diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json
index f54d94e3e2a..0293820c599 100644
--- a/.devcontainer/devcontainer-lock.json
+++ b/.devcontainer/devcontainer-lock.json
@@ -21,4 +21,4 @@
       "integrity": "sha256:34eb8c510a11fc44abb8173519215fcb6b82715b94e647c69089ee23773c6dc8"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/terraform/environments/apex/ecs.tf b/terraform/environments/apex/ecs.tf
index 4137e84c413..9c9f053350c 100644
--- a/terraform/environments/apex/ecs.tf
+++ b/terraform/environments/apex/ecs.tf
@@ -6,17 +6,17 @@ module "apex-ecs" {
 
   source = "./modules/ecs"
 
-  subnet_set_name            = local.subnet_set_name
-  vpc_all                    = local.vpc_all
-  app_name                   = local.application_name
-  container_instance_type    = local.application_data.accounts[local.environment].container_instance_type
-  instance_type              = local.application_data.accounts[local.environment].instance_type
-  user_data                  = local.user_data
-  key_name                   = local.application_data.accounts[local.environment].key_name
-  task_definition            = local.task_definition
-  ec2_desired_capacity       = local.application_data.accounts[local.environment].ec2_desired_capacity
-  ec2_max_size               = local.application_data.accounts[local.environment].ec2_max_size
-  ec2_min_size               = local.application_data.accounts[local.environment].ec2_min_size
+  subnet_set_name         = local.subnet_set_name
+  vpc_all                 = local.vpc_all
+  app_name                = local.application_name
+  container_instance_type = local.application_data.accounts[local.environment].container_instance_type
+  instance_type           = local.application_data.accounts[local.environment].instance_type
+  user_data               = local.user_data
+  key_name                = local.application_data.accounts[local.environment].key_name
+  task_definition         = local.task_definition
+  ec2_desired_capacity    = local.application_data.accounts[local.environment].ec2_desired_capacity
+  ec2_max_size            = local.application_data.accounts[local.environment].ec2_max_size
+  ec2_min_size            = local.application_data.accounts[local.environment].ec2_min_size
   # task_definition_volume     = local.application_data.accounts[local.environment].task_definition_volume
   # network_mode               = local.application_data.accounts[local.environment].network_mode
   server_port                = local.application_data.accounts[local.environment].server_port
diff --git a/terraform/environments/apex/locals.tf b/terraform/environments/apex/locals.tf
index 8395c0ac08c..0712f9b3514 100644
--- a/terraform/environments/apex/locals.tf
+++ b/terraform/environments/apex/locals.tf
@@ -75,7 +75,7 @@ locals {
 
   env_account_id       = local.environment_management.account_ids[terraform.workspace]
   app_db_password_name = "APP_APEX_DBPASSWORD_TAD"
-  db_hostname = "db.${local.application_name}"
+  db_hostname          = "db.${local.application_name}"
 
   database-instance-userdata = <<EOF
 #!/bin/bash
diff --git a/terraform/environments/apex/modules/ecs/main.tf b/terraform/environments/apex/modules/ecs/main.tf
index 218b180e0d7..efbd76b8fff 100644
--- a/terraform/environments/apex/modules/ecs/main.tf
+++ b/terraform/environments/apex/modules/ecs/main.tf
@@ -20,11 +20,11 @@ data "aws_subnets" "shared-private" {
 }
 
 resource "aws_autoscaling_group" "cluster-scaling-group" {
-  vpc_zone_identifier = sort(data.aws_subnets.shared-private.ids)
-  name                = "${var.app_name}-cluster-scaling-group"
-  desired_capacity    = var.ec2_desired_capacity
-  max_size            = var.ec2_max_size
-  min_size            = var.ec2_min_size
+  vpc_zone_identifier   = sort(data.aws_subnets.shared-private.ids)
+  name                  = "${var.app_name}-cluster-scaling-group"
+  desired_capacity      = var.ec2_desired_capacity
+  max_size              = var.ec2_max_size
+  min_size              = var.ec2_min_size
   protect_from_scale_in = true
 
   launch_template {
diff --git a/terraform/environments/corporate-staff-rostering/locals_preproduction.tf b/terraform/environments/corporate-staff-rostering/locals_preproduction.tf
index 29db5947c48..33495f17f01 100644
--- a/terraform/environments/corporate-staff-rostering/locals_preproduction.tf
+++ b/terraform/environments/corporate-staff-rostering/locals_preproduction.tf
@@ -2,7 +2,7 @@ locals {
 
   baseline_presets_preproduction = {
     options = {
-      cloudwatch_metric_alarms_default_actions    = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "corporate-staff-rostering-preproduction"
diff --git a/terraform/environments/corporate-staff-rostering/locals_production.tf b/terraform/environments/corporate-staff-rostering/locals_production.tf
index ec4d88f62f5..2a489735c8b 100644
--- a/terraform/environments/corporate-staff-rostering/locals_production.tf
+++ b/terraform/environments/corporate-staff-rostering/locals_production.tf
@@ -2,8 +2,8 @@ locals {
 
   baseline_presets_production = {
     options = {
-      cloudwatch_metric_alarms_default_actions    = ["pagerduty"]
-      db_backup_lifecycle_rule = "rman_backup_one_month"      
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
+      db_backup_lifecycle_rule                 = "rman_backup_one_month"
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "corporate-staff-rostering-production"
diff --git a/terraform/environments/delius-core/modules/helpers/delius_microservice/rds_monitoring.tf b/terraform/environments/delius-core/modules/helpers/delius_microservice/rds_monitoring.tf
index fda4f04c74c..fc45414054f 100644
--- a/terraform/environments/delius-core/modules/helpers/delius_microservice/rds_monitoring.tf
+++ b/terraform/environments/delius-core/modules/helpers/delius_microservice/rds_monitoring.tf
@@ -27,14 +27,14 @@ resource "aws_cloudwatch_metric_alarm" "rds_cpu_over_threshold" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "rds_memory_over_threshold" {
-  count              = var.create_rds ? 1 : 0
-  alarm_name         = "${var.name}-rds-memory-threshold"
-  alarm_description  = "Triggers alarm if RDS Memory crosses a threshold"
-  namespace          = "AWS/RDS"
-  metric_name        = "FreeableMemory"
-  statistic          = "Average"
-  period             = "60"
-  evaluation_periods = "10"
+  count               = var.create_rds ? 1 : 0
+  alarm_name          = "${var.name}-rds-memory-threshold"
+  alarm_description   = "Triggers alarm if RDS Memory crosses a threshold"
+  namespace           = "AWS/RDS"
+  metric_name         = "FreeableMemory"
+  statistic           = "Average"
+  period              = "60"
+  evaluation_periods  = "10"
   alarm_actions       = [var.sns_topic_arn]
   ok_actions          = [var.sns_topic_arn]
   threshold           = "800000000"
@@ -54,14 +54,14 @@ resource "aws_cloudwatch_metric_alarm" "rds_memory_over_threshold" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "rds_read_latency_over_threshold" {
-  count              = var.create_rds ? 1 : 0
-  alarm_name         = "${var.name}-rds-read-latency-threshold"
-  alarm_description  = "Triggers alarm if RDS read latency crosses a threshold"
-  namespace          = "AWS/RDS"
-  metric_name        = "ReadLatency"
-  statistic          = "Average"
-  period             = "60"
-  evaluation_periods = "5"
+  count               = var.create_rds ? 1 : 0
+  alarm_name          = "${var.name}-rds-read-latency-threshold"
+  alarm_description   = "Triggers alarm if RDS read latency crosses a threshold"
+  namespace           = "AWS/RDS"
+  metric_name         = "ReadLatency"
+  statistic           = "Average"
+  period              = "60"
+  evaluation_periods  = "5"
   alarm_actions       = [var.sns_topic_arn]
   ok_actions          = [var.sns_topic_arn]
   threshold           = "5"
@@ -81,14 +81,14 @@ resource "aws_cloudwatch_metric_alarm" "rds_read_latency_over_threshold" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "rds_write_latency_over_threshold" {
-  count              = var.create_rds ? 1 : 0
-  alarm_name         = "${var.name}-rds-write-latency-threshold"
-  alarm_description  = "Triggers alarm if RDS write latency crosses a threshold"
-  namespace          = "AWS/RDS"
-  metric_name        = "WriteLatency"
-  statistic          = "Average"
-  period             = "60"
-  evaluation_periods = "5"
+  count               = var.create_rds ? 1 : 0
+  alarm_name          = "${var.name}-rds-write-latency-threshold"
+  alarm_description   = "Triggers alarm if RDS write latency crosses a threshold"
+  namespace           = "AWS/RDS"
+  metric_name         = "WriteLatency"
+  statistic           = "Average"
+  period              = "60"
+  evaluation_periods  = "5"
   alarm_actions       = [var.sns_topic_arn]
   ok_actions          = [var.sns_topic_arn]
   threshold           = "5"
@@ -108,14 +108,14 @@ resource "aws_cloudwatch_metric_alarm" "rds_write_latency_over_threshold" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "rds_connections_over_threshold" {
-  count              = var.create_rds ? 1 : 0
-  alarm_name         = "${var.name}-rds-db-connections-threshold"
-  alarm_description  = "Triggers alarm if RDS database connections crosses a threshold"
-  namespace          = "AWS/RDS"
-  metric_name        = "DatabaseConnections"
-  statistic          = "Average"
-  period             = "60"
-  evaluation_periods = "5"
+  count               = var.create_rds ? 1 : 0
+  alarm_name          = "${var.name}-rds-db-connections-threshold"
+  alarm_description   = "Triggers alarm if RDS database connections crosses a threshold"
+  namespace           = "AWS/RDS"
+  metric_name         = "DatabaseConnections"
+  statistic           = "Average"
+  period              = "60"
+  evaluation_periods  = "5"
   alarm_actions       = [var.sns_topic_arn]
   ok_actions          = [var.sns_topic_arn]
   threshold           = "100"
@@ -135,14 +135,14 @@ resource "aws_cloudwatch_metric_alarm" "rds_connections_over_threshold" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "rds_allocated_storage_queue_depth_over_threshold" {
-  count              = var.create_rds ? 1 : 0
-  alarm_name         = "${var.name}-rds-queue-depth-threshold"
-  alarm_description  = "Triggers alarm if RDS database queue depth crosses a threshold"
-  namespace          = "AWS/RDS"
-  metric_name        = "DiskQueueDepth"
-  statistic          = "Average"
-  period             = "300"
-  evaluation_periods = "5"
+  count               = var.create_rds ? 1 : 0
+  alarm_name          = "${var.name}-rds-queue-depth-threshold"
+  alarm_description   = "Triggers alarm if RDS database queue depth crosses a threshold"
+  namespace           = "AWS/RDS"
+  metric_name         = "DiskQueueDepth"
+  statistic           = "Average"
+  period              = "300"
+  evaluation_periods  = "5"
   alarm_actions       = [var.sns_topic_arn]
   ok_actions          = [var.sns_topic_arn]
   threshold           = "60"
diff --git a/terraform/environments/digital-prison-reporting/data.tf b/terraform/environments/digital-prison-reporting/data.tf
index 92ad7ca6498..1a7f5e6c9fe 100644
--- a/terraform/environments/digital-prison-reporting/data.tf
+++ b/terraform/environments/digital-prison-reporting/data.tf
@@ -45,7 +45,7 @@ data "aws_secretsmanager_secret_version" "datamart" {
 # AWS _IAM_ Policy
 data "aws_iam_policy" "rds_full_access" {
   #checkov:skip=CKV_AWS_275:Disallow policies from using the AWS AdministratorAccess policy
-  
+
   arn = "arn:aws:iam::aws:policy/AmazonRDSFullAccess"
 }
 
diff --git a/terraform/environments/digital-prison-reporting/kms.tf b/terraform/environments/digital-prison-reporting/kms.tf
index 1316c49dcc5..a5371f44895 100644
--- a/terraform/environments/digital-prison-reporting/kms.tf
+++ b/terraform/environments/digital-prison-reporting/kms.tf
@@ -31,7 +31,7 @@ data "aws_iam_policy_document" "s3-kms" {
     #checkov:skip=CKV_AWS_49
     #checkov:skip=CKV_AWS_108
     #checkov:skip=CKV_AWS_110   
-          
+
     effect    = "Allow"
     actions   = ["kms:*"]
     resources = ["*"]
@@ -190,7 +190,7 @@ resource "aws_kms_key" "operational_db" {
   #checkov:skip=CKV_AWS_33
   #checkov:skip=CKV_AWS_227
   #checkov:skip=CKV_AWS_7
-    
+
   description         = "Encryption key for Operational DB"
   enable_key_rotation = true
   key_usage           = "ENCRYPT_DECRYPT"
diff --git a/terraform/environments/digital-prison-reporting/main.tf b/terraform/environments/digital-prison-reporting/main.tf
index efbc7a19cc9..6196f55fd01 100644
--- a/terraform/environments/digital-prison-reporting/main.tf
+++ b/terraform/environments/digital-prison-reporting/main.tf
@@ -97,7 +97,7 @@ module "glue_reporting_hub_job" {
 # Glue Job, Reporting Hub Batch
 module "glue_reporting_hub_batch_job" {
   #checkov:skip=CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS, Skipping for Timebeing in view of Cost Savings”
-  
+
   source                        = "./modules/glue_job"
   create_job                    = local.create_job
   name                          = "${local.project}-reporting-hub-batch-${local.env}"
diff --git a/terraform/environments/digital-prison-reporting/modules/apigateway/serverless-lambda-gw/main.tf b/terraform/environments/digital-prison-reporting/modules/apigateway/serverless-lambda-gw/main.tf
index 1c075067b45..2bdf5e7056a 100644
--- a/terraform/environments/digital-prison-reporting/modules/apigateway/serverless-lambda-gw/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/apigateway/serverless-lambda-gw/main.tf
@@ -72,7 +72,7 @@ resource "aws_api_gateway_method" "this" {
   #checkov:skip=CKV_AWS_70:Ensure API gateway method has authorization or API key set
   #checkov:skip=CKV2_AWS_53: “Ignoring AWS API gateway request validatation"
   #checkov:skip=CCKV_AWS_59: "Ensure there is no open access to back-end resources through API"
-  
+
 
   authorization = "NONE"
   http_method   = "ANY"
@@ -92,7 +92,7 @@ resource "aws_api_gateway_integration" "this" {
 resource "aws_lambda_permission" "apigw_lambda" {
   #checkov:skip=CKV_AWS_364:Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount
   #checkov:skip=CKV_AWS_301:Ensure that AWS Lambda function is not publicly accessible
-  
+
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
   function_name = var.lambda_name
diff --git a/terraform/environments/digital-prison-reporting/modules/dms/main.tf b/terraform/environments/digital-prison-reporting/modules/dms/main.tf
index 63263a5d225..504ad6b9441 100644
--- a/terraform/environments/digital-prison-reporting/modules/dms/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/dms/main.tf
@@ -1,7 +1,7 @@
 # Create a new DMS replication instance
 resource "aws_dms_replication_instance" "dms-s3-target-instance" {
-#checkov:skip=CKV_AWS_222: "Ensure DMS replication instance gets all minor upgrade automatically"
-#checkov:skip=CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
+  #checkov:skip=CKV_AWS_222: "Ensure DMS replication instance gets all minor upgrade automatically"
+  #checkov:skip=CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
 
   count = var.setup_dms_instance ? 1 : 0
 
@@ -66,7 +66,7 @@ resource "aws_dms_replication_task" "dms-replication" {
 resource "aws_dms_endpoint" "dms-s3-target-source" {
   #checkov:skip=CKV2_AWS_49: "Ensure AWS Database Migration Service endpoints have SSL configured - Will resolve through Spike"
   #checkov:skip=CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
-  
+
   count = var.setup_dms_instance ? 1 : 0
 
   database_name = var.source_db_name
diff --git a/terraform/environments/digital-prison-reporting/modules/dms_dps/main.tf b/terraform/environments/digital-prison-reporting/modules/dms_dps/main.tf
index 0512383efb7..3b8a74a90b1 100644
--- a/terraform/environments/digital-prison-reporting/modules/dms_dps/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/dms_dps/main.tf
@@ -87,7 +87,7 @@ resource "aws_dms_endpoint" "source" {
 # Create an endpoint for the target Kinesis
 resource "aws_dms_endpoint" "target" {
   #checkov:skip=CKV2_AWS_49: "Ensure AWS Database Migration Service endpoints have SSL configured - Will resolve through Spike"
-  
+
   count = var.setup_dms_instance ? 1 : 0
 
   endpoint_id   = "${var.project_id}-dms-${var.short_name}-${var.dms_target_name}-target"
diff --git a/terraform/environments/digital-prison-reporting/modules/dms_s3_v2/main.tf b/terraform/environments/digital-prison-reporting/modules/dms_s3_v2/main.tf
index 17215c6eb06..e216e0f5b9d 100644
--- a/terraform/environments/digital-prison-reporting/modules/dms_s3_v2/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/dms_s3_v2/main.tf
@@ -115,7 +115,7 @@ resource "aws_dms_replication_task" "dms-replication" {
 # Create an endpoint for the source database
 resource "aws_dms_endpoint" "dms-s3-target-source" {
   #checkov:skip=CKV2_AWS_49: "Ensure AWS Database Migration Service endpoints have SSL configured - Will resolve through Spike"
-  
+
   count = var.setup_dms_endpoints && var.setup_dms_source_endpoint ? 1 : 0
 
   database_name = var.source_db_name
diff --git a/terraform/environments/digital-prison-reporting/modules/glue_job/main.tf b/terraform/environments/digital-prison-reporting/modules/glue_job/main.tf
index c78e0e9a639..e037c0a28f9 100644
--- a/terraform/environments/digital-prison-reporting/modules/glue_job/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/glue_job/main.tf
@@ -242,7 +242,7 @@ resource "aws_cloudwatch_log_group" "sec_config_output" {
 
 resource "aws_cloudwatch_log_group" "continuous_log" {
   #checkov:skip=CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS, Skipping for Timebeing in view of Cost Savings”
-  
+
   count = var.create_job ? 1 : 0
 
   name              = "/aws-glue/jobs/${var.name}-${var.short_name}-sec-config"
diff --git a/terraform/environments/digital-prison-reporting/modules/lambdas/generic/main.tf b/terraform/environments/digital-prison-reporting/modules/lambdas/generic/main.tf
index 1cf3d7954ed..71eb375110f 100644
--- a/terraform/environments/digital-prison-reporting/modules/lambdas/generic/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/lambdas/generic/main.tf
@@ -1,6 +1,6 @@
 resource "aws_cloudwatch_log_group" "this" {
   #checkov:skip=CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS, Skipping for Timebeing in view of Cost Savings”
-  
+
   count = var.enable_lambda ? 1 : 0
   name  = "/aws/lambda/${var.name}-function"
 
diff --git a/terraform/environments/digital-prison-reporting/modules/rds/aws-aurora/main.tf b/terraform/environments/digital-prison-reporting/modules/rds/aws-aurora/main.tf
index d563f53f880..9e2fe3d986e 100644
--- a/terraform/environments/digital-prison-reporting/modules/rds/aws-aurora/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/rds/aws-aurora/main.tf
@@ -419,7 +419,7 @@ resource "aws_db_parameter_group" "this" {
 # Log groups will not be created if using a cluster identifier prefix
 resource "aws_cloudwatch_log_group" "this" {
   #checkov:skip=CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS, Skipping for Timebeing in view of Cost Savings”
-  
+
   for_each = toset([for log in var.enabled_cloudwatch_logs_exports : log if local.create && var.create_cloudwatch_log_group && !var.cluster_use_name_prefix])
 
   name              = "/aws/rds/cluster/${var.name}/${each.value}"
diff --git a/terraform/environments/digital-prison-reporting/modules/rds/postgres/main.tf b/terraform/environments/digital-prison-reporting/modules/rds/postgres/main.tf
index 4cf1ab242f2..ca86ec3f3a5 100644
--- a/terraform/environments/digital-prison-reporting/modules/rds/postgres/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/rds/postgres/main.tf
@@ -1,6 +1,6 @@
 resource "aws_secretsmanager_secret" "password" {
   #checkov:skip=CKV2_AWS_57: “Ignore - Ensure Secrets Manager secrets should have automatic rotation enabled"
-  
+
   name = "${var.name}-password"
 }
 
@@ -38,7 +38,7 @@ resource "aws_db_subnet_group" "subnets" {
 resource "aws_db_instance" "default" {
   #checkov:skip=CKV2_AWS_30:”Query Logging is not required"
   #checkov:skip=CKV2_AWS_60: “Ignore -Ensure RDS instance with copy tags to snapshots is enabled"
-  
+
   count                   = var.enable_rds ? 1 : 0
   identifier              = var.name
   db_name                 = var.db_name
diff --git a/terraform/environments/digital-prison-reporting/modules/redshift/secrets.tf b/terraform/environments/digital-prison-reporting/modules/redshift/secrets.tf
index 167a95f1f58..6bf4b9bdb11 100644
--- a/terraform/environments/digital-prison-reporting/modules/redshift/secrets.tf
+++ b/terraform/environments/digital-prison-reporting/modules/redshift/secrets.tf
@@ -17,7 +17,7 @@ resource "random_string" "unique_suffix" {
 
 resource "aws_secretsmanager_secret" "redshift_connection" {
   #checkov:skip=CKV2_AWS_57: “Ignore - Ensure Secrets Manager secrets should have automatic rotation enabled"
-  
+
   description = "Redshift connect details"
   name        = "${var.project_id}-redshift-secret-${var.env}"
 }
diff --git a/terraform/environments/digital-prison-reporting/modules/s3_bucket/main.tf b/terraform/environments/digital-prison-reporting/modules/s3_bucket/main.tf
index 15039e8e5d0..a0d590b88ac 100644
--- a/terraform/environments/digital-prison-reporting/modules/s3_bucket/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/s3_bucket/main.tf
@@ -9,7 +9,7 @@ resource "aws_s3_bucket" "storage" { # TBC "application_tf_state" should be gene
   #checkov:skip=CKV_AWS_144
   #checkov:skip=CKV2_AWS_6
   #checkov:skip=CKV_AWS_21:”Not all S3 bucket requires versioning enabaled"
-  
+
   bucket = var.name
 
   lifecycle {
diff --git a/terraform/environments/digital-prison-reporting/modules/secrets_manager/main.tf b/terraform/environments/digital-prison-reporting/modules/secrets_manager/main.tf
index 2c1784622d0..d54e14c8b7c 100644
--- a/terraform/environments/digital-prison-reporting/modules/secrets_manager/main.tf
+++ b/terraform/environments/digital-prison-reporting/modules/secrets_manager/main.tf
@@ -18,7 +18,7 @@ resource "random_password" "random_string" {
 
 resource "aws_secretsmanager_secret" "secret" {
   #checkov:skip=CKV2_AWS_57: “Ignore - Ensure Secrets Manager secrets should have automatic rotation enabled"
-  
+
   name                    = var.name == "" ? null : var.name
   name_prefix             = var.name == "" ? var.name_prefix : null
   description             = var.description
diff --git a/terraform/environments/digital-prison-reporting/operational_datastore.tf b/terraform/environments/digital-prison-reporting/operational_datastore.tf
index 1db6546d282..2ff022941a8 100644
--- a/terraform/environments/digital-prison-reporting/operational_datastore.tf
+++ b/terraform/environments/digital-prison-reporting/operational_datastore.tf
@@ -135,7 +135,7 @@ resource "aws_glue_connection" "glue_operational_datastore_connection" {
 
 resource "aws_security_group" "glue_operational_datastore_connection_sg" {
   #checkov:skip=CKV2_AWS_5
-  
+
   name        = "${local.project}-operational-datastore-connection_sg"
   description = "Security group to allow glue access to Operational Datastore via JDBC Connection"
   vpc_id      = data.aws_vpc.shared.id
diff --git a/terraform/environments/digital-prison-reporting/platform_versions.tf b/terraform/environments/digital-prison-reporting/platform_versions.tf
index 5c3d9315e8e..84c8e921cf7 100644
--- a/terraform/environments/digital-prison-reporting/platform_versions.tf
+++ b/terraform/environments/digital-prison-reporting/platform_versions.tf
@@ -15,7 +15,7 @@ terraform {
     random = {
       version = "~> 3.0"
       source  = "hashicorp/random"
-    }    
+    }
   }
   required_version = "~> 1.0"
 }
diff --git a/terraform/environments/digital-prison-reporting/policy.tf b/terraform/environments/digital-prison-reporting/policy.tf
index dc6179e0c8a..92d82b2a5cf 100644
--- a/terraform/environments/digital-prison-reporting/policy.tf
+++ b/terraform/environments/digital-prison-reporting/policy.tf
@@ -309,7 +309,7 @@ data "aws_iam_policy_document" "redshift-additional-policy" {
   #checkov:skip=CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
   #checkov:skip=CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
   #checkov:skip=CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
-  
+
   statement {
     actions = [
       "glue:*"
@@ -540,7 +540,7 @@ data "aws_iam_policy_document" "domain_builder_preview" {
 }
 
 resource "aws_iam_policy" "domain_builder_preview_policy" {
-  
+
   name        = "${local.project}-domain-builder-preview-policy"
   description = "Additional policy to allow execution of query previews in Athena"
   policy      = data.aws_iam_policy_document.domain_builder_preview.json
diff --git a/terraform/environments/digital-prison-reporting/secrets.tf b/terraform/environments/digital-prison-reporting/secrets.tf
index 8d3eccb5585..2d44e9d14d5 100644
--- a/terraform/environments/digital-prison-reporting/secrets.tf
+++ b/terraform/environments/digital-prison-reporting/secrets.tf
@@ -310,7 +310,7 @@ resource "aws_secretsmanager_secret_version" "dbt_secrets" {
 resource "aws_secretsmanager_secret" "dbt_secrets" {
   #checkov:skip=CKV2_AWS_57: “Ignore - Ensure Secrets Manager secrets should have automatic rotation enabled"
   #checkov:skip=CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
-  
+
   count = local.enable_dbt_k8s_secrets ? 1 : 0
 
   name = "external/analytics_platform/k8s_dbt_auth"
diff --git a/terraform/environments/digital-prison-reporting/sg.tf b/terraform/environments/digital-prison-reporting/sg.tf
index 911b2215844..a00ec259001 100644
--- a/terraform/environments/digital-prison-reporting/sg.tf
+++ b/terraform/environments/digital-prison-reporting/sg.tf
@@ -5,7 +5,7 @@ data "aws_vpc" "dpr" {
 ## Lambda Generic SG
 resource "aws_security_group" "lambda_generic" {
   #checkov:skip=CKV2_AWS_5
-  
+
   count = local.enable_generic_lambda_sg ? 1 : 0
 
   name_prefix = "${local.generic_lambda}-sg"
@@ -27,7 +27,7 @@ resource "aws_security_group" "lambda_generic" {
 }
 
 resource "aws_security_group_rule" "lambda_ingress_generic" {
-#checkov:skip=CKV_AWS_23: "Ensure every security group and rule has a description"
+  #checkov:skip=CKV_AWS_23: "Ensure every security group and rule has a description"
 
   count = local.enable_generic_lambda_sg ? 1 : 0
 
diff --git a/terraform/environments/digital-prison-reporting/temporary_domain_refresh_jobs.tf b/terraform/environments/digital-prison-reporting/temporary_domain_refresh_jobs.tf
index a52b3540380..cd0c4d4266d 100644
--- a/terraform/environments/digital-prison-reporting/temporary_domain_refresh_jobs.tf
+++ b/terraform/environments/digital-prison-reporting/temporary_domain_refresh_jobs.tf
@@ -125,7 +125,7 @@ module "glue_temp_refresh_job_establishment_living_unit" {
 # Glue Job, Domain Refresh movements/movements
 module "glue_temp_refresh_job_movements_movements" {
   #checkov:skip=CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS, Skipping for Timebeing in view of Cost Savings"
-  
+
   source                 = "./modules/glue_job"
   create_job             = local.create_job
   name                   = local.domain_refresh_movements_movements
diff --git a/terraform/environments/edw/ec2.tf b/terraform/environments/edw/ec2.tf
index b1b2ff87879..404ac1cacbb 100644
--- a/terraform/environments/edw/ec2.tf
+++ b/terraform/environments/edw/ec2.tf
@@ -408,9 +408,9 @@ EOF
 
 ####### IAM role #######
 
-resource "aws_iam_role" "edw_ec2_role" { 
-  name = "${local.application_name}-ec2-instance-role"
-  managed_policy_arns = ["arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"]    
+resource "aws_iam_role" "edw_ec2_role" {
+  name                = "${local.application_name}-ec2-instance-role"
+  managed_policy_arns = ["arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"]
   tags = merge(
     local.tags,
     {
@@ -724,30 +724,30 @@ resource "aws_vpc_security_group_ingress_rule" "db_lambda" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "RDS_Appstream" {
-  security_group_id            = aws_security_group.edw_db_security_group.id
-  description                  = "RDS Appstream access"
-  cidr_ipv4                    = "10.200.32.0/19"
-  from_port                    = 1521
-  ip_protocol                  = "tcp"
-  to_port                      = 1521
+  security_group_id = aws_security_group.edw_db_security_group.id
+  description       = "RDS Appstream access"
+  cidr_ipv4         = "10.200.32.0/19"
+  from_port         = 1521
+  ip_protocol       = "tcp"
+  to_port           = 1521
 }
 
 resource "aws_vpc_security_group_ingress_rule" "RDS_workstream" {
-  security_group_id            = aws_security_group.edw_db_security_group.id
-  description                  = "RDS Workspace access"
-  cidr_ipv4                    = local.application_data.accounts[local.environment].edw_management_cidr
-  from_port                    = 1521
-  ip_protocol                  = "tcp"
-  to_port                      = 1521
+  security_group_id = aws_security_group.edw_db_security_group.id
+  description       = "RDS Workspace access"
+  cidr_ipv4         = local.application_data.accounts[local.environment].edw_management_cidr
+  from_port         = 1521
+  ip_protocol       = "tcp"
+  to_port           = 1521
 }
 
 resource "aws_vpc_security_group_ingress_rule" "RDS_env" {
-  security_group_id            = aws_security_group.edw_db_security_group.id
-  description                  = "RDS env access"
-  cidr_ipv4                    = data.aws_vpc.shared.cidr_block
-  from_port                    = 1521
-  ip_protocol                  = "tcp"
-  to_port                      = 1521
+  security_group_id = aws_security_group.edw_db_security_group.id
+  description       = "RDS env access"
+  cidr_ipv4         = data.aws_vpc.shared.cidr_block
+  from_port         = 1521
+  ip_protocol       = "tcp"
+  to_port           = 1521
 }
 
 resource "aws_vpc_security_group_egress_rule" "all_out" {
diff --git a/terraform/environments/edw/efs.tf b/terraform/environments/edw/efs.tf
index d647855135e..ec24f06d12b 100644
--- a/terraform/environments/edw/efs.tf
+++ b/terraform/environments/edw/efs.tf
@@ -2,8 +2,8 @@ resource "aws_efs_file_system" "edw" {
 
   performance_mode = "maxIO"
   throughput_mode  = "bursting"
-  encrypted  = "true"
-  kms_key_id = aws_kms_key.efs.arn
+  encrypted        = "true"
+  kms_key_id       = aws_kms_key.efs.arn
 
   lifecycle_policy {
     transition_to_ia = "AFTER_90_DAYS"
diff --git a/terraform/environments/electronic-monitoring-data/api_gateway.tf b/terraform/environments/electronic-monitoring-data/api_gateway.tf
index fe80f2bd9ae..b5f1dbef435 100644
--- a/terraform/environments/electronic-monitoring-data/api_gateway.tf
+++ b/terraform/environments/electronic-monitoring-data/api_gateway.tf
@@ -5,10 +5,10 @@
 resource "aws_api_gateway_rest_api" "get_zipped_file" {
   name        = "get_zipped_file"
   description = "API Gateway to trigger Step Function to get a unzipped file from zipped store"
-  
- lifecycle {
-   create_before_destroy = true
- }
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "aws_api_gateway_resource" "get_zipped_step_function_invoke" {
@@ -18,9 +18,9 @@ resource "aws_api_gateway_resource" "get_zipped_step_function_invoke" {
 }
 
 resource "aws_api_gateway_method" "get_zipped_step_function_invoke" {
-  rest_api_id   = aws_api_gateway_rest_api.get_zipped_file.id
-  resource_id   = aws_api_gateway_resource.get_zipped_step_function_invoke.id
-  http_method = "OPTIONS"
+  rest_api_id      = aws_api_gateway_rest_api.get_zipped_file.id
+  resource_id      = aws_api_gateway_resource.get_zipped_step_function_invoke.id
+  http_method      = "OPTIONS"
   authorization    = "NONE"
   api_key_required = true
 }
@@ -30,34 +30,34 @@ resource "aws_api_gateway_method" "get_zipped_step_function_invoke" {
 # --------------------------------------------------------
 
 data "aws_iam_policy_document" "gateway_role_policy" {
-    statement {
-        actions = ["sts:AssumeRole"]
-        effect = "Allow"
-        principals {
-            type = "Service"
-            identifiers = ["apigateway.amazonaws.com"]
-        }
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["apigateway.amazonaws.com"]
     }
+  }
 }
 
 
 resource "aws_iam_role" "get_zipped_gateway_role" {
-  name = "get_zipped_gateway_role"
+  name               = "get_zipped_gateway_role"
   assume_role_policy = data.aws_iam_policy_document.gateway_role_policy.json
 }
 
 data "aws_iam_policy_document" "trigger_step_function_policy" {
-    statement {
-        actions = ["states:StartExecution"]
-        effect = "Allow"
-        resources = [module.get_zipped_file.arn]
-    }
+  statement {
+    actions   = ["states:StartExecution"]
+    effect    = "Allow"
+    resources = [module.get_zipped_file.arn]
+  }
 }
 
 resource "aws_iam_policy" "trigger_step_function_policy" {
   name        = "trigger_step_function_policy"
   description = "Policy to trigger Step Function"
-  policy = data.aws_iam_policy_document.trigger_step_function_policy.json
+  policy      = data.aws_iam_policy_document.trigger_step_function_policy.json
 }
 
 resource "aws_iam_role_policy_attachment" "get_zipped_gateway_trigger_step_function_policy_attachment" {
@@ -97,10 +97,10 @@ resource "aws_api_gateway_deployment" "deployment" {
     #       resources will show a difference after the initial implementation.
     #       It will stabilize to only change when resources change afterwards.
     redeployment = sha1(jsonencode([
-        # put some stuff once written
-        aws_api_gateway_resource.get_zipped_step_function_invoke,
-        aws_api_gateway_method.get_zipped_step_function_invoke,
-        aws_api_gateway_integration.get_zipped_step_function_invoke,
+      # put some stuff once written
+      aws_api_gateway_resource.get_zipped_step_function_invoke,
+      aws_api_gateway_method.get_zipped_step_function_invoke,
+      aws_api_gateway_integration.get_zipped_step_function_invoke,
     ]))
   }
 
diff --git a/terraform/environments/electronic-monitoring-data/lambdas_main.tf b/terraform/environments/electronic-monitoring-data/lambdas_main.tf
index 45c0b2f63a3..b000cae41f0 100644
--- a/terraform/environments/electronic-monitoring-data/lambdas_main.tf
+++ b/terraform/environments/electronic-monitoring-data/lambdas_main.tf
@@ -316,7 +316,7 @@ module "unzip_single_file" {
   core_shared_services_id = local.environment_management.account_ids["core-shared-services-production"]
   production_dev          = local.is-production ? "prod" : "dev"
   environment_variables = {
-    BUCKET_NAME = aws_s3_bucket.data_store.id
+    BUCKET_NAME        = aws_s3_bucket.data_store.id
     EXPORT_BUCKET_NAME = module.unzipped-s3-data-store.bucket.id
   }
 }
diff --git a/terraform/environments/electronic-monitoring-data/modules/step_function/main.tf b/terraform/environments/electronic-monitoring-data/modules/step_function/main.tf
index e784f177448..a1fd180a7d4 100644
--- a/terraform/environments/electronic-monitoring-data/modules/step_function/main.tf
+++ b/terraform/environments/electronic-monitoring-data/modules/step_function/main.tf
@@ -1,93 +1,93 @@
 resource "aws_sfn_state_machine" "this" {
-  name     = var.name
-  role_arn = aws_iam_role.step_function_role.arn
+  name       = var.name
+  role_arn   = aws_iam_role.step_function_role.arn
   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
 }
 
 resource "aws_iam_role" "step_function_role" {
-    name = "${var.name}_step_function_role"
-    assume_role_policy = data.aws_iam_policy_document.assume_step_function.json
+  name               = "${var.name}_step_function_role"
+  assume_role_policy = data.aws_iam_policy_document.assume_step_function.json
 }
 
 resource "aws_iam_role_policy_attachment" "this_attachment" {
-    for_each = var.iam_policies
+  for_each = var.iam_policies
 
-    role       = aws_iam_role.step_function_role.name
-    policy_arn = each.value.arn
+  role       = aws_iam_role.step_function_role.name
+  policy_arn = each.value.arn
 }
 
 resource "aws_iam_role_policy_attachment" "base_perms_attached" {
-    role       = aws_iam_role.step_function_role.name
-    policy_arn = aws_iam_policy.step_function_base_permissions.arn
+  role       = aws_iam_role.step_function_role.name
+  policy_arn = aws_iam_policy.step_function_base_permissions.arn
 }
 
 
 data "aws_iam_policy_document" "assume_step_function" {
-    statement {
+  statement {
     effect = "Allow"
     principals {
-        type        = "Service"
-        identifiers = ["states.amazonaws.com"]
-    }
-    actions   = ["sts:AssumeRole"]
+      type        = "Service"
+      identifiers = ["states.amazonaws.com"]
     }
+    actions = ["sts:AssumeRole"]
+  }
 }
 
 data "aws_iam_policy_document" "step_function_base_permissions" {
-    statement {
-        effect = "Allow"
-        actions   = [
-            "sns:Publish",
-            "sqs:SendMessage"
-            ]
-        resources = ["*"]
-    }
+  statement {
+    effect = "Allow"
+    actions = [
+      "sns:Publish",
+      "sqs:SendMessage"
+    ]
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "step_function_base_permissions" {
-    name = "step_function_base_permissions"
-    policy = data.aws_iam_policy_document.step_function_base_permissions.json
+  name   = "step_function_base_permissions"
+  policy = data.aws_iam_policy_document.step_function_base_permissions.json
 }
 
 data "aws_iam_policy_document" "this_log_key_document" {
-    statement {
+  statement {
     sid    = "EnableIAMUserPermissions"
     effect = "Allow"
     principals {
-        type        = "AWS"
-        identifiers = ["arn:aws:iam::${var.env_account_id}:root"]
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.env_account_id}:root"]
     }
     actions   = ["kms:*"]
     resources = ["*"]
-    }
+  }
 
-    statement {
+  statement {
     sid    = "EnableLogServicePermissions"
     effect = "Allow"
     principals {
-        type        = "Service"
-        identifiers = ["logs.eu-west-2.amazonaws.com"]
+      type        = "Service"
+      identifiers = ["logs.eu-west-2.amazonaws.com"]
     }
     actions = [
-        "kms:Encrypt*",
-        "kms:Decrypt*",
-        "kms:ReEncrypt*",
-        "kms:GenerateDataKey*",
-        "kms:Describe*",
+      "kms:Encrypt*",
+      "kms:Decrypt*",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:Describe*",
     ]
     resources = ["*"]
-    }
+  }
 }
 
 
 resource "aws_kms_key_policy" "kms_key_policy" {
-    key_id = aws_kms_key.this_log_key.id
-    policy = data.aws_iam_policy_document.this_log_key_document.json
+  key_id = aws_kms_key.this_log_key.id
+  policy = data.aws_iam_policy_document.this_log_key_document.json
 }
 
 resource "aws_kms_key" "this_log_key" {
-    description         = "KMS key for encrypting Step Functions logs"
-    enable_key_rotation = true
+  description         = "KMS key for encrypting Step Functions logs"
+  enable_key_rotation = true
 }
 
 resource "aws_cloudwatch_log_group" "this_log_group" {
diff --git a/terraform/environments/electronic-monitoring-data/modules/step_function/outputs.tf b/terraform/environments/electronic-monitoring-data/modules/step_function/outputs.tf
index f09f6ebc93b..1c175c3d3ac 100644
--- a/terraform/environments/electronic-monitoring-data/modules/step_function/outputs.tf
+++ b/terraform/environments/electronic-monitoring-data/modules/step_function/outputs.tf
@@ -1,3 +1,3 @@
 output "arn" {
-    value = aws_sfn_state_machine.this.arn
+  value = aws_sfn_state_machine.this.arn
 }
\ No newline at end of file
diff --git a/terraform/environments/electronic-monitoring-data/modules/step_function/variables.tf b/terraform/environments/electronic-monitoring-data/modules/step_function/variables.tf
index 3545504c88f..0e245ca0f25 100644
--- a/terraform/environments/electronic-monitoring-data/modules/step_function/variables.tf
+++ b/terraform/environments/electronic-monitoring-data/modules/step_function/variables.tf
@@ -1,21 +1,21 @@
 variable "name" {
-    type = string
-    nullable = false
+  type     = string
+  nullable = false
 }
 
 variable "iam_policies" {
   type = map(object({
-    arn  = string
+    arn = string
   }))
   nullable = false
 }
 
 variable "env_account_id" {
-    type = string
-    nullable = false
+  type     = string
+  nullable = false
 }
 
 variable "variable_dictionary" {
-    type = map
-    nullable = false
+  type     = map(any)
+  nullable = false
 }
\ No newline at end of file
diff --git a/terraform/environments/electronic-monitoring-data/step_functions_main.tf b/terraform/environments/electronic-monitoring-data/step_functions_main.tf
index 056d1818e1a..84b2eb2226b 100644
--- a/terraform/environments/electronic-monitoring-data/step_functions_main.tf
+++ b/terraform/environments/electronic-monitoring-data/step_functions_main.tf
@@ -216,7 +216,7 @@ resource "aws_cloudwatch_log_group" "send_database_to_ap" {
 
 data "aws_iam_policy_document" "trigger_unzip_lambda" {
   statement {
-    effect = "Allow"
+    effect  = "Allow"
     actions = ["lambda:InvokeFunction"]
     resources = [
       module.unzip_single_file.lambda_function_arn,
@@ -226,18 +226,18 @@ data "aws_iam_policy_document" "trigger_unzip_lambda" {
 }
 
 resource "aws_iam_policy" "trigger_unzip_lambda" {
-  name = "trigger_unzip_lambda"
+  name   = "trigger_unzip_lambda"
   policy = data.aws_iam_policy_document.trigger_unzip_lambda.json
 }
 
 module "get_zipped_file" {
-  source = "./modules/step_function"
-  name = "get_zipped_file"
-  iam_policies = tomap({"trigger_unzip_lambda" = aws_iam_policy.trigger_unzip_lambda})
+  source         = "./modules/step_function"
+  name           = "get_zipped_file"
+  iam_policies   = tomap({ "trigger_unzip_lambda" = aws_iam_policy.trigger_unzip_lambda })
   env_account_id = local.env_account_id
   variable_dictionary = tomap(
     {
-      "unzip_file_name" = module.unzip_single_file.lambda_function_name, 
+      "unzip_file_name"            = module.unzip_single_file.lambda_function_name,
       "pre_signed_url_lambda_name" = module.unzipped_presigned_url.lambda_function_name
     }
   )
diff --git a/terraform/environments/mojfin/mojfin-rds.tf b/terraform/environments/mojfin/mojfin-rds.tf
index a617cd52eab..1473abc3400 100644
--- a/terraform/environments/mojfin/mojfin-rds.tf
+++ b/terraform/environments/mojfin/mojfin-rds.tf
@@ -70,9 +70,9 @@ resource "aws_db_instance" "appdb1" {
   storage_encrypted               = true
   apply_immediately               = true
   # snapshot_identifier             = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id,local.application_data.accounts[local.environment].mojfinrdssnapshotid)
-  kms_key_id        = data.aws_kms_key.rds_shared.arn
-  multi_az          = true
-  option_group_name = aws_db_option_group.mojfin.name
+  kms_key_id         = data.aws_kms_key.rds_shared.arn
+  multi_az           = true
+  option_group_name  = aws_db_option_group.mojfin.name
   ca_cert_identifier = local.ca_cert_identifier
 
   # restore_to_point_in_time {
diff --git a/terraform/environments/nomis/locals_development.tf b/terraform/environments/nomis/locals_development.tf
index ea0cc4a0597..6ad6b74dc13 100644
--- a/terraform/environments/nomis/locals_development.tf
+++ b/terraform/environments/nomis/locals_development.tf
@@ -9,7 +9,7 @@ locals {
     options = {
       sns_topics = {
         pagerduty_integrations = {
-          pagerduty                   = "nomis-development"
+          pagerduty = "nomis-development"
         }
       }
     }
diff --git a/terraform/environments/nomis/locals_preproduction.tf b/terraform/environments/nomis/locals_preproduction.tf
index af0f5e11519..c9d5987cdc8 100644
--- a/terraform/environments/nomis/locals_preproduction.tf
+++ b/terraform/environments/nomis/locals_preproduction.tf
@@ -13,7 +13,7 @@ locals {
       }
       sns_topics = {
         pagerduty_integrations = {
-          pagerduty                   = "nomis-preproduction"
+          pagerduty = "nomis-preproduction"
         }
       }
     }
diff --git a/terraform/environments/nomis/locals_production.tf b/terraform/environments/nomis/locals_production.tf
index a5739eee43e..309db9df6c5 100644
--- a/terraform/environments/nomis/locals_production.tf
+++ b/terraform/environments/nomis/locals_production.tf
@@ -24,7 +24,7 @@ locals {
       }
       sns_topics = {
         pagerduty_integrations = {
-          pagerduty                   = "nomis-production"
+          pagerduty = "nomis-production"
         }
       }
     }
diff --git a/terraform/environments/nomis/locals_test.tf b/terraform/environments/nomis/locals_test.tf
index 6c08fd5d145..d51f604ea1b 100644
--- a/terraform/environments/nomis/locals_test.tf
+++ b/terraform/environments/nomis/locals_test.tf
@@ -10,7 +10,7 @@ locals {
       enable_observability_platform_monitoring = true
       sns_topics = {
         pagerduty_integrations = {
-          pagerduty                   = "nomis-test"
+          pagerduty = "nomis-test"
         }
       }
     }
diff --git a/terraform/environments/oasys-national-reporting/locals_preproduction.tf b/terraform/environments/oasys-national-reporting/locals_preproduction.tf
index 9dd13fed9be..c1992a1af28 100644
--- a/terraform/environments/oasys-national-reporting/locals_preproduction.tf
+++ b/terraform/environments/oasys-national-reporting/locals_preproduction.tf
@@ -2,7 +2,7 @@ locals {
 
   baseline_presets_preproduction = {
     options = {
-      cloudwatch_metric_alarms_default_actions   = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "oasys-national-reporting-production"
diff --git a/terraform/environments/oasys-national-reporting/locals_production.tf b/terraform/environments/oasys-national-reporting/locals_production.tf
index 9461c00034a..a0e5853143c 100644
--- a/terraform/environments/oasys-national-reporting/locals_production.tf
+++ b/terraform/environments/oasys-national-reporting/locals_production.tf
@@ -2,7 +2,7 @@ locals {
 
   baseline_presets_production = {
     options = {
-      cloudwatch_metric_alarms_default_actions   = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "oasys-national-reporting-production"
diff --git a/terraform/environments/oasys-national-reporting/locals_test.tf b/terraform/environments/oasys-national-reporting/locals_test.tf
index 391d6769a02..772ec35fcb3 100644
--- a/terraform/environments/oasys-national-reporting/locals_test.tf
+++ b/terraform/environments/oasys-national-reporting/locals_test.tf
@@ -2,7 +2,7 @@ locals {
 
   baseline_presets_test = {
     options = {
-      cloudwatch_metric_alarms_default_actions   = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "oasys-national-reporting-test"
diff --git a/terraform/environments/oasys/locals_preproduction.tf b/terraform/environments/oasys/locals_preproduction.tf
index 3d0ac57a3e0..40b34beb85d 100644
--- a/terraform/environments/oasys/locals_preproduction.tf
+++ b/terraform/environments/oasys/locals_preproduction.tf
@@ -3,7 +3,7 @@ locals {
   baseline_presets_preproduction = {
     options = {
 
-      cloudwatch_metric_alarms_default_actions    = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       sns_topics = {
         pagerduty_integrations = {
           pagerduty = "oasys-preproduction"
diff --git a/terraform/environments/oasys/locals_production.tf b/terraform/environments/oasys/locals_production.tf
index c7d8643f4a2..b9d1375410d 100644
--- a/terraform/environments/oasys/locals_production.tf
+++ b/terraform/environments/oasys/locals_production.tf
@@ -4,13 +4,13 @@ locals {
 
   baseline_presets_production = {
     options = {
-      cloudwatch_log_groups_retention_in_days = 90
-      cloudwatch_metric_alarms_default_actions    = ["pagerduty"]
-      db_backup_lifecycle_rule                = "rman_backup_one_month"
+      cloudwatch_log_groups_retention_in_days  = 90
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
+      db_backup_lifecycle_rule                 = "rman_backup_one_month"
 
       sns_topics = {
         pagerduty_integrations = {
-          pagerduty               = "oasys-production"
+          pagerduty = "oasys-production"
         }
       }
     }
diff --git a/terraform/environments/oasys/locals_test.tf b/terraform/environments/oasys/locals_test.tf
index 730f9aa9213..c60e285a9fc 100644
--- a/terraform/environments/oasys/locals_test.tf
+++ b/terraform/environments/oasys/locals_test.tf
@@ -3,7 +3,7 @@ locals {
   baseline_presets_test = {
     options = {
 
-      cloudwatch_metric_alarms_default_actions    = ["pagerduty"]
+      cloudwatch_metric_alarms_default_actions = ["pagerduty"]
       enable_observability_platform_monitoring = true
       sns_topics = {
         pagerduty_integrations = {
diff --git a/terraform/environments/tribunals/dns-delegate-route53.tf b/terraform/environments/tribunals/dns-delegate-route53.tf
index 8a44f6ebc45..44cc34da231 100644
--- a/terraform/environments/tribunals/dns-delegate-route53.tf
+++ b/terraform/environments/tribunals/dns-delegate-route53.tf
@@ -52,35 +52,35 @@ locals {
 
 # 'A' records for sftp services currently routed to the existing EC2 Tribunals instance in DSD account via static ip address
 resource "aws_route53_record" "ec2_instances" {
-  count = local.is-production ? length(local.ec2_records) : 0
+  count    = local.is-production ? length(local.ec2_records) : 0
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = local.ec2_records[count.index]
-  type    = "A"
-  ttl     = 300
-  records = ["34.243.192.28"]
+  zone_id  = local.production_zone_id
+  name     = local.ec2_records[count.index]
+  type     = "A"
+  ttl      = 300
+  records  = ["34.243.192.28"]
 }
 
 # 'CNAME' records for all www legacy services which currently route through Azure Front Door
 resource "aws_route53_record" "afd_instances" {
-  count = local.is-production ? length(local.afd_records) : 0
+  count    = local.is-production ? length(local.afd_records) : 0
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = local.afd_records[count.index]
-  type    = "CNAME"
-  ttl     = 300
-  records = ["sdshmcts-prod-egd0dscwgwh0bpdq.z01.azurefd.net"]
+  zone_id  = local.production_zone_id
+  name     = local.afd_records[count.index]
+  type     = "CNAME"
+  ttl      = 300
+  records  = ["sdshmcts-prod-egd0dscwgwh0bpdq.z01.azurefd.net"]
 }
 
 # 'A' records for tribunals URLs routed through the NGINX reverse proxy hosted in AWS DSD Account
 # This includes the empty name for the root domain
 # The target ALB is in eu-west-1 zone which has a fixed zone id of "Z32O12XQLNTSW2"
 resource "aws_route53_record" "nginx_instances" {
-  count = local.is-production ? length(local.nginx_records) : 0
+  count    = local.is-production ? length(local.nginx_records) : 0
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = local.nginx_records[count.index]
-  type    = "A"
+  zone_id  = local.production_zone_id
+  name     = local.nginx_records[count.index]
+  type     = "A"
 
   alias {
     name                   = "tribunals-nginx-1184258455.eu-west-1.elb.amazonaws.com."
@@ -91,14 +91,14 @@ resource "aws_route53_record" "nginx_instances" {
 
 # 'A' records for tribunals www. URLs redirects to existing entries - subtract the "www."
 resource "aws_route53_record" "www_instances" {
-  count = local.is-production ? length(local.www_records) : 0
+  count    = local.is-production ? length(local.www_records) : 0
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = local.www_records[count.index]
-  type    = "A"
+  zone_id  = local.production_zone_id
+  name     = local.www_records[count.index]
+  type     = "A"
 
   alias {
-    name                   = format("%s.tribunals.gov.uk",substr(local.www_records[count.index], 4, -1))
+    name                   = format("%s.tribunals.gov.uk", substr(local.www_records[count.index], 4, -1))
     zone_id                = local.production_zone_id
     evaluate_target_health = false
   }
@@ -107,9 +107,9 @@ resource "aws_route53_record" "www_instances" {
 #  The root www resource record needs its own resource to avoid breaking the logic of using the substring in www_instances
 resource "aws_route53_record" "www_root" {
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = "www"
-  type    = "A"
+  zone_id  = local.production_zone_id
+  name     = "www"
+  type     = "A"
 
   alias {
     name                   = "tribunals.gov.uk"
@@ -120,11 +120,11 @@ resource "aws_route53_record" "www_root" {
 
 # TXT validation record
 resource "aws_route53_record" "txt_instance" {
-  count = local.is-production ? 1 : 0
+  count    = local.is-production ? 1 : 0
   provider = aws.core-network-services
-  zone_id = local.production_zone_id
-  name    = "_asvdns-5429b53c-d07b-4d04-83ea-9df3ff2bcdc0.tribunals.gov.uk"
-  type    = "TXT"
-  ttl     = 300
-  records = ["asvdns_7665450b-1d2a-41de-a8b7-c7a89c63c6b5"]
+  zone_id  = local.production_zone_id
+  name     = "_asvdns-5429b53c-d07b-4d04-83ea-9df3ff2bcdc0.tribunals.gov.uk"
+  type     = "TXT"
+  ttl      = 300
+  records  = ["asvdns_7665450b-1d2a-41de-a8b7-c7a89c63c6b5"]
 }
\ No newline at end of file