diff --git a/terraform/environments/ccms-ebs-upgrade/application_variables.json b/terraform/environments/ccms-ebs-upgrade/application_variables.json
index 3fafe74446c..17c8109723b 100644
--- a/terraform/environments/ccms-ebs-upgrade/application_variables.json
+++ b/terraform/environments/ccms-ebs-upgrade/application_variables.json
@@ -4,7 +4,11 @@
       "short_env": "dev",
       "dns": "laa-development",
       "ses_domain_identity": "dev.legalservices.gov.uk",
-      "instance-scheduling": "skip-scheduling",
+      "instance-scheduling-accessgate": "skip-scheduling",
+      "instance-scheduling-ebsapps": "skip-scheduling",
+      "instance-scheduling-ebsconc": "skip-scheduling",
+      "instance-scheduling-ebsdb": "skip-scheduling",
+      "instance-scheduling-webgate": "skip-scheduling",
       "ec2_oracle_instance_type_ebsdb_test": "x2iedn.8xlarge",
       "ec2_oracle_instance_type_ebsdb": "m5d.4xlarge",
       "ec2_oracle_instance_cores_ebsdb": "8",
@@ -100,7 +104,12 @@
       "ebs_size_ebsconc_home": 100,
       "ebs_size_ebsconc_stage": 100,
       "ebs_size_ebsconc_temp": 100,
-      "ebs_backup_snapshot_id": "snap-0cdfe4b46c1e34ebb"
+      "ebs_backup_snapshot_id": "snap-0cdfe4b46c1e34ebb",
+      "instance_role_accessgate": "accessgate",
+      "instance_role_ebsapps": "apps",
+      "instance_role_ebsconc": "conc",
+      "instance_role_ebsdb": "db",
+      "instance_role_webgate": "webgate"
     }
   },
   "webgate_ebs": {
diff --git a/terraform/environments/ccms-ebs-upgrade/ccms-resource-groups.tf b/terraform/environments/ccms-ebs-upgrade/ccms-resource-groups.tf
new file mode 100644
index 00000000000..a868287a62c
--- /dev/null
+++ b/terraform/environments/ccms-ebs-upgrade/ccms-resource-groups.tf
@@ -0,0 +1,119 @@
+resource "aws_resourcegroups_group" "accessgate" {
+  name        = "accessgate"
+  description = "Accessgate instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["accessgate"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "ebsapps" {
+  name        = "ebsapps"
+  description = "EBSapps instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["ebsapps"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "conc" {
+  name        = "conc"
+  description = "EBSconc instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["conc"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "ebsdb" {
+  name        = "ebsdb"
+  description = "EBSdb instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["ebsdb"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "webgate" {
+  name        = "webgate"
+  description = "Webgate instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["webgate"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+output "aws_resourcegroups_group_accessgate_arn" {
+  description = "aws_resourcegroups_group accessgate arn"
+  value       = "aws_resourcegroups_group.accessgate.arn"
+}
+
+output "aws_resourcegroups_group_ebsapps_arn" {
+  description = "aws_resourcegroups_group ebsapps arn"
+  value       = "aws_resourcegroups_group.ebsapps.arn"
+}
+
+output "aws_resourcegroups_group_conc_arn" {
+  description = "aws_resourcegroups_group conc arn"
+  value       = "aws_resourcegroups_group.conc.arn"
+}
+
+output "aws_resourcegroups_group_ebsdb_arn" {
+  description = "aws_resourcegroups_group ebsdb arn"
+  value       = "aws_resourcegroups_group.ebsdb.arn"
+}
+
+output "aws_resourcegroups_group_webgate_arn" {
+  description = "aws_resourcegroups_group webgate arn"
+  value       = "aws_resourcegroups_group.webgate.arn"
+}
diff --git a/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-start.yaml b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-start.yaml
new file mode 100644
index 00000000000..ef5407c0434
--- /dev/null
+++ b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-start.yaml
@@ -0,0 +1,20 @@
+# ccms-ssm-document-ebs-apps-service-start.yaml
+---
+schemaVersion: "2.2"
+description: Execute the startAPP.sh script.
+parameters:
+  action:
+    type: String
+    allowedValues:
+    - start
+mainSteps:
+  - name: startAPP
+    action: aws:runShellScript
+    isEnd: true
+    precondition:
+      StringEquals:
+        - "{{ action }}"
+        - start
+    inputs:
+      runCommand:
+        - "/home/applmgr/scripts/startAPP.sh"
\ No newline at end of file
diff --git a/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-status.yaml b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-status.yaml
new file mode 100644
index 00000000000..8ec63b59af2
--- /dev/null
+++ b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-status.yaml
@@ -0,0 +1,20 @@
+# ccms-ssm-document-ebs-apps-service-status.yaml
+---
+schemaVersion: "2.2"
+description: Execute the statusAPP.sh script.
+parameters:
+  action:
+    type: String
+    allowedValues:
+    - status
+mainSteps:
+  - name: statusAPP
+    action: aws:runShellScript
+    isEnd: true
+    precondition:
+      StringEquals:
+        - "{{ action }}"
+        - status
+    inputs:
+      runCommand:
+        - "/home/applmgr/scripts/statusAPP.sh"
\ No newline at end of file
diff --git a/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-stop.yaml b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-stop.yaml
new file mode 100644
index 00000000000..1a1d12f9fd9
--- /dev/null
+++ b/terraform/environments/ccms-ebs-upgrade/ccms-ssm-document-ebs-apps-service-stop.yaml
@@ -0,0 +1,20 @@
+# ccms-ssm-document-ebs-apps-service-stop.yaml
+---
+schemaVersion: "2.2"
+description: Execute the stopAPP.sh script.
+parameters:
+  action:
+    type: String
+    allowedValues:
+    - stop
+mainSteps:
+  - name: stopAPP
+    action: aws:runShellScript
+    isEnd: true
+    precondition:
+      StringEquals:
+        - "{{ action }}"
+        - stop
+    inputs:
+      runCommand:
+        - "/home/applmgr/scripts/stopAPP.sh"
\ No newline at end of file
diff --git a/terraform/environments/ccms-ebs-upgrade/ccms-ssm.tf b/terraform/environments/ccms-ebs-upgrade/ccms-ssm.tf
new file mode 100644
index 00000000000..af1ed497e19
--- /dev/null
+++ b/terraform/environments/ccms-ebs-upgrade/ccms-ssm.tf
@@ -0,0 +1,92 @@
+resource "aws_ssm_document" "ebs_apps_service_start" {
+  name            = "EBS-Apps-Service-Start"
+  document_type   = "Command"
+  document_format = "YAML"
+
+  content = file("ccms-ssm-document-ebs-apps-service-start.yaml")
+}
+
+resource "aws_ssm_document" "ebs_apps_service_status" {
+  name            = "EBS-Apps-Service-Status"
+  document_type   = "Command"
+  document_format = "YAML"
+
+  content = file("ccms-ssm-document-ebs-apps-service-status.yaml")
+}
+
+resource "aws_ssm_document" "ebs_apps_service_stop" {
+  name            = "EBS-Apps-Service-Stop"
+  document_type   = "Command"
+  document_format = "YAML"
+
+  content = file("ccms-ssm-document-ebs-apps-service-stop.yaml")
+}
+
+resource "aws_ssm_maintenance_window" "ebs_apps_service_status_mw" {
+  name                       = "EBS-Apps-Service-Status"
+  schedule                   = "cron(*/15 * * * ? *)"
+  duration                   = 1
+  cutoff                     = 0
+  allow_unassociated_targets = false
+}
+
+resource "aws_ssm_maintenance_window" "ebs_apps_service_start_mw" {
+  name                       = "EBS-Apps-Service-Start"
+  schedule                   = "cron(15 7 * * ? *)" # "cron(15 7 ? * MON-FRI *)"
+  duration                   = 1
+  cutoff                     = 0
+  allow_unassociated_targets = false
+}
+
+resource "aws_ssm_maintenance_window" "ebs_apps_service_stop_mw" {
+  name                       = "EBS-Apps-Service-Stop"
+  schedule                   = "cron(45 17 * * ? *)"
+  duration                   = 1
+  cutoff                     = 0
+  allow_unassociated_targets = false
+}
+
+# resource "aws_ssm_maintenance_window_target" "ebs_apps_service_status_targets" {
+#   window_id        = aws_ssm_maintenance_window.ebs_apps_service_status_mw.id
+#   resource_type    = "INSTANCE"
+#   
+#   targets {
+#     key    = "ResourceGroup"
+#     values = ["EBS-Apps"]
+#   }
+# }
+# 
+# resource "aws_ssm_maintenance_window_target" "ebs_apps_service_start_targets" {
+#   window_id        = aws_ssm_maintenance_window.ebs_apps_service_start_mw.id
+#   resource_type    = "INSTANCE"
+#   
+#   targets {
+#     key    = "ResourceGroup"
+#     values = ["EBS-Apps"]
+#   }
+# }
+# 
+# resource "aws_ssm_maintenance_window_target" "ebs_apps_service_stop_targets" {
+#   window_id        = aws_ssm_maintenance_window.ebs_apps_service_stop_mw.id
+#   resource_type    = "INSTANCE"
+#   
+#   targets {
+#     key    = "ResourceGroup"
+#     values = ["EBS-Apps"]
+#   }
+# }
+
+# resource "aws_ssm_association" "start_app_association" {
+#   name            = "StartAppMaintenanceWindowAssociation"
+#   document_version = "$LATEST"
+#   instance_id     = aws_ssm_maintenance_window_target.foo_ec2_targets.targets[0].key
+#   targets {
+#     key    = "WindowTargetIds"
+#     values = [aws_ssm_maintenance_window_target.foo_ec2_targets.id]
+#   }
+#   parameters {
+#     "documentVersion" = "$LATEST"
+#     "documentName"    = aws_ssm_document.start_app_command_document.name
+#   }
+#   schedule_expression = "cron(15 7 ? * MON-FRI *)"
+# }
\ No newline at end of file
diff --git a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_accessgate.tf b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_accessgate.tf
index aac892f341b..d092af764ff 100644
--- a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_accessgate.tf
+++ b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_accessgate.tf
@@ -38,7 +38,8 @@ resource "aws_instance" "ec2_accessgate" {
     volume_size = 50
     encrypted   = true
     tags = merge(local.tags,
-      { Name = "root-block" }
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, count.index + 1, "root")) },
+      { device-name = "/dev/sda1" }
     )
   }
   # swap
@@ -48,6 +49,10 @@ resource "aws_instance" "ec2_accessgate" {
     volume_size = 20
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, count.index + 1, "swap")) },
+      { device-name = "/dev/sdb" }
+    )
   }
   # temp
   ebs_block_device {
@@ -56,6 +61,10 @@ resource "aws_instance" "ec2_accessgate" {
     volume_size = 100
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, count.index + 1, "temp")) },
+      { device-name = "/dev/sdc" }
+    )
   }
   # home
   ebs_block_device {
@@ -64,6 +73,10 @@ resource "aws_instance" "ec2_accessgate" {
     volume_size = 100
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, count.index + 1, "home")) },
+      { device-name = "/dev/sdd" }
+    )
   }
 
   # non-AMI mappings start at /dev/sdh
@@ -75,11 +88,16 @@ resource "aws_instance" "ec2_accessgate" {
     iops        = local.application_data.accounts[local.environment].accessgate_default_iops
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, count.index + 1, "ccms")) },
+      { device-name = "/dev/sdh" }
+    )
   }
 
   tags = merge(local.tags,
     { Name = lower(format("ec2-%s-%s-accessgate-%s", local.application_name, local.environment, count.index + 1)) },
-    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling },
+    { instance-role = local.application_data.accounts[local.environment].instance_role_accessgate },
+    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-accessgate },
     { backup = "true" }
   )
   depends_on = [aws_security_group.ec2_sg_accessgate]
diff --git a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_apps.tf b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_apps.tf
index 7136e078ab9..8532ae6974a 100644
--- a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_apps.tf
+++ b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_apps.tf
@@ -35,13 +35,15 @@ resource "aws_instance" "ec2_ebsapps" {
     volume_size = 50
     encrypted   = true
     tags = merge(local.tags,
-      { Name = "root-block" }
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "root")) },
+      { device-name = "/dev/sda1" }
     )
   }
 
   tags = merge(local.tags,
     { Name = lower(format("ec2-%s-%s-ebsapps-%s", local.application_name, local.environment, count.index + 1)) },
-    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling },
+    { instance-role = local.application_data.accounts[local.environment].instance_role_ebsapps },
+    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsapps },
     { backup = "true" }
   )
   depends_on = [aws_security_group.ec2_sg_ebsapps]
@@ -59,7 +61,8 @@ resource "aws_ebs_volume" "swap" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "swap" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "swap")) },
+    { device-name = "/dev/sdb" }
   )
 }
 
@@ -83,7 +86,8 @@ resource "aws_ebs_volume" "temp" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "temp" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "temp")) },
+    { device-name = "/dev/sdc" }
   )
 }
 
@@ -107,7 +111,8 @@ resource "aws_ebs_volume" "home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "home" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "home")) },
+    { device-name = "/dev/sdd" }
   )
 }
 
@@ -131,7 +136,8 @@ resource "aws_ebs_volume" "apps_export_home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "export home" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "export-home")) },
+    { device-name = "/dev/sdh" }
   )
 }
 
@@ -155,7 +161,8 @@ resource "aws_ebs_volume" "apps_u01" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "u01" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "u01")) },
+    { device-name = "/dev/sdi" }
   )
 }
 
@@ -179,7 +186,8 @@ resource "aws_ebs_volume" "apps_u03" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "u03" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "u03")) },
+    { device-name = "/dev/sdj" }
   )
 }
 
@@ -203,7 +211,8 @@ resource "aws_ebs_volume" "stage" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "stage" }
+    { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_ebsapps, count.index + 1, "stage")) },
+    { device-name = "/dev/sdk" }
   )
 }
 
diff --git a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_conc.tf b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_conc.tf
index ae67888f00f..37774056771 100644
--- a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_conc.tf
+++ b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_conc.tf
@@ -38,7 +38,8 @@ resource "aws_instance" "ec2_oracle_conc" {
 
   tags = merge(local.tags,
     { Name = lower(format("ec2-%s-%s-ebsconc", local.application_name, local.environment)) },
-    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling },
+    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsconc },
+    { instance-role = local.application_data.accounts[local.environment].instance_role_ebsconc },
     { backup = "true" },
     { OracleDbLTS-ManagedInstance = "true" }
   )
@@ -56,7 +57,8 @@ resource "aws_ebs_volume" "conc_export_home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc export/home" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "export/home")) },
+    { device-name = "/dev/sdh" }
   )
 }
 
@@ -77,7 +79,8 @@ resource "aws_ebs_volume" "conc_u01" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc u01" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "u01")) },
+    { device-name = "/dev/sdi" }
   )
 }
 
@@ -98,7 +101,8 @@ resource "aws_ebs_volume" "conc_u03" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc u03" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "u03")) },
+    { device-name = "/dev/sdj" }
   )
 }
 
@@ -119,7 +123,8 @@ resource "aws_ebs_volume" "conc_home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc home" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "home")) },
+    { device-name = "/dev/sdk" }
   )
 }
 
@@ -140,7 +145,8 @@ resource "aws_ebs_volume" "conc_stage" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc stage" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "stage")) },
+    { device-name = "/dev/sdl" }
   )
 }
 
@@ -161,7 +167,8 @@ resource "aws_ebs_volume" "conc_temp" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "conc temp" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsconc, "temp")) },
+    { device-name = "/dev/sdm" }
   )
 }
 
diff --git a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_db.tf b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_db.tf
index e0bfa431aad..b369ececf02 100644
--- a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_db.tf
+++ b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_db.tf
@@ -39,7 +39,8 @@ resource "aws_instance" "ec2_oracle_ebs" {
 
   tags = merge(local.tags,
     { Name = lower(format("ec2-%s-%s-ebsdb", local.application_name, local.environment)) },
-    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling },
+    { instance-role = local.application_data.accounts[local.environment].instance_role_ebsdb },
+    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsdb },
     { backup = "true" },
     { OracleDbLTS-ManagedInstance = "true" }
   )
@@ -57,7 +58,8 @@ resource "aws_ebs_volume" "ebsdb_swap" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "swap" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "swap")) },
+    { device-name = "/dev/sdb" }
   )
 }
 
@@ -81,7 +83,8 @@ resource "aws_ebs_volume" "export_home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "export/home" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "export-home")) },
+    { device-name = "/dev/sdh" }
   )
 }
 
@@ -102,7 +105,8 @@ resource "aws_ebs_volume" "u01" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "u01" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "u01")) },
+    { device-name = "/dev/sdi" }
   )
 }
 
@@ -123,7 +127,8 @@ resource "aws_ebs_volume" "arch" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "arch" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "arch")) },
+    { device-name = "/dev/sdj" }
   )
 }
 
@@ -144,7 +149,8 @@ resource "aws_ebs_volume" "dbf" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "dbf" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "dbf")) },
+    { device-name = "/dev/sdk" }
   )
 }
 
@@ -165,7 +171,8 @@ resource "aws_ebs_volume" "dbf01" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "dbf01" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "dbf01")) },
+    { device-name = "/dev/sde" }
   )
 }
 
@@ -189,7 +196,8 @@ resource "aws_ebs_volume" "dbf02" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "dbf02" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "dbf02")) },
+    { device-name = "/dev/sdf" }
   )
 }
 
@@ -213,7 +221,8 @@ resource "aws_ebs_volume" "dbf03" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "dbf03" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "dbf03")) },
+    { device-name = "/dev/sdg" }
   )
 }
 
@@ -237,7 +246,8 @@ resource "aws_ebs_volume" "redoA" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "redoA" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "redoA")) },
+    { device-name = "/dev/sdl" }
   )
 }
 
@@ -258,7 +268,8 @@ resource "aws_ebs_volume" "techst" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "techst" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "techst")) },
+    { device-name = "/dev/sdm" }
   )
 }
 
@@ -280,7 +291,8 @@ resource "aws_ebs_volume" "backup" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "backup" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "backup")) },
+    { device-name = "/dev/sdn" }
   )
 }
 
@@ -301,7 +313,8 @@ resource "aws_ebs_volume" "redoB" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "redoB" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "redoB")) },
+    { device-name = "/dev/sdo" }
   )
 }
 
@@ -325,7 +338,8 @@ resource "aws_ebs_volume" "diag" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "diag" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "diag")) },
+    { device-name = "/dev/sdp" }
   )
 }
 
@@ -350,7 +364,8 @@ resource "aws_ebs_volume" "appshare" {
   encrypted            = true
   kms_key_id           = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "appshare" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "appshare")) },
+    { device-name = "/dev/sdq" }
   )
 }
 
@@ -374,7 +389,8 @@ resource "aws_ebs_volume" "db_home" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "db home" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "db-home")) },
+    { device-name = "/dev/sdr" }
   )
 }
 
@@ -395,7 +411,8 @@ resource "aws_ebs_volume" "db_temp" {
   encrypted         = true
   kms_key_id        = data.aws_kms_key.ebs_shared.key_id
   tags = merge(local.tags,
-    { Name = "db temp" }
+    { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_ebsdb, "db-temp")) },
+    { device-name = "/dev/sds" }
   )
 }
 
diff --git a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_webgate.tf b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_webgate.tf
index ba188a543c2..fa8e503c2a6 100644
--- a/terraform/environments/ccms-ebs-upgrade/ec2-oracle_webgate.tf
+++ b/terraform/environments/ccms-ebs-upgrade/ec2-oracle_webgate.tf
@@ -38,7 +38,8 @@ resource "aws_instance" "ec2_webgate" {
     volume_size = 50
     encrypted   = true
     tags = merge(local.tags,
-      { Name = "root-block" }
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_webgate, count.index + 1, "root")) },
+      { device-name = "/dev/sda1" }
     )
   }
   # swap
@@ -48,6 +49,10 @@ resource "aws_instance" "ec2_webgate" {
     volume_size = 20
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_webgate, count.index + 1, "swap")) },
+      { device-name = "/dev/sdb" }
+    )
   }
   # temp
   ebs_block_device {
@@ -56,6 +61,10 @@ resource "aws_instance" "ec2_webgate" {
     volume_size = 100
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_webgate, count.index + 1, "temp")) },
+      { device-name = "/dev/sdc" }
+    )
   }
   # home
   ebs_block_device {
@@ -64,6 +73,10 @@ resource "aws_instance" "ec2_webgate" {
     volume_size = 100
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_webgate, count.index + 1, "home")) },
+      { device-name = "/dev/sdd" }
+    )
   }
 
   # non-AMI mappings start at /dev/sdh
@@ -75,11 +88,16 @@ resource "aws_instance" "ec2_webgate" {
     iops        = local.application_data.accounts[local.environment].webgate_default_iops
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
+    tags = merge(local.tags,
+      { Name = lower(format("%s-%s-%s", local.application_data.accounts[local.environment].instance_role_webgate, count.index + 1, "ccms")) },
+      { device-name = "/dev/sdh" }
+    )
   }
 
   tags = merge(local.tags,
     { Name = lower(format("ec2-%s-%s-webgate-%s", local.application_name, local.environment, count.index + 1)) },
-    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling },
+    { instance-role = local.application_data.accounts[local.environment].instance_role_webgate },
+    { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-webgate },
     { backup = "true" }
   )
   depends_on = [aws_security_group.ec2_sg_webgate]
diff --git a/terraform/environments/ccms-ebs/ccms-ec2-clamav.tf b/terraform/environments/ccms-ebs/ccms-ec2-clamav.tf
index 7ef733a8dae..e357e64ad5c 100644
--- a/terraform/environments/ccms-ebs/ccms-ec2-clamav.tf
+++ b/terraform/environments/ccms-ebs/ccms-ec2-clamav.tf
@@ -36,7 +36,7 @@ resource "aws_instance" "ec2_clamav" {
     encrypted   = true
     kms_key_id  = data.aws_kms_key.ebs_shared.key_id
     tags = merge(local.tags,
-      { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_accessgate, "root")) },
+      { Name = lower(format("%s-%s", local.application_data.accounts[local.environment].instance_role_clamav, "root")) },
       { device-name = "/dev/sda1" }
     )
   }
diff --git a/terraform/environments/ccms-ebs/ccms-resource-groups.tf b/terraform/environments/ccms-ebs/ccms-resource-groups.tf
new file mode 100644
index 00000000000..4ad83a7baca
--- /dev/null
+++ b/terraform/environments/ccms-ebs/ccms-resource-groups.tf
@@ -0,0 +1,167 @@
+resource "aws_resourcegroups_group" "accessgate" {
+  name        = "accessgate"
+  description = "Accessgate instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["accessgate"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "clamav" {
+  name        = "clamav"
+  description = "ClamAV instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["clamav"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "ebsapps" {
+  name        = "ebsapps"
+  description = "EBSapps instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["ebsapps"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "ebsdb" {
+  name        = "ebsdb"
+  description = "EBSdb instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["ebsdb"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "ftp" {
+  name        = "ftp"
+  description = "FTP instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["ftp"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "mailrelay" {
+  name        = "mailrelay"
+  description = "MailRelay instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["mailrelay"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+resource "aws_resourcegroups_group" "webgate" {
+  name        = "webgate"
+  description = "Webgate instances"
+
+  resource_query {
+    query = <<JSON
+{
+  "ResourceTypeFilters": [ "AWS::EC2::Instance" ],
+  "TagFilters": [
+    {
+      "Key": "instance-role",
+      "Values": ["webgate"]
+    }
+  ]
+}
+JSON
+  }
+}
+
+output "aws_resourcegroups_group_accessgate_arn" {
+  description = "aws_resourcegroups_group accessgate arn"
+  value       = "aws_resourcegroups_group.accessgate.arn"
+}
+
+output "aws_resourcegroups_group_clamav_arn" {
+  description = "aws_resourcegroups_group clamav arn"
+  value       = "aws_resourcegroups_group.clamav.arn"
+}
+
+output "aws_resourcegroups_group_ebsapps_arn" {
+  description = "aws_resourcegroups_group ebsapps arn"
+  value       = "aws_resourcegroups_group.ebsapps.arn"
+}
+
+output "aws_resourcegroups_group_ebsdb_arn" {
+  description = "aws_resourcegroups_group ebsdb arn"
+  value       = "aws_resourcegroups_group.ebsdb.arn"
+}
+
+output "aws_resourcegroups_group_ftp_arn" {
+  description = "aws_resourcegroups_group ftp arn"
+  value       = "aws_resourcegroups_group.ftp.arn"
+}
+
+output "aws_resourcegroups_group_mailrelay_arn" {
+  description = "aws_resourcegroups_group mailrelay arn"
+  value       = "aws_resourcegroups_group.mailrelay.arn"
+}
+
+output "aws_resourcegroups_group_webgate_arn" {
+  description = "aws_resourcegroups_group webgate arn"
+  value       = "aws_resourcegroups_group.webgate.arn"
+}
diff --git a/terraform/environments/ccms-ebs/ccms-ssm-document-service-actions.yaml b/terraform/environments/ccms-ebs/ccms-ssm-document-service-actions.yaml
new file mode 100644
index 00000000000..734d9585498
--- /dev/null
+++ b/terraform/environments/ccms-ebs/ccms-ssm-document-service-actions.yaml
@@ -0,0 +1,29 @@
+# ccms-ssm-document-service-actions.yaml
+---
+schemaVersion: "2.2"
+description: Perform an action on a selected service.
+parameters:
+  service:
+    type: String
+    allowedValues:
+    - chronyd
+    - postfix
+    - sshd
+  action:
+    type: String
+    allowedValues:
+    - status
+    - restart
+    - start
+    - stop
+mainSteps:
+  - name: ServiceActions
+    action: aws:runShellScript
+    isEnd: true
+    precondition:
+      StringEquals:
+        - platformType
+        - Linux
+    inputs:
+      runCommand:
+        - "systemctl {{ action }} {{ service }}"
\ No newline at end of file
diff --git a/terraform/environments/ccms-ebs/ccms-ssm-documents.tf b/terraform/environments/ccms-ebs/ccms-ssm-documents.tf
new file mode 100644
index 00000000000..81f3f3d5353
--- /dev/null
+++ b/terraform/environments/ccms-ebs/ccms-ssm-documents.tf
@@ -0,0 +1,7 @@
+resource "aws_ssm_document" "service_actions" {
+  name            = "ServiceActions"
+  document_type   = "Command"
+  document_format = "YAML"
+
+  content = file("ccms-ssm-document-service-actions.yaml")
+}
\ No newline at end of file