  value     = aws_subnet.worker.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "crossfeed_send_db_host" {
-  name      = var.ssm_db_host
-  type      = "SecureString"
-  value     = aws_db_instance.db.address
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "crossfeed_send_db_name" {
-  name      = var.ssm_db_name
-  type      = "SecureString"
-  value     = aws_db_instance.db.name
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-# Reports S3 Bucket
-resource "aws_s3_bucket" "reports_bucket" {
-  bucket = var.reports_bucket_name
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_policy" "reports_bucket" {
-  bucket = var.reports_bucket_name
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [
-      {
-        "Sid" : "RequireSSLRequests",
-        "Action" : "s3:*",
-        "Effect" : "Deny",
-        "Principal" : "*",
-        "Resource" : [
-          aws_s3_bucket.reports_bucket.arn,
-          "${aws_s3_bucket.reports_bucket.arn}/*"
-        ],
-        "Condition" : {
-          "Bool" : {
-            "aws:SecureTransport" : "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
-resource "aws_s3_bucket_acl" "reports_bucket" {
-  bucket = aws_s3_bucket.reports_bucket.id
-  acl    = "private"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "reports_bucket" {
-  bucket = aws_s3_bucket.reports_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_versioning" "reports_bucket" {
-  bucket = aws_s3_bucket.reports_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_logging" "reports_bucket" {
-  bucket        = aws_s3_bucket.reports_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "reports_bucket/"
-}
-
-# P&E DB Backups S3 bucket
-resource "aws_s3_bucket" "pe_db_backups_bucket" {
-  bucket = var.pe_db_backups_bucket_name
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_policy" "pe_db_backups_bucket" {
-  bucket = aws_s3_bucket.pe_db_backups_bucket.id
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [
-      {
-        "Sid" : "RequireSSLRequests",
-        "Action" : "s3:*",
-        "Effect" : "Deny",
-        "Principal" : "*",
-        "Resource" : [
-          aws_s3_bucket.pe_db_backups_bucket.arn,
-          "${aws_s3_bucket.pe_db_backups_bucket.arn}/*"
-        ],
-        "Condition" : {
-          "Bool" : {
-            "aws:SecureTransport" : "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
-resource "aws_s3_bucket_acl" "pe_db_backups_bucket" {
-  bucket = aws_s3_bucket.pe_db_backups_bucket.id
-  acl    = "private"
-}
-resource "aws_s3_bucket_server_side_encryption_configuration" "pe_db_backups_bucket" {
-  bucket = aws_s3_bucket.pe_db_backups_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_versioning" "pe_db_backups_bucket" {
-  bucket = aws_s3_bucket.pe_db_backups_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_logging" "pe_db_backups_bucket" {
-  bucket        = aws_s3_bucket.pe_db_backups_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "pe_db_backups_bucket/"
-}
diff --git a/infrastructure/elastic.tf b/infrastructure/elastic.tf
deleted file mode 100644
index 6e380347..00000000
--- a/infrastructure/elastic.tf
+++ /dev/null
@@ -1,29 +0,0 @@
-//This is intended to be used to create a ubuntu instance that will be used to start and mainain a ELK stack
-
-resource "aws_instance" "elk_stack" {
-  count                       = var.create_elk_instance ? 1 : 0
-  ami                         = data.aws_ami.ubuntu.id
-  instance_type               = var.elk_instance_class
-  associate_public_ip_address = false
-
-  tags = {
-    Name    = "${var.project}-${var.stage}-elk-stack"
-    Project = var.project
-    Stage   = var.stage
-  }
-
-  root_block_device {
-    volume_size = 1000
-  }
-
-  vpc_security_group_ids = [aws_security_group.allow_internal.id]
-  subnet_id              = aws_subnet.backend.id
-
-  iam_instance_profile = aws_iam_instance_profile.db_accessor.id
-  user_data            = file("./ssm-agent-install.sh")
-
-  lifecycle {
-    # prevent_destroy = true
-    ignore_changes = [ami]
-  }
-}
diff --git a/infrastructure/elasticache.tf b/infrastructure/elasticache.tf
deleted file mode 100644
index dfd09825..00000000
--- a/infrastructure/elasticache.tf
+++ /dev/null
@@ -1,94 +0,0 @@
-resource "aws_security_group" "elasticache_security_group" {
-  name_prefix = "elasticache-"
-  description = "ElastiCache security group"
-  vpc_id      = aws_vpc.crossfeed_vpc.id
-  ingress {
-    from_port   = 6379
-    to_port     = 6379
-    protocol    = "tcp"
-    cidr_blocks = [aws_vpc.crossfeed_vpc.cidr_block] // Dynamically restrict to a specific CIDR block, ideally your VPC's CIDR
-  }
-}
-
-resource "aws_elasticache_subnet_group" "crossfeed_vpc" {
-  name       = "crossfeed-vpc-subnet-group"
-  subnet_ids = [aws_subnet.backend.id]
-
-  tags = {
-    Name = "crossfeed_vpc"
-  }
-}
-
-resource "aws_elasticache_parameter_group" "xfd_redis_group" {
-  name   = "my-redis7-1"
-  family = "redis7"
-
-  parameter {
-    name  = "maxmemory-policy"
-    value = "allkeys-lru"
-  }
-}
-
-resource "aws_elasticache_cluster" "crossfeed_vpc_elasticache_cluster" {
-  count                = var.create_elasticache_cluster ? 1 : 0
-  cluster_id           = "crossfeed-vpc-cluster"
-  engine               = "redis"
-  node_type            = "cache.r7g.xlarge"
-  num_cache_nodes      = 1
-  parameter_group_name = aws_elasticache_parameter_group.xfd_redis_group.name
-  engine_version       = "7.1"
-  port                 = 6379
-  subnet_group_name    = aws_elasticache_subnet_group.crossfeed_vpc.name
-  security_group_ids   = [aws_security_group.elasticache_security_group.id]
-
-  tags = {
-    Name    = "crossfeed_vpc_elasticache-cluster"
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_iam_policy" "elasticache_policy" {
-  name        = "elasticache_policy"
-  description = "Policy to allow ElastiCache operations"
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "elasticache:CreateCacheCluster",
-          "elasticache:CreateCacheSubnetGroup",
-          "elasticache:DeleteCacheSubnetGroup",
-          "elasticache:DescribeCacheSubnetGroups",
-          "elasticache:DescribeCacheClusters",
-          "elasticache:DescribeCacheEngineVersions",
-          "elasticache:DescribeCacheSecurityGroups",
-          "elasticache:DescribeCacheParameters",
-          "elasticache:DescribeCacheParameterGroups",
-          "elasticache:ModifyCacheSubnetGroup",
-          "elasticache:AddTagsToResource",
-          "elasticache:ListTagsForResource",
-          "elasticache:CreateCacheParameterGroup",
-          "elasticache:DeleteCacheParameterGroup",
-          "elasticache:DescribeCacheParameterGroups",
-          "elasticache:ModifyCacheParameterGroup",
-          "iam:ListAttachedUserPolicies",
-          "iam:CreatePolicy",
-          "iam:CreatePolicyVersion",
-          "iam:AttachUserPolicy",
-          "iam:GetPolicyVersion",
-          "iam:ListPolicyVersions",
-          "iam:DeletePolicy",
-          "iam:DetachUserPolicy"
-        ]
-        Resource = "*"
-      }
-    ]
-  })
-}
-
-resource "aws_iam_user_policy_attachment" "elasticache_user_policy_attachment" {
-  user       = "crossfeed-deploy-staging"
-  policy_arn = aws_iam_policy.elasticache_policy.arn
-}
diff --git a/infrastructure/es.tf b/infrastructure/es.tf
deleted file mode 100644
index 8e8d5985..00000000
--- a/infrastructure/es.tf
+++ /dev/null
@@ -1,148 +0,0 @@
-data "aws_region" "current" {}
-
-data "aws_caller_identity" "current" {}
-
-resource "aws_elasticsearch_domain" "es" {
-  domain_name           = "crossfeed-${var.stage}"
-  elasticsearch_version = "7.7"
-
-  cluster_config {
-    instance_type            = var.es_instance_type
-    instance_count           = var.es_instance_count
-    dedicated_master_enabled = false
-
-    # Enable for prod:
-    # zone_awareness_enabled = true
-    # zone_awareness_config {
-    #   availability_zone_count = 2
-    # }
-  }
-
-  # Allow all IPs within the private subnet to access this domain.
-  # This allows us to make requests to this ES domain without
-  # having to AWS-sign each request.
-  access_policies = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "es:ESHttp*",
-      "Principal": "*",
-      "Effect": "Allow",
-      "Resource": "arn:aws:es:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:domain/crossfeed-${var.stage}/*"
-    }
-  ]
-}
-POLICY
-
-  vpc_options {
-    subnet_ids         = [aws_subnet.es_1.id]
-    security_group_ids = [aws_security_group.allow_internal.id]
-  }
-
-  #   Only supported on certain instance types, so let's only enable this on prod: https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-instance-types.html
-  encrypt_at_rest {
-    enabled = true
-  }
-
-  node_to_node_encryption {
-    enabled = true
-  }
-
-  snapshot_options {
-    automated_snapshot_start_hour = 0
-  }
-
-  domain_endpoint_options {
-    enforce_https       = true
-    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
-  }
-
-  log_publishing_options {
-    cloudwatch_log_group_arn = aws_cloudwatch_log_group.es_application.arn
-    log_type                 = "ES_APPLICATION_LOGS"
-  }
-
-  log_publishing_options {
-    cloudwatch_log_group_arn = aws_cloudwatch_log_group.es_index_slow.arn
-    log_type                 = "INDEX_SLOW_LOGS"
-  }
-
-  log_publishing_options {
-    cloudwatch_log_group_arn = aws_cloudwatch_log_group.es_search_slow.arn
-    log_type                 = "SEARCH_SLOW_LOGS"
-  }
-
-  ebs_options {
-    ebs_enabled = true
-    volume_size = var.es_instance_volume_size
-  }
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_cloudwatch_log_resource_policy" "es" {
-  policy_name     = "crossfeed-${var.stage}"
-  policy_document = <<CONFIG
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "es.amazonaws.com"
-      },
-      "Action": [
-        "logs:PutLogEvents",
-        "logs:PutLogEventsBatch",
-        "logs:CreateLogStream"
-      ],
-      "Resource": "arn:aws:logs:*"
-    }
-  ]
-}
-CONFIG
-}
-
-resource "aws_cloudwatch_log_group" "es_application" {
-  name              = "crossfeed-${var.stage}-es-application"
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_cloudwatch_log_group" "es_index_slow" {
-  name              = "crossfeed-${var.stage}-es-index-slow"
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_cloudwatch_log_group" "es_search_slow" {
-  name              = "crossfeed-${var.stage}-es-search-slow"
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_ssm_parameter" "es_endpoint" {
-  name      = "/crossfeed/${var.stage}/ELASTICSEARCH_ENDPOINT"
-  type      = "String"
-  value     = "https://${aws_elasticsearch_domain.es.endpoint}"
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
diff --git a/infrastructure/frontend_bucket_policy.tpl b/infrastructure/frontend_bucket_policy.tpl
deleted file mode 100644
index 8beacee6..00000000
--- a/infrastructure/frontend_bucket_policy.tpl
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "Version":"2012-10-17",
-  "Statement":[
-    {
-      "Sid":"PublicRead",
-      "Effect":"Allow",
-      "Principal": "*",
-      "Action":["s3:GetObject"],
-      "Resource":[
-        "arn:aws:s3:::${bucket_name}/*",
-        "arn:aws:s3:::${bucket_name}/*/"
-      ]
-    },
-    {
-      "Sid": "RequireSSLRequests",
-      "Action": "s3:*",
-      "Effect": "Deny",
-      "Principal": "*",
-      "Resource": [
-        "arn:aws:s3:::${bucket_name}",
-        "arn:aws:s3:::${bucket_name}/*"
-      ],
-      "Condition": {
-        "Bool": {
-          "aws:SecureTransport": "false"
-        }
-      }
-    }
-  ]
-}
diff --git a/infrastructure/kms.tf b/infrastructure/kms.tf
deleted file mode 100644
index 55b687d2..00000000
--- a/infrastructure/kms.tf
+++ /dev/null
@@ -1,185 +0,0 @@
-resource "aws_kms_key" "key" {
-  description             = "KMS key"
-  deletion_window_in_days = 10
-  enable_key_rotation     = true
-  policy = jsonencode({
-    Version : "2012-10-17",
-
-    Id : "key-default-1",
-
-    Statement : [
-      {
-        Sid : "Enable IAM User Permissions",
-
-        Effect : "Allow",
-
-        Principal : {
-          AWS : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
-        },
-
-        Action : [
-          "kms:BypassPolicyLockoutSafetyCheck",
-          "kms:CallerAccount",
-          "kms:CancelKeyDeletion",
-          "kms:ConnectCustomKeyStore",
-          "kms:CreateAlias",
-          "kms:CreateCustomKeyStore",
-          "kms:CreateGrant",
-          "kms:CreateKey",
-          "kms:DataKeyPairSpec",
-          "kms:Decrypt",
-          "kms:DeleteAlias",
-          "kms:DeleteCustomKeyStore",
-          "kms:DeleteImportedKeyMaterial",
-          "kms:DescribeCustomKeyStores",
-          "kms:DescribeKey",
-          "kms:DisableKey",
-          "kms:DisableKeyRotation",
-          "kms:DisconnectCustomKeyStore",
-          "kms:EnableKey",
-          "kms:EnableKeyRotation",
-          "kms:Encrypt",
-          "kms:EncryptionAlgorithm",
-          "kms:EncryptionContextKeys",
-          "kms:ExpirationModel",
-          "kms:GenerateDataKey",
-          "kms:GenerateDataKeyPair",
-          "kms:GenerateDataKeyPairWithoutPlaintext",
-          "kms:GenerateDataKeyWithoutPlaintext",
-          "kms:GenerateMac",
-          "kms:GenerateRandom",
-          "kms:GetKeyPolicy",
-          "kms:GetKeyRotationStatus",
-          "kms:GetParametersForImport",
-          "kms:GetPublicKey",
-          "kms:GrantConstraintType",
-          "kms:GrantIsForAWSResource",
-          "kms:GrantOperations",
-          "kms:GranteePrincipal",
-          "kms:ImportKeyMaterial",
-          "kms:KeyOrigin",
-          "kms:KeySpec",
-          "kms:KeyUsage",
-          "kms:ListAliases",
-          "kms:ListGrants",
-          "kms:ListKeyPolicies",
-          "kms:ListKeys",
-          "kms:ListResourceTags",
-          "kms:ListRetirableGrants",
-          "kms:MacAlgorithm",
-          "kms:MessageType",
-          "kms:MultiRegion",
-          "kms:MultiRegionKeyType",
-          "kms:PrimaryRegion",
-          "kms:PutKeyPolicy",
-          "kms:ReEncryptFrom",
-          "kms:ReEncryptOnSameKey",
-          "kms:ReEncryptTo",
-          "kms:ReplicaRegion",
-          "kms:ReplicateKey",
-          "kms:RequestAlias",
-          "kms:ResourceAliases",
-          "kms:RetireGrant",
-          "kms:RetiringPrincipal",
-          "kms:RevokeGrant",
-          "kms:ScheduleKeyDeletion",
-          "kms:Sign",
-          "kms:SigningAlgorithm",
-          "kms:TagResource",
-          "kms:UntagResource",
-          "kms:UpdateAlias",
-          "kms:UpdateCustomKeyStore",
-          "kms:UpdateKeyDescription",
-          "kms:UpdatePrimaryRegion",
-          "kms:ValidTo",
-          "kms:Verify",
-          "kms:VerifyMac",
-          "kms:ViaService",
-          "kms:WrappingAlgorithm",
-          "kms:WrappingKeySpec"
-        ],
-        Resource : "*"
-      },
-
-      {
-        Effect : "Allow",
-
-        Principal : {
-          Service : "logs.${data.aws_region.current.name}.amazonaws.com"
-        },
-
-        Action : [
-          "kms:Decrypt",
-          "kms:DescribeCustomKeyStores",
-          "kms:DescribeKey",
-          "kms:Encrypt",
-          "kms:EncryptionAlgorithm",
-          "kms:EncryptionContextKeys",
-          "kms:GenerateDataKey",
-          "kms:GenerateDataKeyPair",
-          "kms:GenerateDataKeyPairWithoutPlaintext",
-          "kms:GenerateDataKeyWithoutPlaintext",
-          "kms:ReEncryptFrom",
-          "kms:ReEncryptOnSameKey",
-          "kms:ReEncryptTo"
-        ],
-        Resource : "*",
-
-        Condition : {
-          ArnLike : {
-            "kms:EncryptionContext:aws:logs:arn" : "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"
-          }
-        }
-      },
-      {
-        Sid : "Allow CloudTrail to encrypt logs",
-        Effect : "Allow",
-        Principal : {
-          Service : "cloudtrail.amazonaws.com"
-        },
-        Action : "kms:GenerateDataKey*",
-        Resource : "*",
-        Condition : {
-          StringEquals : {
-            "aws:SourceArn" : "arn:aws:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/${var.cloudtrail_name}"
-          },
-          StringLike : {
-            "kms:EncryptionContext:aws:cloudtrail:arn" : "arn:aws:cloudtrail:*:${data.aws_caller_identity.current.account_id}:trail/*"
-          }
-        }
-      },
-      {
-        "Sid" : "Allow CloudTrail to decrypt a trail",
-        "Effect" : "Allow",
-        "Principal" : {
-          "Service" : "cloudtrail.amazonaws.com"
-        },
-        "Action" : "kms:Decrypt",
-        "Resource" : "*"
-      },
-      {
-        Sid : "Allow CloudTrail access",
-        Effect : "Allow",
-        Principal : {
-          Service : "cloudtrail.amazonaws.com"
-        },
-        Action : "kms:DescribeKey",
-        Resource : "arn:aws:kms:region:${data.aws_caller_identity.current.account_id}:key/*}",
-        Condition : {
-          StringEquals : {
-            "aws:SourceArn" : "arn:aws:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/${var.cloudtrail_name}"
-          }
-        }
-      }
-    ]
-  })
-  tags = {
-    project = var.project
-    stage   = var.stage
-  }
-}
-
-resource "aws_kms_alias" "key" {
-  target_key_id = aws_kms_key.key.id
-  name          = "alias/${var.stage}-key"
-}
diff --git a/infrastructure/log_alarms.tf b/infrastructure/log_alarms.tf
deleted file mode 100644
index 3ff8b4e3..00000000
--- a/infrastructure/log_alarms.tf
+++ /dev/null
@@ -1,321 +0,0 @@
-resource "aws_cloudwatch_metric_alarm" "root_user" {
-  alarm_name          = "${var.log_metric_root_user}-alarm"
-  alarm_description   = "The root user account signed into AWS"
-  metric_name         = var.log_metric_root_user
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "unauthorized_api_call" {
-  alarm_name          = "${var.log_metric_unauthorized_api_call}-alarm"
-  alarm_description   = "An API call returned an unauthorized error"
-  metric_name         = var.log_metric_unauthorized_api_call
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_low
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "login_without_mfa" {
-  alarm_name          = "${var.log_metric_login_without_mfa}-alarm"
-  alarm_description   = "A user logged into AWS without MFA"
-  metric_name         = var.log_metric_login_without_mfa
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "iam_policy" {
-  alarm_name          = "${var.log_metric_iam_policy}-alarm"
-  alarm_description   = "An IAM policy was modified"
-  metric_name         = var.log_metric_iam_policy
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "cloudtrail" {
-  alarm_name          = "${var.log_metric_cloudtrail}-alarm"
-  alarm_description   = "CloudTrail configurations were modified"
-  metric_name         = var.log_metric_cloudtrail
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "login_failure" {
-  alarm_name          = "${var.log_metric_login_failure}-alarm"
-  alarm_description   = "A user sign in to AWS failed"
-  metric_name         = var.log_metric_login_failure
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_low
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "cmk_delete_disable" {
-  alarm_name          = "${var.log_metric_cmk_delete_disable}-alarm"
-  alarm_description   = "A customer-managed key was disabled or scheduled for deletion"
-  metric_name         = var.log_metric_cmk_delete_disable
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_critical
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy" {
-  alarm_name          = "${var.log_metric_s3_bucket_policy}-alarm"
-  alarm_description   = "An S3 bucket policy was modified"
-  metric_name         = var.log_metric_s3_bucket_policy
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "aws_config" {
-  alarm_name          = "${var.log_metric_aws_config}-alarm"
-  alarm_description   = "AWS Config was modified"
-  metric_name         = var.log_metric_aws_config
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "security_group" {
-  alarm_name          = "${var.log_metric_security_group}-alarm"
-  alarm_description   = "A security group was modified"
-  metric_name         = var.log_metric_security_group
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "nacl" {
-  alarm_name          = "${var.log_metric_nacl}-alarm"
-  alarm_description   = "A network ACL was modified"
-  metric_name         = var.log_metric_nacl
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "network_gateway" {
-  alarm_name          = "${var.log_metric_network_gateway}-alarm"
-  alarm_description   = "A network gateway was modified"
-  metric_name         = var.log_metric_network_gateway
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "route_table" {
-  alarm_name          = "${var.log_metric_route_table}-alarm"
-  alarm_description   = "A route table was modified"
-  metric_name         = var.log_metric_route_table
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "vpc" {
-  alarm_name          = "${var.log_metric_vpc}-alarm"
-  metric_name         = var.log_metric_vpc
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_high
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "ec2_shutdown" {
-  alarm_name          = "${var.log_metric_ec2_shutdown}-alarm"
-  alarm_description   = "An EC2 instance was shut down"
-  metric_name         = var.log_metric_ec2_shutdown
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_critical
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "db_shutdown" {
-  alarm_name          = "${var.log_metric_db_shutdown}-alarm"
-  alarm_description   = "An RDS instance was shut down"
-  metric_name         = var.log_metric_db_shutdown
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_critical
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "db_deletion" {
-  alarm_name          = "${var.log_metric_db_deletion}-alarm"
-  alarm_description   = "An RDS instance was deleted"
-  metric_name         = var.log_metric_db_deletion
-  namespace           = var.log_metric_namespace
-  alarm_actions       = [aws_sns_topic.alarms.arn]
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  evaluation_periods  = 1
-  period              = 60
-  threshold           = 1
-  statistic           = "Sum"
-
-  tags = {
-    Project  = var.project
-    Stage    = var.stage
-    Severity = var.severity_critical
-  }
-}
diff --git a/infrastructure/log_filters.tf b/infrastructure/log_filters.tf
deleted file mode 100644
index 56f1d681..00000000
--- a/infrastructure/log_filters.tf
+++ /dev/null
@@ -1,203 +0,0 @@
-resource "aws_cloudwatch_log_metric_filter" "root_user" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_root_user
-  pattern        = "{$.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !=\"AwsServiceEvent\"}"
-  metric_transformation {
-    name          = var.log_metric_root_user
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_call" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_unauthorized_api_call
-  pattern        = "{($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")}"
-  metric_transformation {
-    name          = var.log_metric_unauthorized_api_call
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "login_without_mfa" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_login_without_mfa
-  pattern        = "{($.eventName=\"ConsoleLogin\") && ($.additionalEventData.MFAUsed !=\"Yes\") && ($.userIdentity.type=\"IAMUser\") && ($.responseElements.ConsoleLogin=\"Success\")}"
-  metric_transformation {
-    name          = var.log_metric_login_without_mfa
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "iam_policy" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_iam_policy
-  pattern        = "{($.eventSource=iam.amazonaws.com) && (($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy))}"
-  metric_transformation {
-    name          = var.log_metric_iam_policy
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "cloudtrail" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_cloudtrail
-  pattern        = "{($.eventName=CreateTrail) || ($.eventName=UpdateTrail) || ($.eventName=DeleteTrail) || ($.eventName=StartLogging) || ($.eventName=StopLogging)}"
-  metric_transformation {
-    name          = var.log_metric_cloudtrail
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "login_failure" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_login_failure
-  pattern        = "{($.eventName=ConsoleLogin) && ($.errorMessage=\"Failed authentication\")}"
-  metric_transformation {
-    name          = var.log_metric_login_failure
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "cmk_delete_disable" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_cmk_delete_disable
-  pattern        = "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}"
-  metric_transformation {
-    name          = var.log_metric_cmk_delete_disable
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "s3_bucket_policy" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_s3_bucket_policy
-  pattern        = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}"
-  metric_transformation {
-    name          = var.log_metric_s3_bucket_policy
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "aws_config" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_aws_config
-  pattern        = "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}"
-  metric_transformation {
-    name          = var.log_metric_aws_config
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "security_group" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_security_group
-  pattern        = "{($.eventName=AuthorizeSecurityGroupIngress) || ($.eventName=AuthorizeSecurityGroupEgress) || ($.eventName=RevokeSecurityGroupIngress) || ($.eventName=RevokeSecurityGroupEgress) || ($.eventName=CreateSecurityGroup) || ($.eventName=DeleteSecurityGroup)}"
-  metric_transformation {
-    name          = var.log_metric_security_group
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "nacl" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_nacl
-  pattern        = "{($.eventName=CreateNetworkAcl) || ($.eventName=CreateNetworkAclEntry) || ($.eventName=DeleteNetworkAcl) || ($.eventName=DeleteNetworkAclEntry) || ($.eventName=ReplaceNetworkAclEntry) || ($.eventName=ReplaceNetworkAclAssociation)}"
-  metric_transformation {
-    name          = var.log_metric_nacl
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "network_gateway" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_network_gateway
-  pattern        = "{($.eventName=CreateCustomerGateway) || ($.eventName=DeleteCustomerGateway) || ($.eventName=AttachInternetGateway) || ($.eventName=CreateInternetGateway) || ($.eventName=DeleteInternetGateway) || ($.eventName=DetachInternetGateway)}"
-  metric_transformation {
-    name          = var.log_metric_network_gateway
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "route_table" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_route_table
-  pattern        = "{($.eventSource=ec2.amazonaws.com) && (($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable))}"
-  metric_transformation {
-    name          = var.log_metric_route_table
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "vpc" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_vpc
-  pattern        = "{($.eventName=CreateVpc) || ($.eventName=DeleteVpc) || ($.eventName=ModifyVpcAttribute) || ($.eventName=AcceptVpcPeeringConnection) || ($.eventName=CreateVpcPeeringConnection) || ($.eventName=DeleteVpcPeeringConnection) || ($.eventName=RejectVpcPeeringConnection) || ($.eventName=AttachClassicLinkVpc) || ($.eventName=DetachClassicLinkVpc) || ($.eventName=DisableVpcClassicLink) || ($.eventName=EnableVpcClassicLink)}"
-  metric_transformation {
-    name          = var.log_metric_vpc
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "ec2_shutdown" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_ec2_shutdown
-  pattern        = "{($.eventName=StopInstances) || ($.eventName=TerminateInstances)}"
-  metric_transformation {
-    name          = var.log_metric_ec2_shutdown
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "db_shutdown" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_db_shutdown
-  pattern        = "{$.eventName=StopDBInstance}"
-  metric_transformation {
-    name          = var.log_metric_db_shutdown
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "db_deletion" {
-  log_group_name = var.cloudtrail_log_group_name
-  name           = var.log_metric_db_deletion
-  pattern        = "{$.eventName=DeleteDBInstance}"
-  metric_transformation {
-    name          = var.log_metric_db_deletion
-    namespace     = var.log_metric_namespace
-    default_value = 0
-    value         = 1
-  }
-}
diff --git a/infrastructure/main.tf b/infrastructure/main.tf
deleted file mode 100644
index 7cacdb57..00000000
--- a/infrastructure/main.tf
+++ /dev/null
@@ -1,81 +0,0 @@
-data "aws_availability_zones" "available" {
-  state = "available"
-}
-
-resource "aws_ssm_parameter" "prod_api_domain" {
-  name      = "/crossfeed/prod/DOMAIN"
-  type      = "String"
-  value     = "api.crossfeed.cyber.dhs.gov"
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "stage_api_domain" {
-  name      = "/crossfeed/staging/DOMAIN"
-  type      = "String"
-  value     = "api.staging-cd.crossfeed.cyber.dhs.gov"
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_s3_bucket" "logging_bucket" {
-  bucket = var.logging_bucket_name
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_policy" "logging_bucket" {
-  bucket = aws_s3_bucket.logging_bucket.id
-  policy = jsonencode({
-    "Version" : "2012-10-17",
-    "Statement" : [{
-      "Sid" : "RequireSSLRequests",
-      "Action" : "s3:*",
-      "Effect" : "Deny",
-      "Principal" : "*",
-      "Resource" : [
-        aws_s3_bucket.logging_bucket.arn,
-        "${aws_s3_bucket.logging_bucket.arn}/*"
-      ],
-      "Condition" : {
-        "Bool" : {
-          "aws:SecureTransport" : "false"
-        }
-      }
-    }]
-  })
-}
-
-resource "aws_s3_bucket_acl" "logging_bucket" {
-  bucket = aws_s3_bucket.logging_bucket.id
-  acl    = "private"
-}
-resource "aws_s3_bucket_server_side_encryption_configuration" "logging_bucket" {
-  bucket = aws_s3_bucket.logging_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_versioning" "logging_bucket" {
-  bucket = aws_s3_bucket.logging_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_logging" "logging_bucket" {
-  bucket        = aws_s3_bucket.logging_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "logging_bucket/"
-}
diff --git a/infrastructure/matomo.tf b/infrastructure/matomo.tf
deleted file mode 100644
index 9aad3950..00000000
--- a/infrastructure/matomo.tf
+++ /dev/null
@@ -1,225 +0,0 @@
-resource "aws_ecs_cluster" "matomo" {
-  name = var.matomo_ecs_cluster_name
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_ecs_cluster_capacity_providers" "motomo" {
-  cluster_name       = aws_ecs_cluster.matomo.name
-  capacity_providers = ["FARGATE"]
-}
-
-resource "aws_iam_role" "matomo_task_execution_role" {
-  name               = var.matomo_ecs_role_name
-  assume_role_policy = <<EOF
-{
-  "Version": "2008-10-17",
-  "Statement": [
-    {
-      "Sid": "",
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "ecs-tasks.amazonaws.com"
-      },
-      "Action": "sts:AssumeRole"
-    }
-  ]
-}
-  EOF
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_iam_role_policy" "matomo_task_execution_role_policy" {
-  name_prefix = var.matomo_ecs_role_name
-  role        = aws_iam_role.matomo_task_execution_role.id
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "logs:CreateLogStream",
-        "logs:PutLogEvents"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_ecs_task_definition" "matomo" {
-  family                   = var.matomo_ecs_task_definition_family
-  container_definitions    = <<EOF
-[
-  {
-    "name": "main",
-    "image": "matomo:3.14.1",
-    "essential": true,
-    "logConfiguration": {
-      "logDriver": "awslogs",
-      "options": {
-          "awslogs-group": "${var.matomo_ecs_log_group_name}",
-          "awslogs-region": "${var.aws_region}",
-          "awslogs-stream-prefix": "matomo"
-      }
-    },
-    "environment": [
-      {
-        "name": "MATOMO_DATABASE_HOST",
-        "value": "${aws_db_instance.matomo_db.address}"
-      },
-      {
-        "name": "MATOMO_DATABASE_ADAPTER",
-        "value": "mysql"
-      },
-      {
-        "name": "MATOMO_DATABASE_TABLES_PREFIX",
-        "value": "matomo_"
-      },
-      {
-        "name": "MATOMO_DATABASE_USERNAME",
-        "value": "${aws_db_instance.matomo_db.username}"
-      },
-      {
-        "name": "MATOMO_DATABASE_DBNAME",
-        "value": "${aws_db_instance.matomo_db.name}"
-      },
-      {
-        "name": "MATOMO_GENERAL_PROXY_URI_HEADER",
-        "value": "1"
-      },
-      {
-        "name": "MATOMO_GENERAL_ASSUME_SECURE_PROTOCOL",
-        "value": "1"
-      }
-    ],
-    "secrets": [
-      {
-        "name": "MATOMO_DATABASE_PASSWORD",
-        "valueFrom": "${aws_ssm_parameter.matomo_db_password.arn}"
-      }
-    ]
-  }
-]
-  EOF
-  execution_role_arn       = aws_iam_role.matomo_task_execution_role.arn
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-
-  cpu    = 256 # .25 vCPU
-  memory = 512 # 512 MB
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_service_discovery_private_dns_namespace" "default" {
-  name        = "crossfeed.local"
-  description = "Crossfeed ${var.stage}"
-  vpc         = aws_vpc.crossfeed_vpc.id
-}
-
-resource "aws_service_discovery_service" "matomo" {
-  # ECS service can be accessed through http://matomo.crossfeed.local
-  name = "matomo"
-
-  dns_config {
-    namespace_id = aws_service_discovery_private_dns_namespace.default.id
-
-    dns_records {
-      ttl  = 10
-      type = "A"
-    }
-
-    routing_policy = "MULTIVALUE"
-  }
-}
-
-resource "aws_ecs_service" "matomo" {
-  name            = "matomo"
-  launch_type     = "FARGATE"
-  cluster         = aws_ecs_cluster.matomo.id
-  task_definition = aws_ecs_task_definition.matomo.arn
-  desired_count   = 1
-  network_configuration {
-    subnets         = [aws_subnet.matomo_1.id]
-    security_groups = [aws_security_group.allow_internal.id]
-  }
-  service_registries {
-    registry_arn = aws_service_discovery_service.matomo.arn
-  }
-}
-
-resource "aws_cloudwatch_log_group" "matomo" {
-  name              = var.matomo_ecs_log_group_name
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "random_password" "matomo_db_password" {
-  length  = 16
-  special = false
-}
-
-resource "aws_db_instance" "matomo_db" {
-  identifier                          = var.matomo_db_name
-  instance_class                      = var.matomo_db_instance_class
-  allocated_storage                   = 20
-  max_allocated_storage               = 1000
-  storage_type                        = "gp2"
-  engine                              = "mariadb"
-  engine_version                      = "10.6"
-  skip_final_snapshot                 = true
-  availability_zone                   = data.aws_availability_zones.available.names[0]
-  multi_az                            = false
-  backup_retention_period             = 35
-  storage_encrypted                   = true
-  iam_database_authentication_enabled = false
-  allow_major_version_upgrade         = true
-
-  // database information
-  db_name  = "matomo"
-  username = "matomo"
-  password = random_password.matomo_db_password.result
-
-  db_subnet_group_name = aws_db_subnet_group.default.name
-
-  vpc_security_group_ids = [aws_security_group.allow_internal.id]
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_ssm_parameter" "matomo_db_password" {
-  name      = var.ssm_matomo_db_password
-  type      = "SecureString"
-  value     = random_password.matomo_db_password.result
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
diff --git a/infrastructure/output.tf b/infrastructure/output.tf
deleted file mode 100644
index db42a7ea..00000000
--- a/infrastructure/output.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-output "worker_ecs_repository_url" {
-  value = aws_ecr_repository.worker.repository_url
-}
-
-# output "db_accessor_instance_id" {
-#   value = try(aws_instance.db_accessor[0].id, null)
-# }
diff --git a/infrastructure/pe_worker.tf b/infrastructure/pe_worker.tf
deleted file mode 100644
index 3d34ca3f..00000000
--- a/infrastructure/pe_worker.tf
+++ /dev/null
@@ -1,193 +0,0 @@
-
-# P&E ECR Repository
-resource "aws_ecr_repository" "pe_worker" {
-  name = var.pe_worker_ecs_repository_name
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-  image_tag_mutability = "MUTABLE"
-
-  encryption_configuration {
-    encryption_type = "KMS"
-    kms_key         = aws_kms_key.key.arn
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-# P&E ECS Cluster
-resource "aws_ecs_cluster" "pe_worker" {
-  name = var.pe_worker_ecs_cluster_name
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_ecs_cluster_capacity_providers" "pe_worker" {
-  cluster_name       = aws_ecs_cluster.pe_worker.name
-  capacity_providers = ["FARGATE"]
-}
-
-# P&E generic task definition
-resource "aws_ecs_task_definition" "pe_worker" {
-  family                   = var.pe_worker_ecs_task_definition_family
-  container_definitions    = <<EOF
-[
-  {
-    "name": "main",
-    "image": "${aws_ecr_repository.pe_worker.repository_url}:latest",
-    "essential": true,
-    "mountPoints": [],
-    "portMappings": [],
-    "volumesFrom": [],
-    "logConfiguration": {
-      "logDriver": "awslogs",
-      "options": {
-          "awslogs-group": "${var.pe_worker_ecs_log_group_name}",
-          "awslogs-region": "${var.aws_region}",
-          "awslogs-stream-prefix": "worker"
-      }
-    },
-    "environment": [
-      {
-        "name": "DB_DIALECT",
-        "value": "postgres"
-      },
-      {
-        "name": "DB_PORT",
-        "value": "${var.db_port}"
-      }
-    ],
-    "secrets": [
-      {
-        "name": "DB_HOST",
-        "valueFrom": "${aws_ssm_parameter.crossfeed_send_db_host.arn}"
-      },
-      {
-        "name": "DB_NAME",
-        "valueFrom": "${aws_ssm_parameter.crossfeed_send_db_name.arn}"
-      },
-      {
-        "name": "DB_USERNAME",
-        "valueFrom": "${data.aws_ssm_parameter.db_username.arn}"
-      },
-      {
-        "name": "DB_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.db_password.arn}"
-      },
-      {
-        "name": "PE_DB_NAME",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_name.arn}"
-      },
-      {
-        "name": "PE_DB_USERNAME",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_username.arn}"
-      },
-      {
-        "name": "PE_DB_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_password.arn}"
-      },
-      {
-        "name": "CENSYS_API_ID",
-        "valueFrom": "${data.aws_ssm_parameter.censys_api_id.arn}"
-      },
-      {
-        "name": "CENSYS_API_SECRET",
-        "valueFrom": "${data.aws_ssm_parameter.censys_api_secret.arn}"
-      },
-      {
-        "name": "SHODAN_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.shodan_api_key.arn}"
-      },
-      {
-        "name": "PE_SHODAN_API_KEYS",
-        "valueFrom": "${data.aws_ssm_parameter.pe_shodan_api_keys.arn}"
-      },
-      {
-        "name": "SIXGILL_CLIENT_ID",
-        "valueFrom": "${data.aws_ssm_parameter.sixgill_client_id.arn}"
-      },
-      {
-        "name": "SIXGILL_CLIENT_SECRET",
-        "valueFrom": "${data.aws_ssm_parameter.sixgill_client_secret.arn}"
-      },
-      {
-        "name": "INTELX_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.intelx_api_key.arn}"
-      },
-      {
-        "name": "XPANSE_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.xpanse_api_key.arn}"
-      },
-      {
-        "name": "XPANSE_AUTH_ID",
-        "valueFrom": "${data.aws_ssm_parameter.xpanse_auth_id.arn}"
-      },
-      {
-        "name": "PE_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.pe_api_key.arn}"
-      },
-      {
-        "name": "CF_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.cf_api_key.arn}"
-      },
-      {
-        "name": "LG_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.lg_api_key.arn}"
-      },
-      {
-        "name": "LG_WORKSPACE_NAME",
-        "valueFrom": "${data.aws_ssm_parameter.lg_workspace_name.arn}"
-      },
-      {
-        "name": "WORKER_SIGNATURE_PUBLIC_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.worker_signature_public_key.arn}"
-      },
-      {
-        "name": "WORKER_SIGNATURE_PRIVATE_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.worker_signature_private_key.arn}"
-      },
-      {
-        "name": "ELASTICSEARCH_ENDPOINT",
-        "valueFrom": "${aws_ssm_parameter.es_endpoint.arn}"
-      }
-    ]
-  }
-]
-  EOF
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  execution_role_arn       = aws_iam_role.worker_task_execution_role.arn
-  task_role_arn            = aws_iam_role.worker_task_role.arn
-
-  # CPU and memory values: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-cpu-memory-error.html
-
-  cpu    = 2048
-  memory = 16384
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-# Create the  log group
-resource "aws_cloudwatch_log_group" "pe_worker" {
-  name              = var.pe_worker_ecs_log_group_name
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-    Owner   = "Crossfeed managed resource"
-  }
-}
diff --git a/infrastructure/sns.tf b/infrastructure/sns.tf
deleted file mode 100644
index 58fbe284..00000000
--- a/infrastructure/sns.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-resource "aws_sns_topic" "alarms" {
-  name              = var.sns_topic_alarms
-  kms_master_key_id = "alias/aws/sns"
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
diff --git a/infrastructure/ssm-agent-install.sh b/infrastructure/ssm-agent-install.sh
deleted file mode 100644
index 90537a70..00000000
--- a/infrastructure/ssm-agent-install.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-
-sudo mkdir /tmp/ssm
-cd /tmp/ssm || return
-wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
-sudo dpkg -i amazon-ssm-agent.deb
-sudo systemctl enable amazon-ssm-agent
-rm amazon-ssm-agent.deb
diff --git a/infrastructure/stage.config b/infrastructure/stage.config
deleted file mode 100644
index 0dfa2422..00000000
--- a/infrastructure/stage.config
+++ /dev/null
@@ -1,8 +0,0 @@
-# Backend Remote State Storage
-# Store the environmental variables needed to create the frontend
-
-
-key="STAGE/frontend-stage.tfstate"
-bucket="cisa-cd-crossfeed-terraform-state"
-region="us-east-1"
-profile="default"
diff --git a/infrastructure/stage.tfvars b/infrastructure/stage.tfvars
deleted file mode 100644
index 10c71f1c..00000000
--- a/infrastructure/stage.tfvars
+++ /dev/null
@@ -1,108 +0,0 @@
-aws_region                           = "us-east-1"
-project                              = "Crossfeed"
-stage                                = "staging"
-frontend_domain                      = "staging-cd.crossfeed.cyber.dhs.gov"
-frontend_lambda_function             = "crossfeed-security-headers-staging"
-frontend_bucket                      = "staging.crossfeed.cyber.dhs.gov"
-api_domain                           = "api.staging-cd.crossfeed.cyber.dhs.gov"
-frontend_cert_arn                    = "arn:aws:acm:us-east-1:957221700844:certificate/a0f51e21-3b90-43c5-b2e7-b99e1897429d"
-db_name                              = "crossfeed-stage-db"
-db_port                              = 5432
-db_table_name                        = "cfstagingdb"
-db_instance_class                    = "db.t3.2xlarge"
-log_metric_namespace                 = "LogMetrics"
-log_metric_root_user                 = "crossfeed-staging-RootUserAccess"
-log_metric_api_error_rate            = "crossfeed-staging-APIErrorRate"
-log_metric_unauthorized_api_call     = "crossfeed-staging-UnauthorizedApiCall"
-log_metric_login_without_mfa         = "crossfeed-staging-ConsoleSignInWithoutMFA"
-log_metric_iam_policy                = "crossfeed-staging-IAMPolicyChange"
-log_metric_cloudtrail                = "crossfeed-staging-CloudTrailConfigurationChanges"
-log_metric_login_failure             = "crossfeed-staging-ConsoleLoginFailure"
-log_metric_cmk_delete_disable        = "crossfeed-staging-DisablingOrScheduledDeletionOfCMK"
-log_metric_s3_bucket_policy          = "crossfeed-staging-S3BucketPolicyChanges"
-log_metric_aws_config                = "crossfeed-staging-AWSConfigConfigurationChange"
-log_metric_security_group            = "crossfeed-staging-SecurityGroupChange"
-log_metric_nacl                      = "crossfeed-staging-NACLChange"
-log_metric_network_gateway           = "crossfeed-staging-NetworkGatewayChange"
-log_metric_route_table               = "crossfeed-staging-RouteTableChange"
-log_metric_vpc                       = "crossfeed-staging-VPCChange"
-log_metric_ec2_shutdown              = "crossfeed-staging-EC2Shutdown"
-log_metric_db_shutdown               = "crossfeed-staging-DBShutdown"
-log_metric_db_deletion               = "crossfeed-staging-DBDeletion"
-sns_topic_alarms                     = "crossfeed-staging-cis-alarms"
-ssm_lambda_subnet                    = "/crossfeed/staging/SUBNET_ID"
-ssm_lambda_sg                        = "/crossfeed/staging/SG_ID"
-ssm_worker_subnet                    = "/crossfeed/staging/WORKER_SUBNET_ID"
-ssm_worker_sg                        = "/crossfeed/staging/WORKER_SG_ID"
-ssm_worker_arn                       = "/crossfeed/staging/WORKER_CLUSTER_ARN"
-ssm_db_name                          = "/crossfeed/staging/DATABASE_NAME"
-ssm_db_host                          = "/crossfeed/staging/DATABASE_HOST"
-ssm_db_username                      = "/crossfeed/staging/DATABASE_USER"
-ssm_db_password                      = "/crossfeed/staging/DATABASE_PASSWORD"
-ssm_pe_db_name                       = "/crossfeed/staging/PE_DB_NAME"
-ssm_pe_db_username                   = "/crossfeed/staging/PE_DB_USERNAME"
-ssm_pe_db_password                   = "/crossfeed/staging/PE_DB_PASSWORD"
-ssm_matomo_db_password               = "/crossfeed/staging/MATOMO_DATABASE_PASSWORD"
-ssm_worker_signature_public_key      = "/crossfeed/staging/WORKER_SIGNATURE_PUBLIC_KEY"
-ssm_worker_signature_private_key     = "/crossfeed/staging/WORKER_SIGNATURE_PRIVATE_KEY"
-ssm_censys_api_id                    = "/crossfeed/staging/CENSYS_API_ID"
-ssm_censys_api_secret                = "/crossfeed/staging/CENSYS_API_SECRET"
-ssm_shodan_api_key                   = "/crossfeed/staging/SHODAN_API_KEY"
-ssm_pe_shodan_api_keys               = "/crossfeed/staging/PE_SHODAN_API_KEYS"
-ssm_sixgill_client_id                = "/crossfeed/staging/SIXGILL_CLIENT_ID"
-ssm_sixgill_client_secret            = "/crossfeed/staging/SIXGILL_CLIENT_SECRET"
-ssm_intelx_api_key                   = "/crossfeed/staging/INTELX_API_KEY"
-ssm_xpanse_api_key                   = "/crossfeed/staging/XPANSE_API_KEY"
-ssm_xpanse_auth_id                   = "/crossfeed/staging/XPANSE_AUTH_ID"
-ssm_lg_api_key                       = "/crossfeed/staging/LG_API_KEY"
-ssm_lg_workspace_name                = "/crossfeed/staging/LG_WORKSPACE_NAME"
-ssm_pe_api_key                       = "/crossfeed/staging/PE_API_KEY"
-ssm_cf_api_key                       = "/crossfeed/staging/CF_API_KEY"
-db_group_name                        = "crossfeed-staging-db-group"
-worker_ecs_repository_name           = "crossfeed-staging-worker"
-worker_ecs_cluster_name              = "crossfeed-staging-worker"
-worker_ecs_task_definition_family    = "crossfeed-staging-worker"
-worker_ecs_log_group_name            = "crossfeed-staging-worker"
-worker_ecs_role_name                 = "crossfeed-staging-worker"
-pe_worker_ecs_repository_name        = "pe-staging-worker"
-pe_worker_ecs_cluster_name           = "pe-staging-worker"
-pe_worker_ecs_task_definition_family = "pe-staging-worker"
-pe_worker_ecs_log_group_name         = "pe-staging-worker"
-pe_worker_ecs_role_name              = "pe-staging-worker"
-logging_bucket_name                  = "cisa-crossfeed-staging-logging"
-cloudtrail_name                      = "crossfeed-staging-all-events"
-cloudtrail_bucket_name               = "cisa-crossfeed-staging-cloudtrail"
-cloudtrail_role_name                 = "cisa-crossfeed-staging-cloudtrail"
-cloudtrail_log_group_name            = "cisa-crossfeed-staging-cloudtrail"
-cloudwatch_bucket_name               = "cisa-crossfeed-staging-cloudwatch"
-cloudwatch_log_group_name            = "crossfeed-staging-cloudwatch-bucket"
-export_bucket_name                   = "cisa-crossfeed-staging-exports"
-reports_bucket_name                  = "cisa-crossfeed-staging-reports"
-pe_db_backups_bucket_name            = "cisa-crossfeed-staging-pe-db-backups"
-user_pool_name                       = "crossfeed-staging"
-user_pool_domain                     = "crossfeed-staging"
-ssm_user_pool_id                     = "/crossfeed/staging/USER_POOL_ID"
-ssm_user_pool_client_id              = "/crossfeed/staging/USER_POOL_CLIENT_ID"
-ses_support_email_sender             = "noreply@staging.crossfeed.cyber.dhs.gov"
-ses_support_email_replyto            = "vulnerability@cisa.dhs.gov"
-matomo_ecs_cluster_name              = "crossfeed-matomo-staging"
-matomo_ecs_task_definition_family    = "crossfeed-matomo-staging"
-matomo_ecs_log_group_name            = "crossfeed-matomo-staging"
-matomo_db_name                       = "crossfeed-matomo-staging"
-matomo_db_instance_class             = "db.t3.small"
-matomo_ecs_role_name                 = "crossfeed-matomo-staging"
-es_instance_type                     = "t3.small.elasticsearch"
-es_instance_count                    = 1
-es_instance_volume_size              = 100
-create_db_accessor_instance          = true
-db_accessor_instance_class           = "m5.4xlarge"
-create_elk_instance                  = true
-elk_instance_class                   = "t3.2xlarge"
-ssm_mdl_name                         = "/crossfeed/staging/MDL_NAME"
-ssm_mdl_username                     = "/crossfeed/staging/MDL_USERNAME"
-ssm_mdl_password                     = "/crossfeed/staging/MDL_PASSWORD"
-ssm_redshift_host                    = "/crossfeed/staging/REDSHIFT_HOST"
-ssm_redshift_database                = "/crossfeed/staging/REDSHIFT_DATABASE"
-ssm_redshift_user                    = "/crossfeed/staging/REDSHIFT_USER"
-ssm_redshift_password                = "/crossfeed/staging/REDSHIFT_PASSWORD"
-create_elasticache_cluster           = true
diff --git a/infrastructure/users.tf b/infrastructure/users.tf
deleted file mode 100644
index 29825f4f..00000000
--- a/infrastructure/users.tf
+++ /dev/null
@@ -1,68 +0,0 @@
-resource "aws_cognito_user_pool" "pool" {
-  name                     = var.user_pool_name
-  mfa_configuration        = "ON"
-  username_attributes      = ["email"]
-  auto_verified_attributes = ["email"]
-
-  software_token_mfa_configuration {
-    enabled = true
-  }
-
-  email_configuration {
-    email_sending_account  = "DEVELOPER"
-    source_arn             = aws_ses_email_identity.default.arn
-    reply_to_email_address = var.ses_support_email_replyto
-  }
-
-  verification_message_template {
-    email_subject = "Crossfeed verification code"
-    email_message = "Your verification code is {####}. Please enter this code in when logging into Crossfeed to complete your account setup."
-  }
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ses_email_identity" "default" {
-  email = var.ses_support_email_sender
-}
-
-resource "aws_cognito_user_pool_domain" "auth_domain" {
-  domain       = var.user_pool_domain
-  user_pool_id = aws_cognito_user_pool.pool.id
-}
-
-resource "aws_cognito_user_pool_client" "client" {
-  name                                 = "crossfeed"
-  user_pool_id                         = aws_cognito_user_pool.pool.id
-  callback_urls                        = ["http://localhost"]
-  supported_identity_providers         = ["COGNITO"]
-  allowed_oauth_scopes                 = ["email", "openid"]
-  allowed_oauth_flows                  = ["code"]
-  explicit_auth_flows                  = ["ALLOW_CUSTOM_AUTH", "ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_SRP_AUTH"]
-  allowed_oauth_flows_user_pool_client = true
-  prevent_user_existence_errors        = "ENABLED"
-}
-
-resource "aws_ssm_parameter" "user_pool_id" {
-  name      = var.ssm_user_pool_id
-  type      = "String"
-  value     = aws_cognito_user_pool.pool.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ssm_parameter" "user_pool_client_id" {
-  name      = var.ssm_user_pool_client_id
-  type      = "String"
-  value     = aws_cognito_user_pool_client.client.id
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
diff --git a/infrastructure/vpc.tf b/infrastructure/vpc.tf
deleted file mode 100644
index 9a7f5653..00000000
--- a/infrastructure/vpc.tf
+++ /dev/null
@@ -1,222 +0,0 @@
-resource "aws_vpc" "crossfeed_vpc" {
-  cidr_block           = "10.0.0.0/16"
-  enable_dns_support   = true
-  enable_dns_hostnames = true
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_subnet" "db_1" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.1.0/28"
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_subnet" "db_2" {
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.1.16/28"
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_subnet" "backend" {
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.2.0/24"
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_subnet" "worker" {
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.3.0/24"
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_subnet" "es_1" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.4.0/28"
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_subnet" "matomo_1" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.crossfeed_vpc.id
-  cidr_block        = "10.0.5.0/28"
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_route_table" "r" {
-  vpc_id = aws_vpc.crossfeed_vpc.id
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_route_table" "r2" {
-  vpc_id = aws_vpc.crossfeed_vpc.id
-
-  route {
-    nat_gateway_id = aws_nat_gateway.nat.id
-    cidr_block     = "0.0.0.0/0"
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_route_table" "worker" {
-  vpc_id = aws_vpc.crossfeed_vpc.id
-
-  route {
-    gateway_id = aws_internet_gateway.gw.id
-    cidr_block = "0.0.0.0/0"
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_route_table_association" "r_assoc_db_1" {
-  route_table_id = aws_route_table.r.id
-  subnet_id      = aws_subnet.db_1.id
-}
-
-resource "aws_route_table_association" "r_assoc_db_2" {
-  route_table_id = aws_route_table.r.id
-  subnet_id      = aws_subnet.db_2.id
-}
-
-resource "aws_route_table_association" "r_assoc_backend" {
-  route_table_id = aws_route_table.r2.id
-  subnet_id      = aws_subnet.backend.id
-}
-
-resource "aws_route_table_association" "r_assoc_matomo" {
-  route_table_id = aws_route_table.r2.id
-  subnet_id      = aws_subnet.matomo_1.id
-}
-
-resource "aws_route_table_association" "r_assoc_worker" {
-  route_table_id = aws_route_table.worker.id
-  subnet_id      = aws_subnet.worker.id
-}
-
-resource "aws_internet_gateway" "gw" {
-  vpc_id = aws_vpc.crossfeed_vpc.id
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_eip" "nat_eip" {
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_nat_gateway" "nat" {
-  allocation_id = aws_eip.nat_eip.id
-  subnet_id     = aws_subnet.worker.id
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_security_group" "allow_internal" {
-  name        = "allow-internal"
-  description = "Allow All VPC Internal Traffic"
-  vpc_id      = aws_vpc.crossfeed_vpc.id
-
-  ingress {
-    description = "All Lambda Subnet"
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = [aws_vpc.crossfeed_vpc.cidr_block]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-# TODO: remove this security group. We can't remove it right now because
-# AWS created an ENI in this security group that can't be deleted at the moment.
-# See https://www.reddit.com/r/aws/comments/4fncrl/dangling_enis_after_deleting_an_invpc_lambda_with/
-resource "aws_security_group" "backend" {
-  name        = "backend"
-  description = "Backend"
-  vpc_id      = aws_vpc.crossfeed_vpc.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = [aws_vpc.crossfeed_vpc.cidr_block]
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-
-resource "aws_security_group" "worker" {
-  name        = "worker"
-  description = "Worker"
-  vpc_id      = aws_vpc.crossfeed_vpc.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
diff --git a/infrastructure/worker.tf b/infrastructure/worker.tf
deleted file mode 100644
index 6108cba2..00000000
--- a/infrastructure/worker.tf
+++ /dev/null
@@ -1,493 +0,0 @@
-resource "aws_ecr_repository" "worker" {
-  name = var.worker_ecs_repository_name
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-  image_tag_mutability = "MUTABLE"
-
-  encryption_configuration {
-    encryption_type = "KMS"
-    kms_key         = aws_kms_key.key.arn
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_iam_role" "worker_task_execution_role" {
-  name               = var.worker_ecs_role_name
-  assume_role_policy = <<EOF
-{
-  "Version": "2008-10-17",
-  "Statement": [
-    {
-      "Sid": "",
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "ecs-tasks.amazonaws.com"
-      },
-      "Action": "sts:AssumeRole"
-    }
-  ]
-}
-  EOF
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_iam_role_policy" "worker_task_execution_role_policy" {
-  name_prefix = var.worker_ecs_role_name
-  role        = aws_iam_role.worker_task_execution_role.id
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ecr:GetAuthorizationToken",
-        "ecr:BatchCheckLayerAvailability",
-        "ecr:GetDownloadUrlForLayer",
-        "ecr:BatchGetImage",
-        "logs:CreateLogStream",
-        "logs:PutLogEvents",
-        "sqs:ReceiveMessage",
-        "sqs:DeleteMessage",
-        "sqs:ListQueues",
-        "sqs:GetQueueAttributes"
-      ],
-      "Resource": "*"
-    },
-    {
-        "Effect": "Allow",
-        "Action": [
-            "ssm:GetParameters"
-        ],
-        "Resource": [
-          "${aws_ssm_parameter.crossfeed_send_db_host.arn}",
-          "${aws_ssm_parameter.crossfeed_send_db_name.arn}",
-          "${data.aws_ssm_parameter.db_username.arn}",
-          "${data.aws_ssm_parameter.db_password.arn}",
-          "${data.aws_ssm_parameter.pe_db_name.arn}",
-          "${data.aws_ssm_parameter.pe_db_username.arn}",
-          "${data.aws_ssm_parameter.pe_db_password.arn}",
-          "${data.aws_ssm_parameter.worker_signature_public_key.arn}",
-          "${data.aws_ssm_parameter.worker_signature_private_key.arn}",
-          "${data.aws_ssm_parameter.censys_api_id.arn}",
-          "${data.aws_ssm_parameter.censys_api_secret.arn}",
-          "${data.aws_ssm_parameter.shodan_api_key.arn}",
-          "${data.aws_ssm_parameter.pe_shodan_api_keys.arn}",
-          "${data.aws_ssm_parameter.sixgill_client_id.arn}",
-          "${data.aws_ssm_parameter.intelx_api_key.arn}",
-          "${data.aws_ssm_parameter.xpanse_api_key.arn}",
-          "${data.aws_ssm_parameter.xpanse_auth_id.arn}",
-          "${data.aws_ssm_parameter.sixgill_client_secret.arn}",
-          "${data.aws_ssm_parameter.lg_api_key.arn}",
-          "${data.aws_ssm_parameter.lg_workspace_name.arn}",
-          "${aws_ssm_parameter.es_endpoint.arn}",
-          "${data.aws_ssm_parameter.pe_api_key.arn}",
-          "${data.aws_ssm_parameter.cf_api_key.arn}",
-          "${data.aws_ssm_parameter.ssm_mdl_name.arn}",
-          "${data.aws_ssm_parameter.ssm_mdl_username.arn}",
-          "${data.aws_ssm_parameter.ssm_mdl_password.arn}",
-          "${data.aws_ssm_parameter.ssm_redshift_host.arn}",
-          "${data.aws_ssm_parameter.ssm_redshift_database.arn}",
-          "${data.aws_ssm_parameter.ssm_redshift_user.arn}",
-          "${data.aws_ssm_parameter.ssm_redshift_password.arn}"
-        ]
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role" "worker_task_role" {
-  name               = "crossfeed-${var.stage}-worker-task"
-  assume_role_policy = <<EOF
-{
-  "Version": "2008-10-17",
-  "Statement": [
-    {
-      "Sid": "",
-      "Effect": "Allow",
-      "Principal": {
-        "Service": "ecs-tasks.amazonaws.com"
-      },
-      "Action": "sts:AssumeRole"
-    }
-  ]
-}
-  EOF
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_iam_role_policy" "worker_task_role_policy" {
-  name_prefix = aws_iam_role.worker_task_role.name
-  role        = aws_iam_role.worker_task_role.id
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-        "Effect": "Allow",
-        "Action": [
-            "s3:PutObject",
-            "s3:PutObjectAcl",
-            "s3:GetObject",
-            "s3:GetObjectAcl"
-        ],
-        "Resource": [
-          "${aws_s3_bucket.export_bucket.arn}/*"
-        ]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-          "s3:ListBucket"
-      ],
-      "Resource": [
-        "${aws_s3_bucket.export_bucket.arn}"
-      ]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "sqs:ReceiveMessage",
-        "sqs:DeleteMessage",
-        "sqs:ListQueues",
-        "sqs:GetQueueAttributes"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_ecs_cluster" "worker" {
-  name = var.worker_ecs_cluster_name
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_ecs_cluster_capacity_providers" "worker" {
-  cluster_name       = aws_ecs_cluster.worker.name
-  capacity_providers = ["FARGATE"]
-}
-resource "aws_ssm_parameter" "worker_arn" {
-  name      = var.ssm_worker_arn
-  type      = "String"
-  value     = aws_ecs_cluster.worker.arn
-  overwrite = true
-
-  tags = {
-    Project = var.project
-  }
-}
-
-resource "aws_ecs_task_definition" "worker" {
-  family                   = var.worker_ecs_task_definition_family
-  container_definitions    = <<EOF
-[
-  {
-    "name": "main",
-    "image": "${aws_ecr_repository.worker.repository_url}:latest",
-    "essential": true,
-    "mountPoints": [],
-    "portMappings": [],
-    "volumesFrom": [],
-    "logConfiguration": {
-      "logDriver": "awslogs",
-      "options": {
-          "awslogs-group": "${var.worker_ecs_log_group_name}",
-          "awslogs-region": "${var.aws_region}",
-          "awslogs-stream-prefix": "worker"
-      }
-    },
-    "environment": [
-      {
-        "name": "DB_DIALECT",
-        "value": "postgres"
-      },
-      {
-        "name": "DB_PORT",
-        "value": "${var.db_port}"
-      }
-    ],
-    "secrets": [
-      {
-        "name": "DB_HOST",
-        "valueFrom": "${aws_ssm_parameter.crossfeed_send_db_host.arn}"
-      },
-      {
-        "name": "DB_NAME",
-        "valueFrom": "${aws_ssm_parameter.crossfeed_send_db_name.arn}"
-      },
-      {
-        "name": "DB_USERNAME",
-        "valueFrom": "${data.aws_ssm_parameter.db_username.arn}"
-      },
-      {
-        "name": "DB_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.db_password.arn}"
-      },
-      {
-        "name": "PE_DB_NAME",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_name.arn}"
-      },
-      {
-        "name": "PE_DB_USERNAME",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_username.arn}"
-      },
-      {
-        "name": "PE_DB_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.pe_db_password.arn}"
-      },
-      {
-        "name": "CENSYS_API_ID",
-        "valueFrom": "${data.aws_ssm_parameter.censys_api_id.arn}"
-      },
-      {
-        "name": "CENSYS_API_SECRET",
-        "valueFrom": "${data.aws_ssm_parameter.censys_api_secret.arn}"
-      },
-      {
-        "name": "SHODAN_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.shodan_api_key.arn}"
-      },
-      {
-        "name": "PE_SHODAN_API_KEYS",
-        "valueFrom": "${data.aws_ssm_parameter.pe_shodan_api_keys.arn}"
-      },
-      {
-        "name": "SIXGILL_CLIENT_ID",
-        "valueFrom": "${data.aws_ssm_parameter.sixgill_client_id.arn}"
-      },
-      {
-        "name": "SIXGILL_CLIENT_SECRET",
-        "valueFrom": "${data.aws_ssm_parameter.sixgill_client_secret.arn}"
-      },
-      {
-        "name": "LG_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.lg_api_key.arn}"
-      },
-      {
-        "name": "LG_WORKSPACE_NAME",
-        "valueFrom": "${data.aws_ssm_parameter.lg_workspace_name.arn}"
-      },
-      {
-        "name": "WORKER_SIGNATURE_PUBLIC_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.worker_signature_public_key.arn}"
-      },
-      {
-        "name": "WORKER_SIGNATURE_PRIVATE_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.worker_signature_private_key.arn}"
-      },
-      {
-        "name": "ELASTICSEARCH_ENDPOINT",
-        "valueFrom": "${aws_ssm_parameter.es_endpoint.arn}"
-      },
-      {
-        "name": "PE_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.pe_api_key.arn}"
-      },
-      {
-        "name": "CF_API_KEY",
-        "valueFrom": "${data.aws_ssm_parameter.cf_api_key.arn}"
-      },
-      {
-        "name": "MDL_NAME",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_mdl_name.arn}"
-      },
-      {
-        "name": "MDL_USERNAME",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_mdl_username.arn}"
-      },
-      {
-        "name": "MDL_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_mdl_password.arn}"
-      },
-      {
-        "name": "REDSHIFT_HOST",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_redshift_host.arn}"
-      },
-      {
-        "name": "REDSHIFT_DATABASE",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_redshift_database.arn}"
-      },
-      {
-        "name": "REDSHIFT_USER",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_redshift_user.arn}"
-      },
-      {
-        "name": "REDSHIFT_PASSWORD",
-        "valueFrom": "${data.aws_ssm_parameter.ssm_redshift_password.arn}"
-      }
-    ]
-  }
-]
-  EOF
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  execution_role_arn       = aws_iam_role.worker_task_execution_role.arn
-  task_role_arn            = aws_iam_role.worker_task_role.arn
-
-  # CPU and memory values: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-cpu-memory-error.html
-
-  cpu    = 256 # .25 vCPU
-  memory = 512 # 512 MB
-
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_cloudwatch_log_group" "worker" {
-  name              = var.worker_ecs_log_group_name # should match awslogs-group in service.json
-  retention_in_days = 3653
-  kms_key_id        = aws_kms_key.key.arn
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-data "aws_ssm_parameter" "censys_api_id" { name = var.ssm_censys_api_id }
-
-data "aws_ssm_parameter" "censys_api_secret" { name = var.ssm_censys_api_secret }
-
-data "aws_ssm_parameter" "shodan_api_key" { name = var.ssm_shodan_api_key }
-
-data "aws_ssm_parameter" "pe_shodan_api_keys" { name = var.ssm_pe_shodan_api_keys }
-
-data "aws_ssm_parameter" "sixgill_client_id" { name = var.ssm_sixgill_client_id }
-
-data "aws_ssm_parameter" "intelx_api_key" { name = var.ssm_intelx_api_key }
-
-data "aws_ssm_parameter" "xpanse_api_key" { name = var.ssm_xpanse_api_key }
-
-data "aws_ssm_parameter" "xpanse_auth_id" { name = var.ssm_xpanse_auth_id }
-
-data "aws_ssm_parameter" "sixgill_client_secret" { name = var.ssm_sixgill_client_secret }
-
-data "aws_ssm_parameter" "pe_db_name" { name = var.ssm_pe_db_name }
-
-data "aws_ssm_parameter" "pe_db_username" { name = var.ssm_pe_db_username }
-
-data "aws_ssm_parameter" "pe_db_password" { name = var.ssm_pe_db_password }
-
-data "aws_ssm_parameter" "lg_api_key" { name = var.ssm_lg_api_key }
-
-data "aws_ssm_parameter" "lg_workspace_name" { name = var.ssm_lg_workspace_name }
-
-data "aws_ssm_parameter" "worker_signature_public_key" { name = var.ssm_worker_signature_public_key }
-
-data "aws_ssm_parameter" "worker_signature_private_key" { name = var.ssm_worker_signature_private_key }
-
-data "aws_ssm_parameter" "pe_api_key" { name = var.ssm_pe_api_key }
-
-data "aws_ssm_parameter" "cf_api_key" { name = var.ssm_cf_api_key }
-
-data "aws_ssm_parameter" "ssm_mdl_name" { name = var.ssm_mdl_name }
-
-data "aws_ssm_parameter" "ssm_mdl_username" { name = var.ssm_mdl_username }
-
-data "aws_ssm_parameter" "ssm_mdl_password" { name = var.ssm_mdl_password }
-
-data "aws_ssm_parameter" "ssm_redshift_host" { name = var.ssm_redshift_host }
-
-data "aws_ssm_parameter" "ssm_redshift_database" { name = var.ssm_redshift_database }
-
-data "aws_ssm_parameter" "ssm_redshift_user" { name = var.ssm_redshift_user }
-
-data "aws_ssm_parameter" "ssm_redshift_password" { name = var.ssm_redshift_password }
-
-
-resource "aws_s3_bucket" "export_bucket" {
-  bucket = var.export_bucket_name
-  tags = {
-    Project = var.project
-    Stage   = var.stage
-  }
-}
-
-resource "aws_s3_bucket_policy" "export_bucket" {
-  bucket = var.export_bucket_name
-  policy = jsonencode({
-    "Version" : "2012-10-17"
-    "Statement" : [
-      {
-        "Sid" : "RequireSSLRequests"
-        "Action" : "s3:*",
-        "Effect" : "Deny"
-        "Principal" : "*"
-        "Resource" : [
-          aws_s3_bucket.export_bucket.arn,
-          "${aws_s3_bucket.export_bucket.arn}/*"
-        ]
-        "Condition" : {
-          "Bool" : {
-            "aws:SecureTransport" : false
-          }
-        }
-      }
-    ]
-  })
-}
-
-resource "aws_s3_bucket_acl" "export_bucket" {
-  bucket = aws_s3_bucket.export_bucket.id
-  acl    = "private"
-}
-resource "aws_s3_bucket_server_side_encryption_configuration" "export_bucket" {
-  bucket = aws_s3_bucket.export_bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
-resource "aws_s3_bucket_versioning" "export_bucket" {
-  bucket = aws_s3_bucket.export_bucket.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_logging" "export_bucket" {
-  bucket        = aws_s3_bucket.export_bucket.id
-  target_bucket = aws_s3_bucket.logging_bucket.id
-  target_prefix = "export_bucket/"
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "export_bucket" {
-  bucket = aws_s3_bucket.export_bucket.id
-  rule {
-    id     = "all_files"
-    status = "Enabled"
-    expiration {
-      days = 1
-    }
-  }
-}