diff --git a/terraform/environments/cdpt-ifs/application_variables.json b/terraform/environments/cdpt-ifs/application_variables.json
index 6b52bfe9b30..673e8abf6bc 100644
--- a/terraform/environments/cdpt-ifs/application_variables.json
+++ b/terraform/environments/cdpt-ifs/application_variables.json
@@ -1,7 +1,15 @@
 {
   "accounts": {
     "development": {
-      "example_var": "dev-data"
+      "environment_name": "development",
+      "container_port": 80,
+      "client_id": "838aa730-5f66-46df-9ff7-07eea29035ba",
+      "ami_image_id": "ami-06cdd5b44c17085ed",
+      "instance_type": "t3.micro",
+      "app_count": 1,
+      "ec2_desired_capacity": 1,
+      "ec2_max_size": 2,
+      "ec2_min_size": 1
     },
     "test": {
       "example_var": "test-data"
diff --git a/terraform/environments/cdpt-ifs/bastion_linux.json b/terraform/environments/cdpt-ifs/bastion_linux.json
new file mode 100644
index 00000000000..f97bec0e4f8
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/bastion_linux.json
@@ -0,0 +1,13 @@
+{
+  "keys": {
+    "development": {
+      "acurtis": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7Z+QprFiensJ1Kw08i9shm5lfritcI3/71nrDu2S3H alistair.curtis@digital.justice.gov.uk"
+    },
+    "preproduction": {
+      "acurtis": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7Z+QprFiensJ1Kw08i9shm5lfritcI3/71nrDu2S3H alistair.curtis@digital.justice.gov.uk"
+    },
+    "production": {
+      "acurtis": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7Z+QprFiensJ1Kw08i9shm5lfritcI3/71nrDu2S3H alistair.curtis@digital.justice.gov.uk"
+    }
+  }
+}
\ No newline at end of file
diff --git a/terraform/environments/cdpt-ifs/bastion_linux.tf b/terraform/environments/cdpt-ifs/bastion_linux.tf
new file mode 100644
index 00000000000..588ece74247
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/bastion_linux.tf
@@ -0,0 +1,38 @@
+locals {
+  public_key_data = jsondecode(file("./bastion_linux.json"))
+}
+
+module "bastion_linux" {
+  source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0"
+
+  providers = {
+    aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
+    aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
+  }
+
+  # s3 - used for logs and user ssh public keys
+  bucket_name          = "bastion"
+  bucket_versioning    = true
+  bucket_force_destroy = true
+  # public keys
+  public_key_data = local.public_key_data.keys[local.environment]
+  # logs
+  log_auto_clean       = "Enabled"
+  log_standard_ia_days = 30  # days before moving to IA storage
+  log_glacier_days     = 60  # days before moving to Glacier
+  log_expiry_days      = 180 # days before log expiration
+  # bastion
+  allow_ssh_commands = false
+
+  app_name      = var.networking[0].application
+  business_unit = local.vpc_name
+  subnet_set    = local.subnet_set
+  environment   = local.environment
+  region        = "eu-west-2"
+
+  extra_user_data_content = "yum install -y openldap-clients"
+
+  # Tags
+  tags_common = local.tags
+  tags_prefix = terraform.workspace
+}
diff --git a/terraform/environments/cdpt-ifs/ecs.tf b/terraform/environments/cdpt-ifs/ecs.tf
new file mode 100644
index 00000000000..3842b0e9ac4
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/ecs.tf
@@ -0,0 +1,520 @@
+data "aws_ecs_task_definition" "task_definition" {
+  task_definition = aws_ecs_task_definition.ifs_task_definition.family
+  depends_on      = [aws_ecs_task_definition.ifs_task_definition]
+}
+
+resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
+  name = "${local.application_name}-ec2-instance-policy"
+
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeTags",
+                "ecs:CreateCluster",
+                "ecs:DeregisterContainerInstance",
+                "ecs:DiscoverPollEndpoint",
+                "ecs:Poll",
+                "ecs:RegisterContainerInstance",
+                "ecs:StartTelemetrySession",
+                "ecs:UpdateContainerInstancesState",
+                "ecs:Submit*",
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:BatchGetImage",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+                "s3:ListBucket",
+                "s3:*Object*",
+                "kms:Decrypt",
+                "kms:Encrypt",
+                "kms:GenerateDataKey",
+                "kms:ReEncrypt",
+                "kms:GenerateDataKey",
+                "kms:DescribeKey",
+                "rds:Connect",
+                "rds:DescribeDBInstances"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_cloudwatch_log_group" "deployment_logs" {
+  name              = "/aws/events/deploymentLogs"
+  retention_in_days = "7"
+}
+
+resource "aws_iam_role_policy_attachment" "attach_ec2_policy" {
+  role       = aws_iam_role.ec2_instance_role.name
+  policy_arn = aws_iam_policy.ec2_instance_policy.arn
+}
+
+resource "aws_iam_role" "ec2_instance_role" {
+  name = "${local.application_name}-ec2-instance-role"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+               "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_ecs_task_definition" "ifs_task_definition" {
+  family                   = "ifsFamily"
+  requires_compatibilities = ["EC2"]
+  network_mode             = "awsvpc"
+  execution_role_arn       = aws_iam_role.app_execution.arn
+  task_role_arn            = aws_iam_role.app_task.arn
+  container_definitions = jsonencode([
+    {
+      name      = "${local.application_name}-container"
+      image     = "${local.ecr_url}:${local.application_data.accounts[local.environment].environment_name}"
+      cpu       = 1024
+      memory    = 1024
+      essential = true
+      portMappings = [
+        {
+          containerPort = local.application_data.accounts[local.environment].container_port
+          protocol      = "tcp"
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs",
+        options = {
+          awslogs-group         = "${local.application_name}-ecs",
+          awslogs-region        = "eu-west-2",
+          awslogs-stream-prefix = local.application_name
+        }
+      }
+      environment = [
+#        {
+#          name  = "RDS_HOSTNAME"
+#          value = "${aws_db_instance.database.address}"
+#        },
+#        {
+#          name  = "RDS_USERNAME"
+#          value = "${aws_db_instance.database.username}"
+#        },
+#        {
+#          name  = "DB_NAME"
+#          value = "${local.application_data.accounts[local.environment].db_name}"
+#        },
+        {
+         name  = "CLIENT_ID"
+          value = "${local.application_data.accounts[local.environment].client_id}"
+        }
+      ]
+#      secrets = [
+#        {
+#          name : "RDS_PASSWORD",
+#          valueFrom : aws_secretsmanager_secret_version.db_password.arn
+#        }
+#      ]
+    }
+  ])
+}
+
+
+resource "aws_ecs_cluster" "ecs_cluster" {
+  name = "${local.application_name}-ecs-cluster"
+
+  setting {
+    name  = "containerInsights"
+    value = "enabled"
+  }
+}
+
+resource "aws_iam_role" "app_task" {
+  name = "task-${var.networking[0].application}"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ecs-tasks.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "task-${var.networking[0].application}"
+    },
+  )
+}
+
+resource "aws_iam_role_policy" "app_task" {
+  name = "task-${var.networking[0].application}"
+  role = aws_iam_role.app_task.id
+
+  policy = <<-EOF
+  {
+   "Version": "2012-10-17",
+   "Statement": [
+     {
+       "Effect": "Allow",
+        "Action": [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+          "ecr:*",
+          "iam:*",
+          "ec2:*"
+        ],
+       "Resource": "*"
+     }
+   ]
+  }
+  EOF
+}
+
+resource "aws_iam_role" "app_execution" {
+  name = "execution-${var.networking[0].application}"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ecs-tasks.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "execution-${var.networking[0].application}"
+    },
+  )
+}
+resource "aws_iam_role_policy" "app_execution" {
+  name = "execution-${var.networking[0].application}"
+  role = aws_iam_role.app_execution.id
+
+  policy = <<-EOF
+  {
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+           "Action": [
+              "ecr:*",
+              "logs:CreateLogGroup",
+              "logs:CreateLogStream",
+              "logs:PutLogEvents",
+              "logs:DescribeLogStreams",
+              "secretsmanager:GetSecretValue"
+           ],
+           "Resource": "*",
+           "Effect": "Allow"
+      }
+    ]
+  }
+  EOF
+}
+
+# EC2 launch template - settings to use for new EC2s added to the group
+# Note - when updating this you will need to manually terminate the EC2s
+# so that the autoscaling group creates new ones using the new launch template
+
+resource "aws_launch_template" "ec2-launch-template" {
+  name_prefix   = "${local.application_name}-ec2-launch-template"
+  image_id      = local.application_data.accounts[local.environment].ami_image_id
+  instance_type = local.application_data.accounts[local.environment].instance_type
+  key_name      = "${local.application_name}-ec2"
+  ebs_optimized = true
+
+  monitoring {
+    enabled = true
+  }
+
+  metadata_options {
+    http_endpoint = "enabled"
+    http_tokens   = "optional"
+  }
+
+  iam_instance_profile {
+    name = aws_iam_instance_profile.ec2_instance_profile.name
+  }
+
+  network_interfaces {
+    associate_public_ip_address = false
+    security_groups             = [aws_security_group.cluster_ec2.id]#, aws_security_group.db.id]
+  }
+
+  block_device_mappings {
+    device_name = "/dev/xvda"
+    ebs {
+      delete_on_termination = true
+      encrypted             = true
+      volume_size           = 30
+      volume_type           = "gp2"
+      iops                  = 0
+    }
+  }
+
+  user_data = local.user_data
+
+  tag_specifications {
+    resource_type = "instance"
+    tags = merge(tomap({
+      "Name" = "${local.application_name}-ecs-cluster"
+    }), local.tags)
+  }
+
+  tag_specifications {
+    resource_type = "volume"
+    tags = merge(tomap({
+      "Name" = "${local.application_name}-ecs-cluster"
+    }), local.tags)
+  }
+
+  tags = merge(tomap({
+    "Name" = "${local.application_name}-ecs-cluster-template"
+  }), local.tags)
+}
+
+resource "aws_security_group" "cluster_ec2" {
+  name        = "${local.application_name}-cluster-ec2-security-group"
+  description = "controls access to the cluster ec2 instance"
+  vpc_id      = data.aws_vpc.shared.id
+
+ingress {
+  description     = "allow access on HTTP from load balancer"
+  from_port       = 80
+  to_port         = 80
+  protocol        = "tcp"
+  cidr_blocks     = ["0.0.0.0/0"]
+  security_groups = [aws_security_group.ifs_lb_sc.id]
+ }
+
+# ingress {
+#   description     = "Allow RDP ingress"
+#   from_port       = 3389
+#   to_port         = 3389
+#   protocol        = "tcp"
+#   security_groups = [module.bastion_linux.bastion_security_group]
+# }
+
+  egress {
+    description     = "Cluster EC2 loadbalancer egress rule"
+    from_port       = 0
+    to_port         = 0
+    protocol        = "-1"
+    cidr_blocks     = ["0.0.0.0/0"]
+    security_groups = []
+  }
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "${local.application_name}-cluster-ec2-security-group"
+    }
+  )
+}
+
+resource "aws_iam_instance_profile" "ec2_instance_profile" {
+  name = "${local.application_name}-ec2-instance-profile"
+  role = aws_iam_role.ec2_instance_role.name
+}
+
+resource "aws_ecs_service" "ecs_service" {
+  depends_on = [aws_lb_listener.https_listener]
+  name                              = var.networking[0].application
+  cluster                           = aws_ecs_cluster.ecs_cluster.id
+  task_definition                   = aws_ecs_task_definition.ifs_task_definition.arn
+  desired_count                     = local.application_data.accounts[local.environment].app_count
+  health_check_grace_period_seconds = 60
+  capacity_provider_strategy {
+    capacity_provider = aws_ecs_capacity_provider.ifs.name
+    weight            = 1
+  }
+
+  ordered_placement_strategy {
+    field = "attribute:ecs.availability-zone"
+    type  = "spread"
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.ifs_target_group.arn
+    container_name   = "${local.application_name}-container"
+    container_port   = local.application_data.accounts[local.environment].container_port
+  }
+
+  network_configuration {
+    subnets         = data.aws_subnets.shared-private.ids
+    security_groups = [aws_security_group.ecs_service.id]
+  }
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "${local.application_name}"
+    }
+  )
+}
+
+resource "aws_ecs_capacity_provider" "ifs" {
+  name = "${local.application_name}-ecs-capacity-provider"
+
+  auto_scaling_group_provider {
+    auto_scaling_group_arn = aws_autoscaling_group.cluster-scaling-group.arn
+
+    managed_scaling {
+      status          = "ENABLED"
+      target_capacity = 100
+    }
+  }
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "${local.application_name}-ecs-capacity-provider"
+    }
+  )
+}
+
+resource "aws_ecs_cluster_capacity_providers" "cdpt-ifs" {
+  cluster_name = aws_ecs_cluster.ecs_cluster.name
+
+  capacity_providers = [aws_ecs_capacity_provider.ifs.name]
+}
+
+resource "aws_autoscaling_group" "cluster-scaling-group" {
+  vpc_zone_identifier       = sort(data.aws_subnets.shared-private.ids)
+  name                      = "${local.application_name}-cluster-scaling-group"
+  desired_capacity          = local.application_data.accounts[local.environment].ec2_desired_capacity
+  max_size                  = local.application_data.accounts[local.environment].ec2_max_size
+  min_size                  = local.application_data.accounts[local.environment].ec2_min_size
+  health_check_grace_period = 60
+
+  launch_template {
+    id      = aws_launch_template.ec2-launch-template.id
+    version = "$Latest"
+  }
+
+  tag {
+    key                 = "Name"
+    value               = "${local.application_name}-cluster-scaling-group"
+    propagate_at_launch = true
+  }
+
+  dynamic "tag" {
+    for_each = local.tags
+
+    content {
+      key                 = tag.key
+      value               = tag.value
+      propagate_at_launch = true
+    }
+  }
+}
+
+resource "aws_key_pair" "ec2-user" {
+  key_name   = "${local.application_name}-ec2"
+  public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwVil3c3Nh/F6S1IzMFUMhykwj1SwQEXVvNghpUW5Ncm82ibJqtVccgCFW96HoHO7Bv8jt5O+TrfENlNI6yywASKEiJRDNUpBBK/UCqXQrYJ0KTvJ7FHegQjrxBOM/Lo3o3IniB2lNTe8hijBMrdaeKivWjB2YKTJxLFdUdLFjBop5uH0gL5Or6+P5/CyKmkIftn3Wazyq4Oe3mYQhB9Gr45/T8/UZCPnWWZ/p7AB3hH5jVO3BqHsB0t3YqJrbCV3Uo85xM62BBBV0AcWXNADY2f4A+6zcUX6j6BIfgAmYP3EQCZBxFq0BgxurF7xIh7CIjl4iIMQJ0sz3uoyLdh9f alistair.curtis@MJ004521"
+  tags       = local.tags
+  }
+
+resource "aws_security_group" "ecs_service" {
+  name_prefix = "ecs-service-sg-"
+  vpc_id      = data.aws_vpc.shared.id
+
+  ingress {
+    from_port       = 80
+    to_port         = 80
+    protocol        = "tcp"
+    description     = "Allow traffic on port 80 from load balancer"
+    security_groups = [aws_security_group.ifs_lb_sc.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# AWS EventBridge rule
+resource "aws_cloudwatch_event_rule" "ecs_events" {
+  name        = "ecs-events"
+  description = "Capture all ECS events"
+
+  event_pattern = jsonencode({
+    "source" : ["aws.ecs"],
+    "detail" : {
+      "clusterArn" : [aws_ecs_cluster.ecs_cluster.arn]
+    }
+  })
+}
+
+# AWS EventBridge target
+resource "aws_cloudwatch_event_target" "logs" {
+  depends_on = [aws_cloudwatch_log_group.deployment_logs]
+  rule       = aws_cloudwatch_event_rule.ecs_events.name
+  target_id  = "send-to-cloudwatch"
+  arn        = aws_cloudwatch_log_group.deployment_logs.arn
+}
+
+resource "aws_cloudwatch_log_resource_policy" "ecs_logging_policy" {
+  policy_document = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Sid" : "TrustEventsToStoreLogEvent",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : ["events.amazonaws.com", "delivery.logs.amazonaws.com"]
+        },
+        "Action" : [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        "Resource" : "arn:aws:logs:eu-west-2:${data.aws_caller_identity.current.account_id}:log-group:/aws/events/*:*"
+      }
+    ]
+  })
+  policy_name = "TrustEventsToStoreLogEvents"
+}
+
+# Set up CloudWatch group and log stream and retain logs for 30 days
+resource "aws_cloudwatch_log_group" "cloudwatch_group" {
+  name              = "${local.application_name}-ecs"
+  retention_in_days = 30
+}
+
+resource "aws_cloudwatch_log_stream" "cloudwatch_stream" {
+  name           = "${local.application_name}-log-stream"
+  log_group_name = aws_cloudwatch_log_group.cloudwatch_group.name
+}
diff --git a/terraform/environments/cdpt-ifs/loadbalancer.tf b/terraform/environments/cdpt-ifs/loadbalancer.tf
new file mode 100644
index 00000000000..6d948b3b1b2
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/loadbalancer.tf
@@ -0,0 +1,64 @@
+resource "aws_security_group" "ifs_lb_sc" {
+  name        = "load balancer security group"
+  description = "control access to the load balancer"
+  vpc_id      = data.aws_vpc.shared.id
+
+  ingress {
+    description = "allow access on HTTPS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description = "Open all outbound ports"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_lb" "ifs_lb" {
+  name               = "ifs-load-balancer"
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.ifs_lb_sc.id]
+  subnets            = data.aws_subnets.shared-public.ids
+}
+
+resource "aws_lb_target_group" "ifs_target_group" {
+  name                 = "ifs-target-group"
+  port                 = 80
+  protocol             = "HTTP"
+  vpc_id               = data.aws_vpc.shared.id
+  target_type          = "ip"
+  deregistration_delay = 30
+
+  stickiness {
+    type = "lb_cookie"
+  }
+
+  health_check {
+    healthy_threshold   = "2"
+    interval            = "30"
+    unhealthy_threshold = "5"
+    matcher             = "200-499"
+    timeout             = "10"
+  }
+}
+
+resource "aws_lb_listener" "https_listener" {
+  #checkov:skip=CKV_AWS_103
+  depends_on = [aws_acm_certificate_validation.external]
+
+  load_balancer_arn = aws_lb.ifs_lb.arn
+  port              = 443
+  protocol          = "HTTPS"
+  certificate_arn   = aws_acm_certificate.external.arn
+
+  default_action {
+    target_group_arn = aws_lb_target_group.ifs_target_group.id
+    type             = "forward"
+  }
+}
diff --git a/terraform/environments/cdpt-ifs/locals.tf b/terraform/environments/cdpt-ifs/locals.tf
index a7454414911..8d9234c26cd 100644
--- a/terraform/environments/cdpt-ifs/locals.tf
+++ b/terraform/environments/cdpt-ifs/locals.tf
@@ -1 +1,23 @@
-#### This file can be used to store locals specific to the member account ####
+locals {
+
+domain_types = { for dvo in aws_acm_certificate.external.domain_validation_options : dvo.domain_name => {
+    name   = dvo.resource_record_name
+    record = dvo.resource_record_value
+    type   = dvo.resource_record_type
+    }
+  }
+
+  domain_name_main   = [for k, v in local.domain_types : v.name if k == "modernisation-platform.service.justice.gov.uk"]
+  domain_name_sub    = [for k, v in local.domain_types : v.name if k != "modernisation-platform.service.justice.gov.uk"]
+  domain_record_main = [for k, v in local.domain_types : v.record if k == "modernisation-platform.service.justice.gov.uk"]
+  domain_record_sub  = [for k, v in local.domain_types : v.record if k != "modernisation-platform.service.justice.gov.uk"]
+  domain_type_main   = [for k, v in local.domain_types : v.type if k == "modernisation-platform.service.justice.gov.uk"]
+  domain_type_sub    = [for k, v in local.domain_types : v.type if k != "modernisation-platform.service.justice.gov.uk"]
+
+ecr_url = "${local.environment_management.account_ids["core-shared-services-production"]}.dkr.ecr.eu-west-2.amazonaws.com/cdpt-ifs-ecr-repo"
+
+user_data = base64encode(templatefile("user_data.txt", {
+    cluster_name = "${local.application_name}-ecs-cluster"
+  }))
+
+}
\ No newline at end of file
diff --git a/terraform/environments/cdpt-ifs/route53.tf b/terraform/environments/cdpt-ifs/route53.tf
new file mode 100644
index 00000000000..cb6bc2c468f
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/route53.tf
@@ -0,0 +1,65 @@
+// DEV + PRE-PRODUCTION DNS CONFIGURATION
+
+// ACM Public Certificate
+resource "aws_acm_certificate" "external" {
+  domain_name       = "modernisation-platform.service.justice.gov.uk"
+  validation_method = "DNS"
+
+  subject_alternative_names = ["${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}.modernisation-platform.service.justice.gov.uk"]
+  tags = {
+    Environment = local.environment
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_acm_certificate_validation" "external" {
+  certificate_arn         = aws_acm_certificate.external.arn
+  validation_record_fqdns = [local.domain_name_main[0], local.domain_name_sub[0]]
+}
+
+// Route53 DNS records for certificate validation
+resource "aws_route53_record" "external_validation" {
+  provider = aws.core-network-services
+
+  allow_overwrite = true
+  name            = local.domain_name_main[0]
+  records         = local.domain_record_main
+  ttl             = 60
+  type            = local.domain_type_main[0]
+  zone_id         = data.aws_route53_zone.network-services.zone_id
+}
+
+resource "aws_route53_record" "external_validation_subdomain" {
+  provider = aws.core-vpc
+
+  allow_overwrite = true
+  name            = local.domain_name_sub[0]
+  records         = local.domain_record_sub
+  ttl             = 60
+  type            = local.domain_type_sub[0]
+  zone_id         = data.aws_route53_zone.external.zone_id
+}
+
+// Route53 DNS record for directing traffic to the service
+resource "aws_route53_record" "external" {
+  provider = aws.core-vpc
+
+  zone_id = data.aws_route53_zone.external.zone_id
+  name    = "${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}.modernisation-platform.service.justice.gov.uk"
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.ifs_lb.dns_name
+    zone_id                = aws_lb.ifs_lb.zone_id
+    evaluate_target_health = true
+  }
+}
+
+
+// PRODUCTION DNS CONFIGURATION
+
+// ACM Public Certificate
+
diff --git a/terraform/environments/cdpt-ifs/user_data.txt b/terraform/environments/cdpt-ifs/user_data.txt
new file mode 100644
index 00000000000..6c9e085a925
--- /dev/null
+++ b/terraform/environments/cdpt-ifs/user_data.txt
@@ -0,0 +1,11 @@
+<powershell>
+Import-Module ECSTools
+[Environment]::SetEnvironmentVariable("ECS_CONTAINER_START_TIMEOUT", "15m", [System.EnvironmentVariableTarget]::Machine)
+[Environment]::SetEnvironmentVariable("ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE", "true", "Machine")
+[Environment]::SetEnvironmentVariable("ECS_ENABLE_TASK_IAM_ROLE", "true", "Machine")
+
+Initialize-ECSAgent –Cluster ${cluster_name} -EnableTaskIAMRole -LoggingDrivers '["json-file","awslogs"]' -EnableTaskENI
+
+Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
+
+</powershell>