diff --git a/1_private_network/ecr.tf b/1_private_network/ecr.tf
deleted file mode 100644
index 935156d..0000000
--- a/1_private_network/ecr.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-resource "aws_ecr_repository" "ocp4" {
-  count = var.airgapped ? 1 : 0
-  name                 = local.infrastructure_id
-  image_tag_mutability = "MUTABLE"
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-}
diff --git a/1_private_network/output.tf b/1_private_network/output.tf
deleted file mode 100644
index 9c9cbdc..0000000
--- a/1_private_network/output.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "private_vpc_id" {
-    value =  aws_vpc.ocp_vpc.id
-}
-
-output "private_vpc_private_subnet_ids" {
-    value =  aws_subnet.ocp_pri_subnet.*.id
-}
-
-#output "private_vpc_public_subnet_ids" {
-#    value =  aws_subnet.ocp_pub_subnet.*.id
-#}
-
-output "private_ecr_repository_url" {
-    value = var.airgapped ? aws_ecr_repository.ocp4.0.name : ""
-}
diff --git a/1_private_network/provider.tf b/1_private_network/provider.tf
deleted file mode 100644
index cbb295b..0000000
--- a/1_private_network/provider.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/1_private_network/security_group.tf b/1_private_network/security_group.tf
deleted file mode 100644
index 4596ba6..0000000
--- a/1_private_network/security_group.tf
+++ /dev/null
@@ -1,77 +0,0 @@
-resource "aws_security_group" "private_ec2_api" {
-  name =  "${local.infrastructure_id}-ec2-api"
-  vpc_id =  aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-private-ec2-api",
-    )
-  )
-}
-
-# allow anybody in the VPC to talk to ec2 through the private endpoint
-resource "aws_security_group_rule" "private_ec2_ingress" {
-  type        = "ingress"
-
-  from_port   = 0
-  to_port     = 65535
-  protocol    = "tcp"
-  cidr_blocks = [
-     var.vpc_cidr
-  ]
-
-  security_group_id =  aws_security_group.private_ec2_api.id
-}
-
-resource "aws_security_group_rule" "private_ec2_api_egress" {
-  type        = "egress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "all"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.private_ec2_api.id
-}
-
-resource "aws_security_group" "private_ecr_api" {
-  name =  "${local.infrastructure_id}-ecr-api"
-  vpc_id =  aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-private-ecr-api",
-    )
-  )
-}
-
-# allow anybody in the VPC to talk to ecr through the private endpoint
-resource "aws_security_group_rule" "private_ecr_ingress" {
-  type        = "ingress"
-
-  from_port   = 0
-  to_port     = 65535
-  protocol    = "tcp"
-  cidr_blocks = [
-     var.vpc_cidr
-  ]
-
-  security_group_id =  aws_security_group.private_ecr_api.id
-}
-
-resource "aws_security_group_rule" "private_ecr_api_egress" {
-  type        = "egress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "all"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.private_ecr_api.id
-}
diff --git a/1_private_network/subnet.tf b/1_private_network/subnet.tf
deleted file mode 100644
index 996776b..0000000
--- a/1_private_network/subnet.tf
+++ /dev/null
@@ -1,238 +0,0 @@
-# Create private subnet in each AZ for the dmz
-resource "aws_subnet" "ocp_pri_subnet" {
-  count                   =  length(var.aws_azs)
-
-  vpc_id                  =  aws_vpc.ocp_vpc.id
-  cidr_block              =  element(var.vpc_private_subnet_cidrs, count.index)
-  availability_zone       =  format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index))
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-%s-pri", format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index))),
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-    )
-  )
-}
-
-resource "aws_route_table" "ocp_pri_net_route_table" {
-  count =  length(var.aws_azs)
-
-  vpc_id =  aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-rtbl-%s-pri", format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index))),
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared")
-  )
-}
-
-resource "aws_route_table_association" "ocp_pri_net_route_table_assoc" {
-  count          =  length(var.aws_azs)
-
-  subnet_id      = element(aws_subnet.ocp_pri_subnet.*.id, count.index)
-  route_table_id = element(aws_route_table.ocp_pri_net_route_table.*.id, count.index)
-}
-
-# private S3 endpoint
-data "aws_vpc_endpoint_service" "s3" {
-  service = "s3"
-}
-
-resource "aws_vpc_endpoint" "private_s3" {
-  vpc_id       =  aws_vpc.ocp_vpc.id
-  service_name =  data.aws_vpc_endpoint_service.s3.service_name
-
-  policy = <<EOF
-{
-  "Version": "2008-10-17",
-  "Statement": [
-    {
-      "Principal": "*",
-      "Action": "*",
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pri-s3-vpce"),
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared")
-  )
-
-}
-
-resource "aws_vpc_endpoint_route_table_association" "private_s3" {
-  count =  length(var.aws_azs)
-
-  vpc_endpoint_id = aws_vpc_endpoint.private_s3.id
-  route_table_id  = element(aws_route_table.ocp_pri_net_route_table.*.id, count.index)
-}
-
-## private ec2 endpoint
-data "aws_vpc_endpoint_service" "ec2" {
-  service = "ec2"
-}
-
-resource "aws_vpc_endpoint" "private_ec2" {
-  vpc_id       =  aws_vpc.ocp_vpc.id
-  service_name =  data.aws_vpc_endpoint_service.ec2.service_name
-  vpc_endpoint_type = "Interface"
-
-  private_dns_enabled = true
-
-  security_group_ids = [
-     aws_security_group.private_ec2_api.id
-  ]
-
-  subnet_ids =  aws_subnet.ocp_pri_subnet.*.id
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-ec2-vpce"
-    )
-  )
-
-}
-
-## private ecr endpoint
-data "aws_vpc_endpoint_service" "ecr" {
-  service = "ecr.dkr"
-}
-
-resource "aws_vpc_endpoint" "private_ecr" {
-  count = var.airgapped ? 1 : 0
-
-  vpc_id       =  aws_vpc.ocp_vpc.id
-  service_name =  data.aws_vpc_endpoint_service.ecr.service_name
-  vpc_endpoint_type = "Interface"
-
-  private_dns_enabled = true
-
-  security_group_ids = [
-     aws_security_group.private_ecr_api.id
-  ]
-
-  subnet_ids =  aws_subnet.ocp_pri_subnet.*.id
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-ecr-vpce"
-    )
-  )
-
-}
-
-
-#### The following must be mod for airgapped - temporary enable public resources for debugging
-
-resource "aws_subnet" "ocp_pub_subnet" {
-  count                   =  length(var.aws_azs)
-  # count                   =  var.airgapped ? 0 : length(var.aws_azs)
-
-  vpc_id                  =  aws_vpc.ocp_vpc.id
-  cidr_block              =  element(var.vpc_public_subnet_cidrs, count.index)
-  availability_zone       =  format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index))
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-%s-pub", format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index))),
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared",
-      "kubernetes.io/role/elb", "1",
-      "KubernetesCluster",  local.infrastructure_id
-    )
-  )
-}
-
-resource "aws_internet_gateway" "ocp_igw" {
-  count  = 1
-  # count  = var.airgapped ? 0 : 1
-  vpc_id =  aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-pub-igw"
-    )
-  )
-}
-
-resource "aws_route" "ocp_pub_net_route" {
-  count =  length(var.aws_azs)
-  # count =  var.airgapped ? 0 : length(var.aws_azs)
-
-  route_table_id = element(aws_route_table.ocp_pub_net_route_table.*.id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
-  gateway_id =  aws_internet_gateway.ocp_igw.0.id
-}
-
-resource "aws_route_table" "ocp_pub_net_route_table" {
-  count          =  length(var.aws_azs)
-  # count          =  var.airgapped ? 0 : length(var.aws_azs)
-
-  vpc_id =  aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-rtbl-%s-pub", format("%s%s", element(list(var.aws_region), count.index), element(var.aws_azs, count.index)))
-    )
-  )
-
-}
-
-resource "aws_route_table_association" "ocp_pub_net_route_table_assoc" {
-  count          =  length(var.aws_azs)
-  # count          =  var.airgapped ? 0 : length(var.aws_azs)
-
-  subnet_id      = element(aws_subnet.ocp_pub_subnet.*.id, count.index)
-  route_table_id = element(aws_route_table.ocp_pub_net_route_table.*.id, count.index)
-}
-
-# Create Elastic IP for NAT gateway in each AZ
-resource "aws_eip" "ocp_ngw_eip" {
-  count =  var.airgapped ? 0 : length(var.aws_azs)
-  vpc   = "true"
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-ngw-eip-%1d", count.index + 1)
-    )
-  )
-}
-
-# Create NAT gateways for the private networks in each AZ
-resource "aws_nat_gateway" "ocp_ngw" {
-  count                   =  var.airgapped ? 0 : length(var.aws_azs)
-
-  depends_on = [
-    aws_internet_gateway.ocp_igw
-  ]
-
-  allocation_id           = element(aws_eip.ocp_ngw_eip.*.id, count.index)
-  subnet_id               = element(aws_subnet.ocp_pub_subnet.*.id, count.index)
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name", format("${local.infrastructure_id}-pub-ngw-%1d", count.index + 1)
-    )
-  )
-}
-
-resource "aws_route" "ocp_pri_net_route_ngw" {
-  count =  var.airgapped ? 0 : length(var.aws_azs)
-
-  route_table_id = element(aws_route_table.ocp_pri_net_route_table.*.id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
-
-  # TODO if no nat gateway exists, you may use a transit gateway or peering connection here
-  nat_gateway_id = element(aws_nat_gateway.ocp_ngw.*.id, count.index)
-}
diff --git a/1_private_network/variables.tf b/1_private_network/variables.tf
deleted file mode 100644
index 3662221..0000000
--- a/1_private_network/variables.tf
+++ /dev/null
@@ -1,40 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "aws_azs" {
-  type  = list(string)
-  description = "The availability zone letter appendix you want to deploy to in the selected region "
-  default = ["a", "b", "c"]
-}
-
-variable "default_tags" {
-  default = {}
-}
-
-variable "infrastructure_id" {
-  default = ""
-}
-
-
-variable "clustername" { default = "ocp4" }
-variable "vpc_cidr" { default = "10.10.0.0/16" }
-
-# Subnet Details
-variable "vpc_private_subnet_cidrs" {
-  description = "List of subnet CIDRs"
-  type        = list(string)
-  default     = ["10.10.10.0/24", "10.10.11.0/24", "10.10.12.0/24" ]
-}
-
-variable "vpc_public_subnet_cidrs" {
-  description = "List of subnet CIDRs"
-  type        = list(string)
-  default     = ["10.10.20.0/24", "10.10.21.0/24", "10.10.22.0/24" ]
-}
-
-variable "airgapped" {
-  default = false
-}
diff --git a/1_private_network/vpc.tf b/1_private_network/vpc.tf
deleted file mode 100644
index 0d95bb8..0000000
--- a/1_private_network/vpc.tf
+++ /dev/null
@@ -1,15 +0,0 @@
-# create a vpc
-resource "aws_vpc" "ocp_vpc" {
-  cidr_block =   var.vpc_cidr
-
-  enable_dns_support = true
-  enable_dns_hostnames = true
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-pri",
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-    )
-  )
-}
diff --git a/2_load_balancer/elb.tf b/2_load_balancer/elb.tf
deleted file mode 100644
index 8e8ef3c..0000000
--- a/2_load_balancer/elb.tf
+++ /dev/null
@@ -1,67 +0,0 @@
-resource "aws_lb" "ocp_control_plane_int" {
-  name =  "${local.infrastructure_id}-int"
-
-  load_balancer_type = "network"
-  internal = "true"
-  subnets =  data.aws_subnet.ocp_pri_subnet.*.id
-
-  tags =  var.default_tags
-}
-
-resource "aws_lb_listener" "ocp_control_plane_int_6443" {
-  load_balancer_arn =  aws_lb.ocp_control_plane_int.arn
-
-  port = "6443"
-  protocol = "TCP"
-
-  default_action {
-    target_group_arn =  aws_lb_target_group.ocp_control_plane_int_6443.arn
-    type = "forward"
-  }
-}
-
-resource "aws_lb_listener" "ocp_control_plane_int_22623" {
-  load_balancer_arn =  aws_lb.ocp_control_plane_int.arn
-
-  port = "22623"
-  protocol = "TCP"
-
-  default_action {
-    target_group_arn =  aws_lb_target_group.ocp_control_plane_int_22623.arn
-    type = "forward"
-  }
-}
-
-resource "aws_lb_target_group" "ocp_control_plane_int_6443" {
-  name =  "${local.infrastructure_id}-6443-int-tg"
-  port = 6443
-  protocol = "TCP"
-  tags =  var.default_tags
-  target_type = "ip"
-  vpc_id =  data.aws_vpc.ocp_vpc.id
-  deregistration_delay = 60
-}
-
-resource "aws_lb_target_group" "ocp_control_plane_int_22623" {
-  name =  "${local.infrastructure_id}-22623-int-tg"
-  port = 22623
-  protocol = "TCP"
-  tags =  var.default_tags
-  target_type = "ip"
-  vpc_id =  data.aws_vpc.ocp_vpc.id
-  deregistration_delay = 60
-}
-
-
-resource "aws_vpc_endpoint_service" "ocp_control_plane" {
-  acceptance_required = false
-  network_load_balancer_arns = [aws_lb.ocp_control_plane_int.arn]
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-control-plane-vpce"
-    )
-  )
-
-}
diff --git a/2_load_balancer/output.tf b/2_load_balancer/output.tf
deleted file mode 100644
index 66eb3ef..0000000
--- a/2_load_balancer/output.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-output "private_vpc_id" {
-    value =  data.aws_vpc.ocp_vpc.id
-}
-
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "ocp_control_plane_lb_int_arn" {
-    value =  aws_lb.ocp_control_plane_int.arn
-}
-
-output "ocp_control_plane_lb_int_6443_tg_arn" {
-    value =  aws_lb_target_group.ocp_control_plane_int_6443.arn
-}
-
-output "ocp_control_plane_lb_int_22623_tg_arn" {
-    value =  aws_lb_target_group.ocp_control_plane_int_22623.arn
-}
diff --git a/2_load_balancer/provider.tf b/2_load_balancer/provider.tf
deleted file mode 100644
index cbb295b..0000000
--- a/2_load_balancer/provider.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/2_load_balancer/variables.tf b/2_load_balancer/variables.tf
deleted file mode 100644
index 1ea3fe5..0000000
--- a/2_load_balancer/variables.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-variable "infrastructure_id" { default = "" }
-
-variable "clustername" { default = "ocp4" }
-
-variable "private_vpc_id" {}
-
-# Subnet Details
-variable "private_vpc_private_subnet_ids" {
-  description = "List of subnet ids"
-  type        = list(string)
-}
diff --git a/2_load_balancer/vpc.tf b/2_load_balancer/vpc.tf
deleted file mode 100644
index 7c30dab..0000000
--- a/2_load_balancer/vpc.tf
+++ /dev/null
@@ -1,13 +0,0 @@
-data "aws_vpc" "ocp_vpc" {
-  id =  var.private_vpc_id
-}
-
-# Create private subnet in each AZ for the worker nodes to reside in
-data "aws_subnet" "ocp_pri_subnet" {
-  count       =  length(var.private_vpc_private_subnet_ids)
-  id          = "${element(var.private_vpc_private_subnet_ids, count.index)}"
-}
-
-
-
-
diff --git a/3_dns/output.tf b/3_dns/output.tf
deleted file mode 100644
index 265c97e..0000000
--- a/3_dns/output.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-output "ocp_route53_private_zone_id" {
-    value =  aws_route53_zone.ocp_private.zone_id
-}
-
-output "private_vpc_id" {
-    value =  data.aws_vpc.ocp_vpc.id
-}
-
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "ocp_control_plane_lb_int_arn" {
-    value =  data.aws_lb.ocp_control_plane_int.arn
-}
diff --git a/3_dns/provider.tf b/3_dns/provider.tf
deleted file mode 100644
index cbb295b..0000000
--- a/3_dns/provider.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/3_dns/route53.tf b/3_dns/route53.tf
deleted file mode 100644
index 93e8a6e..0000000
--- a/3_dns/route53.tf
+++ /dev/null
@@ -1,39 +0,0 @@
-resource "aws_route53_zone" "ocp_private" {
-  name =  "${var.clustername}.${var.domain}"
-  vpc {
-    vpc_id =  data.aws_vpc.ocp_vpc.id
-  }
-  force_destroy = "true"
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${var.clustername}.${var.domain}.",
-      "kubernetes.io/cluster/${local.infrastructure_id}", "owned"
-    )
-  )
-}
-
-resource "aws_route53_record" "master_api_int" {
-  name      = "api-int.${var.clustername}.${var.domain}"
-  type      = "A"
-  zone_id   =  aws_route53_zone.ocp_private.zone_id
-
-  alias {
-    name                    =  data.aws_lb.ocp_control_plane_int.dns_name
-    zone_id                 =  data.aws_lb.ocp_control_plane_int.zone_id
-    evaluate_target_health  = true
-  }
-}
-
-resource "aws_route53_record" "master_api" {
-  name      = "api.${var.clustername}.${var.domain}"
-  type      = "A"
-  zone_id   =  aws_route53_zone.ocp_private.zone_id
-
-  alias {
-    name                    =  data.aws_lb.ocp_control_plane_int.dns_name
-    zone_id                 =  data.aws_lb.ocp_control_plane_int.zone_id
-    evaluate_target_health  = true
-  }
-}
diff --git a/3_dns/variables.tf b/3_dns/variables.tf
deleted file mode 100644
index 3640b6b..0000000
--- a/3_dns/variables.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-variable "infrastructure_id" { default = "" }
-
-variable "private_vpc_id" {}
-
-variable "ocp_control_plane_lb_int_arn" {}
-
-variable "clustername" { default = "ocp4" }
-
-variable "domain" {}
diff --git a/3_dns/vpc.tf b/3_dns/vpc.tf
deleted file mode 100644
index 44d17a5..0000000
--- a/3_dns/vpc.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-data "aws_vpc" "ocp_vpc" {
-  id =  var.private_vpc_id
-}
-
-
-data "aws_lb" "ocp_control_plane_int" {
-  arn =  var.ocp_control_plane_lb_int_arn
-}
diff --git a/4_security_group/output.tf b/4_security_group/output.tf
deleted file mode 100644
index dbede3b..0000000
--- a/4_security_group/output.tf
+++ /dev/null
@@ -1,15 +0,0 @@
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "ocp_control_plane_security_group_id" {
-    value =  aws_security_group.master.id
-}
-
-output "ocp_worker_security_group_id" {
-    value =  aws_security_group.worker.id
-}
diff --git a/4_security_group/provider.tf b/4_security_group/provider.tf
deleted file mode 100644
index cbb295b..0000000
--- a/4_security_group/provider.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/4_security_group/security_group.tf b/4_security_group/security_group.tf
deleted file mode 100644
index 31b3340..0000000
--- a/4_security_group/security_group.tf
+++ /dev/null
@@ -1,348 +0,0 @@
-
-
-resource "aws_security_group" "master" {
-  name =  "${local.infrastructure_id}-master"
-  vpc_id =  data.aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-master",
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-    )
-  )
-}
-
-resource "aws_security_group_rule" "master_icmp" {
-  type        = "ingress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "icmp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_ssh" {
-  type        = "ingress"
-
-  from_port   = 22
-  to_port     = 22
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_6443" {
-  type        = "ingress"
-
-  from_port   = 6443
-  to_port     = 6443
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_22623" {
-  type        = "ingress"
-
-  from_port   = 22623
-  to_port     = 22623
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_etcd" {
-  type        = "ingress"
-
-  from_port   = 2379
-  to_port     = 2380
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_master_vxlan" {
-  type        = "ingress"
-
-  from_port   = 4789
-  to_port     = 4789
-  protocol    = "udp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_worker_vxlan" {
-  type        = "ingress"
-
-  from_port   = 4789
-  to_port     = 4789
-  protocol    = "udp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_master_internal" {
-  type        = "ingress"
-
-  from_port   = 9000
-  to_port     = 9999
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_worker_internal" {
-  type        = "ingress"
-
-  from_port   = 9000
-  to_port     = 9999
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_master_kube" {
-  type        = "ingress"
-
-  from_port   = 10250
-  to_port     = 10259
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_worker_kube" {
-  type        = "ingress"
-
-  from_port   = 10250
-  to_port     = 10259
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.master.id
-}
-
-# TODO i don't like this
-resource "aws_security_group_rule" "master_master_nodeport" {
-  type        = "ingress"
-
-  from_port   = 30000
-  to_port     = 32767
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.master.id
-}
-
-# TODO i don't like this
-resource "aws_security_group_rule" "master_worker_nodeport" {
-  type        = "ingress"
-
-  from_port   = 30000
-  to_port     = 32767
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group_rule" "master_egress" {
-  type        = "egress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "all"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.master.id
-}
-
-resource "aws_security_group" "worker" {
-  name =  "${local.infrastructure_id}-worker"
-  vpc_id =  data.aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-worker",
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-    )
-  )
-}
-
-resource "aws_security_group_rule" "worker_icmp" {
-  type        = "ingress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "icmp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_443" {
-  type        = "ingress"
-
-  from_port     = 443
-  to_port     = 443
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_80" {
-  type        = "ingress"
-
-  from_port     = 80
-  to_port     = 80
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_ssh" {
-  type        = "ingress"
-
-  from_port   = 22
-  to_port     = 22
-  protocol    = "tcp"
-  cidr_blocks = [
-     data.aws_vpc.ocp_vpc.cidr_block
-  ]
-
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_master_vxlan" {
-  type        = "ingress"
-
-  from_port   = 4789
-  to_port     = 4789
-  protocol    = "udp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_worker_vxlan" {
-  type        = "ingress"
-
-  from_port   = 4789
-  to_port     = 4789
-  protocol    = "udp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_master_internal" {
-  type        = "ingress"
-
-  from_port   = 9000
-  to_port     = 9999
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_worker_internal" {
-  type        = "ingress"
-
-  from_port   = 9000
-  to_port     = 9999
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_worker_kube" {
-  type        = "ingress"
-
-  from_port   = 10250
-  to_port     = 10250
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_master_kube" {
-  type        = "ingress"
-
-  from_port   = 10250
-  to_port     = 10250
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-# TODO i don't like this
-resource "aws_security_group_rule" "worker_worker_nodeport" {
-  type        = "ingress"
-
-  from_port   = 30000
-  to_port     = 32767
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.worker.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-# TODO i don't like this
-resource "aws_security_group_rule" "worker_master_nodeport" {
-  type        = "ingress"
-
-  from_port   = 30000
-  to_port     = 32767
-  protocol    = "tcp"
-
-  source_security_group_id =  aws_security_group.master.id
-  security_group_id =  aws_security_group.worker.id
-}
-
-resource "aws_security_group_rule" "worker_egress" {
-  type        = "egress"
-
-  from_port   = 0
-  to_port     = 0
-  protocol    = "all"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.worker.id
-}
diff --git a/4_security_group/variables.tf b/4_security_group/variables.tf
deleted file mode 100644
index 071acde..0000000
--- a/4_security_group/variables.tf
+++ /dev/null
@@ -1,17 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-variable "clustername" { default = "ocp4" }
-
-# Subnet Details
-variable "infrastructure_id" { default = "" }
-
-variable "private_vpc_id" { }
-
diff --git a/4_security_group/vpc.tf b/4_security_group/vpc.tf
deleted file mode 100644
index 89252e2..0000000
--- a/4_security_group/vpc.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-data "aws_vpc" "ocp_vpc" {
-  id =  var.private_vpc_id
-}
diff --git a/5_iam/iam.tf b/5_iam/iam.tf
deleted file mode 100644
index 2c20781..0000000
--- a/5_iam/iam.tf
+++ /dev/null
@@ -1,95 +0,0 @@
-resource "aws_iam_role" "ocp_ec2_master_role" {
-  name =  "${local.infrastructure_id}-master-role"
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-# machine api and volume provisioning requires ec2*, load balancer service requires elb*,
-# machine api requires iam passrole*, registry and bootstrap requires s3*
-resource "aws_iam_role_policy" "ocp_ec2_master_role_policy" {
-  name =  "${local.infrastructure_id}-master-role-policy"
-  role =  aws_iam_role.ocp_ec2_master_role.id
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:*",
-        "elasticloadbalancing:*",
-        "iam:PassRole",
-        "s3:GetObject"
-      ],
-      "Resource": [
-        "*"
-      ]
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_instance_profile" "ocp_ec2_master_instance_profile" {
-  name =  "${local.infrastructure_id}-master-profile"
-  role =  aws_iam_role.ocp_ec2_master_role.name
-}
-
-resource "aws_iam_role" "ocp_ec2_worker_role" {
-  name =  "${local.infrastructure_id}-worker-role"
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "ocp_ec2_worker_role_policy" {
-  name =  "${local.infrastructure_id}-worker-role-policy"
-  role =  aws_iam_role.ocp_ec2_worker_role.id
-  policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ec2:Describe*"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-EOF
-}
-
-
-resource "aws_iam_instance_profile" "ocp_ec2_worker_instance_profile" {
-  name =  "${local.infrastructure_id}-worker-profile"
-  role =  aws_iam_role.ocp_ec2_worker_role.name
-}
diff --git a/5_iam/output.tf b/5_iam/output.tf
deleted file mode 100644
index f425dbe..0000000
--- a/5_iam/output.tf
+++ /dev/null
@@ -1,15 +0,0 @@
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "ocp_master_instance_profile_id" {
-    value =  aws_iam_instance_profile.ocp_ec2_master_instance_profile.id
-}
-
-output "ocp_worker_instance_profile_id" {
-    value =  aws_iam_instance_profile.ocp_ec2_worker_instance_profile.id
-}
diff --git a/5_iam/provider.tf b/5_iam/provider.tf
deleted file mode 100644
index cbb295b..0000000
--- a/5_iam/provider.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/5_iam/variables.tf b/5_iam/variables.tf
deleted file mode 100644
index 44f1b8f..0000000
--- a/5_iam/variables.tf
+++ /dev/null
@@ -1,13 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-variable "infrastructure_id" { default = "" }
-
-variable "clustername" { default = "ocp4" }
diff --git a/6_bootstrap/bootstrap.tf b/6_bootstrap/bootstrap.tf
deleted file mode 100644
index ea0ef9f..0000000
--- a/6_bootstrap/bootstrap.tf
+++ /dev/null
@@ -1,32 +0,0 @@
-data "ignition_config" "bootstrap_ign" {
-  replace {
-    source = "s3://${aws_s3_bucket.ocp_ignition.id}/bootstrap.ign"
-  }
-}
-
-resource "aws_instance" "bootstrap" {
-  depends_on = [
-    null_resource.generate_ignition_config,
-    aws_s3_bucket_object.bootstrap_ign
-  ]
-
-  ami           =  data.aws_ami.rhcos.id
-  instance_type =  lookup(var.bootstrap, "type", "i3.xlarge")
-  subnet_id     =  data.aws_subnet.ocp_pri_subnet.0.id
-  iam_instance_profile =  aws_iam_instance_profile.ocp_ec2_bootstrap_instance_profile.name
-
-  vpc_security_group_ids =  concat(
-    aws_security_group.bootstrap.*.id,
-    list(data.aws_security_group.master.id)
-  )
-
-  availability_zone = element(data.aws_availability_zone.aws_azs.*.name, 0)
-
-  tags =  merge(
-      var.default_tags,
-      map("Name",  format("${local.infrastructure_id}-bootstrap") )
-  )
-  user_data = <<EOF
-${data.ignition_config.bootstrap_ign.rendered}
-EOF
-}
diff --git a/6_bootstrap/elb.tf b/6_bootstrap/elb.tf
deleted file mode 100644
index b47190a..0000000
--- a/6_bootstrap/elb.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-data "aws_lb_target_group" "ocp_control_plane_int_6443" {
-    arn =  var.ocp_control_plane_lb_int_6443_tg_arn
-}
-
-data "aws_lb_target_group" "ocp_control_plane_int_22623" {
-    arn =  var.ocp_control_plane_lb_int_22623_tg_arn
-}
-
-data "aws_lb" "ocp_control_plane_int" {
-    arn =  var.ocp_control_plane_lb_int_arn
-}
-
-resource "aws_lb_target_group_attachment" "ocp_bootstrap_control_plane_int_6443" {
-  target_group_arn =  data.aws_lb_target_group.ocp_control_plane_int_6443.arn
-  target_id =  aws_instance.bootstrap.private_ip
-}
-
-resource "aws_lb_target_group_attachment" "ocp_bootstrap_control_plane_int_22623" {
-  target_group_arn =  data.aws_lb_target_group.ocp_control_plane_int_22623.arn
-  target_id =  aws_instance.bootstrap.private_ip
-}
diff --git a/6_bootstrap/iam.tf b/6_bootstrap/iam.tf
deleted file mode 100644
index 010775f..0000000
--- a/6_bootstrap/iam.tf
+++ /dev/null
@@ -1,56 +0,0 @@
-resource "aws_iam_role" "ocp_ec2_bootstrap_role" {
-   name =  "${local.infrastructure_id}-bootstrap-role"
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "ocp_ec2_bootstrap_role_policy" {
-  name =  "${local.infrastructure_id}-bootstrap-role-policy"
-  role =  aws_iam_role.ocp_ec2_bootstrap_role.id
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:Describe*",
-        "ec2:AttachVolume",
-        "ec2:DetachVolume",
-        "s3:GetObject"
-      ],
-      "Resource": [
-        "*"
-      ]
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_instance_profile" "ocp_ec2_bootstrap_instance_profile" {
-  name =  "${local.infrastructure_id}-bootstrap-profile"
-  role =  aws_iam_role.ocp_ec2_bootstrap_role.name
-}
-
-data "aws_iam_instance_profile" "ocp_ec2_master_instance_profile" {
-  name =  var.ocp_master_instance_profile_id
-}
-
-data "aws_iam_instance_profile" "ocp_ec2_worker_instance_profile" {
-  name =  var.ocp_worker_instance_profile_id
-}
diff --git a/6_bootstrap/provider.tf b/6_bootstrap/provider.tf
deleted file mode 100644
index b4b05d3..0000000
--- a/6_bootstrap/provider.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-data "aws_region" "current" {}
-
-data "aws_availability_zone" "aws_azs" {
-  count =  length(var.aws_azs)
-  name = "${format("%s%s", data.aws_region.current.name, element(var.aws_azs, count.index))}"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/6_bootstrap/replicate.sh b/6_bootstrap/replicate.sh
deleted file mode 100755
index 4f59f8f..0000000
--- a/6_bootstrap/replicate.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-
-repoName=$1
-pullSecretFile=$2
-# arguments:
-# - repoName
-# - Pull secret file
-
-# requirements
-# jq
-# aws CLI
-# AWS env variable2`
-
-pullDir=$(dirname $pullSecretFile)
-email=$(cat $pullSecretFile | jq -r -M '."auths"."quay.io"'."email")
-#loginString=$(cat /tmp/dkrout.txt)
-loginString=$(aws ecr get-login)
-# regex magic loginString " -p " passworf " -e none https://" $repoHost
-password=$(echo $loginString |  awk -F"-p " '{print $2}' | awk -F" -e none" '{print $1}')
-repoHost=$(echo $loginString |  awk -F"https://" '{print $2}' )
-# regex repoHost "https://" repoURL
-authpwd=$(echo -n "AWS:$password" | base64)
-authdata="{\"$repoHost\":{\"auth\":\"$authpwd\",\"email\":\"$email\"}}"
-newSecret=$(cat $pullSecretFile | jq -r -M --argjson c $authdata '."auths" + $c')
-echo -n "{\"auths\":$newSecret}" > $pullDir/newPullSecret.json
-
-OCP_RELEASE=$(oc version --client | cut -d- -f3)
-
-echo oc adm -a newPullSecret.json release mirror --from=quay.io/openshift-release-dev/ocp-release:${OCP_RELEASE} \
-       --to=${repoHost}/${repoName} --to-release-image=${repoHost}/${repoName}:${OCP_RELEASE}
diff --git a/6_bootstrap/rhcos.tf b/6_bootstrap/rhcos.tf
deleted file mode 100644
index 156c3ec..0000000
--- a/6_bootstrap/rhcos.tf
+++ /dev/null
@@ -1,11 +0,0 @@
-data "aws_ami" "rhcos" {
-    most_recent = true
-
-    owners = ["531415883065"]
-
-    filter {
-        name = "image-id"
-        values = ["${var.ami}"]
-    }
-
-}
diff --git a/6_bootstrap/route53.tf b/6_bootstrap/route53.tf
deleted file mode 100644
index 38cb911..0000000
--- a/6_bootstrap/route53.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-data "aws_route53_zone" "ocp_private" {
-  zone_id =  var.ocp_route53_private_zone_id
-}
-
diff --git a/6_bootstrap/s3.tf b/6_bootstrap/s3.tf
deleted file mode 100644
index 5aacd22..0000000
--- a/6_bootstrap/s3.tf
+++ /dev/null
@@ -1,26 +0,0 @@
-
-resource "random_id" "bucketid" {
- byte_length = "8"
-}
-
-resource "aws_s3_bucket" "ocp_ignition" {
-  bucket        =  "${local.infrastructure_id}-infra-${random_id.bucketid.hex}"
-  acl           =  "private"
-
-  tags =  merge(
-      var.default_tags,
-      map(
-        "Name",  "${local.infrastructure_id}-infra-${random_id.bucketid.hex}"
-      )
-  )
-}
-
-resource "aws_s3_bucket_object" "bootstrap_ign" {
-  depends_on = [
-    null_resource.generate_ignition_config
-  ]
-
-  bucket =  aws_s3_bucket.ocp_ignition.id
-  key = "bootstrap.ign"
-  content =  data.local_file.bootstrap_ign.content
-}
diff --git a/6_bootstrap/security_group.tf b/6_bootstrap/security_group.tf
deleted file mode 100644
index 4bfcf4e..0000000
--- a/6_bootstrap/security_group.tf
+++ /dev/null
@@ -1,48 +0,0 @@
-data "aws_security_group" "master" {
-    id =  var.ocp_control_plane_security_group_id
-}
-
-data "aws_security_group" "worker" {
-    id =  var.ocp_worker_security_group_id
-}
-
-resource "aws_security_group" "bootstrap" {
-  name =  "${local.infrastructure_id}-bootstrap"
-  vpc_id =  data.aws_vpc.ocp_vpc.id
-
-  tags =  merge(
-    var.default_tags,
-    map(
-      "Name",  "${local.infrastructure_id}-bootstrap",
-      "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-    )
-  )
-}
-
-# TODO do we need SSH?
-resource "aws_security_group_rule" "bootstrap_ssh" {
-  type        = "ingress"
-
-  from_port   = 22
-  to_port     = 22
-  protocol    = "tcp"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.bootstrap.id
-}
-
-# TODO huh?
-resource "aws_security_group_rule" "bootstrap_19531" {
-  type        = "ingress"
-
-  from_port   = 19531
-  to_port     = 19531
-  protocol    = "tcp"
-  cidr_blocks = [
-    "0.0.0.0/0"
-  ]
-
-  security_group_id =  aws_security_group.bootstrap.id
-}
diff --git a/6_bootstrap/variables.tf b/6_bootstrap/variables.tf
deleted file mode 100644
index 69edce2..0000000
--- a/6_bootstrap/variables.tf
+++ /dev/null
@@ -1,122 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "aws_azs" {
-  type  = list(string)
-  description = "The availability zone letter appendix you want to deploy to in the selected region "
-  default = ["a", "b", "c"]
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-####### AWS Deployment Details ####################################
-# SSH Key
-variable "ami" { default = "" }
-
-variable "aws_access_key_id" {
-  default = ""
-}
-
-variable "aws_secret_access_key" {
-  default = ""
-}
-
-variable "infrastructure_id" {
-  default = ""
-}
-
-variable "clustername" { default = "ocp4" }
-
-variable "private_vpc_id" { default = "" }
-
-# Subnet Details
-variable "private_vpc_private_subnet_ids" {
-  description = "List of subnet ids"
-  type        = list(string)
-  default     = []
-}
-
-variable "domain" {
-    default = "example.com"
-}
-
-variable "cluster_network_cidr" { default = "192.168.0.0/17" }
-variable "cluster_network_host_prefix" { default = "23" }
-variable "service_network_cidr" { default = "192.168.128.0/24" }
-
-variable "bootstrap" {
-    default = {
-        type = "i3.xlarge"
-    }
-}
-variable "control_plane" {
-    default = {
-        count = "3"
-        type = "m4.xlarge"
-        disk = "120"
-    }
-}
-
-variable "worker" {
-    default = {
-        count = "3"
-        type = "m4.large"
-        disk = "120"
-    }
-}
-
-variable "openshift_pull_secret" {
-    default = "./openshift_pull_secret.json"
-}
-
-variable "use_worker_machinesets" {
-  default = true
-}
-
-variable "openshift_installer_url" {
-  default = "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest"
-}
-
-variable "ocp_control_plane_security_group_id" {
-  default = ""
-}
-
-variable "ocp_worker_security_group_id" {
-  default = ""
-}
-
-variable "ocp_master_instance_profile_id" {
-  default = ""
-}
-
-variable "ocp_worker_instance_profile_id" {
-  default = ""
-}
-
-variable "ocp_control_plane_lb_int_arn" {
-  default = ""
-}
-variable "ocp_control_plane_lb_int_22623_tg_arn" {
-  default = ""
-}
-
-variable "ocp_control_plane_lb_int_6443_tg_arn" {
-  default = ""
-}
-
-variable "ocp_route53_private_zone_id" {
-  default = ""
-}
-
-variable "airgapped" {
-    default = false
-}
-
-variable repository {
-    default = ""
-}
diff --git a/6_bootstrap/vpc.tf b/6_bootstrap/vpc.tf
deleted file mode 100644
index 47768cb..0000000
--- a/6_bootstrap/vpc.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-data "aws_vpc" "ocp_vpc" {
-  id =  var.private_vpc_id
-}
-
-data "aws_subnet" "ocp_pri_subnet" {
-  count       =  length(var.private_vpc_private_subnet_ids)
-  id          = "${element(var.private_vpc_private_subnet_ids, count.index)}"
-}
diff --git a/7_control_plane/control_plane.tf b/7_control_plane/control_plane.tf
deleted file mode 100644
index 1a7e836..0000000
--- a/7_control_plane/control_plane.tf
+++ /dev/null
@@ -1,32 +0,0 @@
-resource "aws_instance" "master" {
-  # if master nodes are already created, don't trigger a destroy/recreate if we don't
-  # have to, which are triggered on user_data changes
-  count         = lookup(var.control_plane, "count", 3)
-
-  ami           =  data.aws_ami.rhcos.id
-  instance_type = lookup(var.control_plane, "type", "m4.xlarge")
-  subnet_id     = element(data.aws_subnet.ocp_pri_subnet.*.id, count.index)
-  iam_instance_profile =  data.aws_iam_instance_profile.ocp_ec2_master_instance_profile.name
-
-  vpc_security_group_ids = [
-    data.aws_security_group.master.id,
-  ]
-
-  root_block_device {
-    volume_size = lookup(var.control_plane, "disk", 120)
-  }
-
-  associate_public_ip_address = false
-  availability_zone = element(data.aws_availability_zone.aws_azs.*.name, count.index)
-
-  tags =  merge(
-      var.default_tags,
-      map(
-        "Name", format("${local.infrastructure_id}-master%02d", count.index + 1),
-        "kubernetes.io/cluster/${local.infrastructure_id}", "shared"
-      )
-  )
-  user_data = <<EOF
-${base64decode(var.master_ign_64)}
-EOF
-}
diff --git a/7_control_plane/elb.tf b/7_control_plane/elb.tf
deleted file mode 100644
index 447f4f1..0000000
--- a/7_control_plane/elb.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-data "aws_lb_target_group" "ocp_control_plane_int_6443" {
-    arn =  var.ocp_control_plane_lb_int_6443_tg_arn
-}
-
-data "aws_lb_target_group" "ocp_control_plane_int_22623" {
-    arn =  var.ocp_control_plane_lb_int_22623_tg_arn
-}
-
-data "aws_lb" "ocp_control_plane_int" {
-    arn =  var.ocp_control_plane_lb_int_arn
-}
-
-resource "aws_lb_target_group_attachment" "ocp_master_control_plane_int_6443" {
-    count         = lookup(var.control_plane, "count", 3)
-    target_group_arn =  data.aws_lb_target_group.ocp_control_plane_int_6443.arn
-    target_id = element(aws_instance.master.*.private_ip, count.index)
-}
-
-resource "aws_lb_target_group_attachment" "ocp_master_control_plane_int_22623" {
-    count         = lookup(var.control_plane, "count", 3)
-    target_group_arn =  data.aws_lb_target_group.ocp_control_plane_int_22623.arn
-    target_id = element(aws_instance.master.*.private_ip, count.index)
-}
diff --git a/7_control_plane/iam.tf b/7_control_plane/iam.tf
deleted file mode 100644
index 05dfd83..0000000
--- a/7_control_plane/iam.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-data "aws_iam_instance_profile" "ocp_ec2_master_instance_profile" {
-  name =  var.ocp_master_instance_profile_id
-}
-
-data "aws_iam_instance_profile" "ocp_ec2_worker_instance_profile" {
-  name =  var.ocp_worker_instance_profile_id
-}
diff --git a/7_control_plane/output.tf b/7_control_plane/output.tf
deleted file mode 100644
index 1b70611..0000000
--- a/7_control_plane/output.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-output "int_lb_url" {
-    value =  data.aws_lb.ocp_control_plane_int.dns_name
-}
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
diff --git a/7_control_plane/provider.tf b/7_control_plane/provider.tf
deleted file mode 100644
index b4b05d3..0000000
--- a/7_control_plane/provider.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-provider "aws" {
-  region =  var.aws_region
-}
-
-data "aws_caller_identity" "current" {
-}
-
-resource "random_id" "clusterid" {
-  byte_length = "2"
-}
-
-data "aws_region" "current" {}
-
-data "aws_availability_zone" "aws_azs" {
-  count =  length(var.aws_azs)
-  name = "${format("%s%s", data.aws_region.current.name, element(var.aws_azs, count.index))}"
-}
-
-locals {
-  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
-}
diff --git a/7_control_plane/rhcos.tf b/7_control_plane/rhcos.tf
deleted file mode 100644
index b19886d..0000000
--- a/7_control_plane/rhcos.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-data "aws_ami" "rhcos" {
-    most_recent = true
-
-    owners = ["531415883065"]
-
-
-    filter {
-        name = "image-id"
-        values = ["${var.ami}"]
-    }
-
-}
diff --git a/7_control_plane/route53.tf b/7_control_plane/route53.tf
deleted file mode 100644
index 5ef1d62..0000000
--- a/7_control_plane/route53.tf
+++ /dev/null
@@ -1,31 +0,0 @@
-
-resource "aws_route53_record" "etcd_a_int" {
-  count     = lookup(var.control_plane, "count", 3)
-
-  name      = format("etcd-%d.${var.clustername}.${var.domain}", count.index)
-  type      = "A"
-  zone_id   =  data.aws_route53_zone.ocp_private.zone_id
-  ttl       = 60
-
-  records = [
-      element(aws_instance.master.*.private_ip, count.index)
-  ]
-}
-
-data "template_file" "etcd_srv" {
-  count = lookup(var.control_plane, "count", 3)
-  template = format("0 10 2380 etcd-%d.${var.clustername}.${var.domain}", count.index)
-}
-
-resource "aws_route53_record" "etcd_srv_int" {
-  name      = "_etcd-server-ssl._tcp.${var.clustername}.${var.domain}"
-  type      = "SRV"
-  zone_id   =  data.aws_route53_zone.ocp_private.zone_id
-  ttl       = 60
-
-  records =  data.template_file.etcd_srv.*.rendered
-}
-
-data "aws_route53_zone" "ocp_private" {
-  zone_id =  var.ocp_route53_private_zone_id
-}
diff --git a/7_control_plane/security_group.tf b/7_control_plane/security_group.tf
deleted file mode 100644
index a1b498e..0000000
--- a/7_control_plane/security_group.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-data "aws_security_group" "master" {
-    id =  var.ocp_control_plane_security_group_id
-}
-
-data "aws_security_group" "worker" {
-    id =  var.ocp_worker_security_group_id
-}
diff --git a/7_control_plane/variables.tf b/7_control_plane/variables.tf
deleted file mode 100644
index 1f50936..0000000
--- a/7_control_plane/variables.tf
+++ /dev/null
@@ -1,101 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "aws_azs" {
-  type  = list(string)
-  description = "The availability zone letter appendix you want to deploy to in the selected region "
-  default = ["a", "b", "c"]
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-####### AWS Deployment Details ####################################
-# SSH Key
-variable "ami" { default = "" }
-
-variable "infrastructure_id" {
-  default = ""
-}
-
-variable "clustername" { default = "ocp4" }
-
-variable "private_vpc_id" { default = "" }
-
-# Subnet Details
-variable "private_vpc_private_subnet_ids" {
-  description = "List of subnet ids"
-  type        = list(string)
-  default     = []
-}
-
-variable "domain" {
-    default = "example.com"
-}
-
-variable "control_plane" {
-    default = {
-        count = "3"
-        type = "m4.xlarge"
-        disk = "120"
-    }
-}
-
-variable "worker" {
-    default = {
-        count = "3"
-        type = "m4.large"
-        disk = "120"
-    }
-}
-
-variable "openshift_pull_secret" {
-    default = "./openshift_pull_secret.json"
-}
-
-variable "use_worker_machinesets" {
-  default = true
-}
-
-variable "ocp_control_plane_security_group_id" {
-  default = ""
-}
-
-variable "ocp_worker_security_group_id" {
-  default = ""
-}
-
-variable "ocp_master_instance_profile_id" {
-  default = ""
-}
-
-variable "ocp_worker_instance_profile_id" {
-  default = ""
-}
-
-variable "ocp_control_plane_lb_int_arn" {
-  default = ""
-}
-variable "ocp_control_plane_lb_int_22623_tg_arn" {
-  default = ""
-}
-
-variable "ocp_control_plane_lb_int_6443_tg_arn" {
-  default = ""
-}
-
-variable "ocp_route53_private_zone_id" {
-  default = ""
-}
-
-variable "master_ign_64" {
-  default = ""
-}
-
-variable "worker_ign_64" {
-  default = ""
-}
diff --git a/7_control_plane/vpc.tf b/7_control_plane/vpc.tf
deleted file mode 100644
index 47768cb..0000000
--- a/7_control_plane/vpc.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-data "aws_vpc" "ocp_vpc" {
-  id =  var.private_vpc_id
-}
-
-data "aws_subnet" "ocp_pri_subnet" {
-  count       =  length(var.private_vpc_private_subnet_ids)
-  id          = "${element(var.private_vpc_private_subnet_ids, count.index)}"
-}
diff --git a/7_control_plane/worker.tf b/7_control_plane/worker.tf
deleted file mode 100644
index 49bd18b..0000000
--- a/7_control_plane/worker.tf
+++ /dev/null
@@ -1,30 +0,0 @@
-resource "aws_instance" "worker" {
-  count         = var.use_worker_machinesets ? 0 : lookup(var.worker, "count", 3)
-
-  ami           =  data.aws_ami.rhcos.id
-  instance_type = lookup(var.worker, "type", "m4.large")
-  subnet_id     = element(data.aws_subnet.ocp_pri_subnet.*.id, count.index)
-  iam_instance_profile =  data.aws_iam_instance_profile.ocp_ec2_worker_instance_profile.name
-
-  vpc_security_group_ids = [
-    data.aws_security_group.worker.id,
-  ]
-
-  root_block_device {
-    volume_size = lookup(var.worker, "disk", 120)
-  }
-
-  associate_public_ip_address = false
-  availability_zone = element(data.aws_availability_zone.aws_azs.*.name, count.index)
-
-  tags =  merge(
-      var.default_tags,
-      map(
-        "Name", "${format("${local.infrastructure_id}-worker%02d", count.index + 1)}",
-        "kubernetes.io/cluster/${local.infrastructure_id}", "owned"
-      )
-  )
-  user_data = <<EOF
-${base64decode(var.worker_ign_64)}
-EOF
-}
diff --git a/8_postinstall/postinstall.sh b/8_postinstall/postinstall.sh
deleted file mode 100755
index 7e146ff..0000000
--- a/8_postinstall/postinstall.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/bash
-# Assumptions
-# aws, jq are installed
-# checking aws
-echo "Checking Classic load balancers for Kubernetes created elb"
-clusterid=$1 # "ocp42ss-gse01"
-clustername=$2 #"ocp42ss"
-domain=$3 # "vbudi.cf"
-airgapped=$4
-
-if [ -z $domain ]; then
-  echo "Arguments are clusterID clusterName Domain airgapped"
-  exit 999
-fi
-
-found=0
-created_lb=""
-count=100
-
-while [ $found -eq 0 ]; do
-  lb_list=$(aws elb describe-load-balancers | jq '."LoadBalancerDescriptions" | .[]."LoadBalancerName"')
-
-  if [ -z $lb_list ]; then
-    echo "Empty - $count retries left"
-    sleep 60
-  else
-    for lbname in $lb_list; do
-      lbname=$(echo $lbname | tr -d '"')
-      jqargs=".\"TagDescriptions\" | .[].Tags | .[] | select(.Key == \"kubernetes.io/cluster/${clusterid}\") | .Value"
-      klval=$(aws elb describe-tags --load-balancer-names ${lbname} | jq "$jqargs" )
-      if [ $klval = '"owned"' ]; then
-        found=1
-        created_lb=$lbname
-      else
-        echo "Empty - $count retries left"
-        sleep 60
-      fi
-    done
-  fi
-  count=$((count-1))
-  if [ $count -eq 0 ]; then
-    echo "Giving up after 100 minutes"
-    exit 999
-  fi
-done
-
-lbzone=$(aws elb describe-load-balancers --load-balancer-names $created_lb | jq '."LoadBalancerDescriptions" | .[]."CanonicalHostedZoneNameID"' | tr -d '"')
-lbhost=$(aws elb describe-load-balancers --load-balancer-names $created_lb | jq '."LoadBalancerDescriptions" | .[]."CanonicalHostedZoneName"' | tr -d '"')
-
-echo $lbzone $lbhost
-
-rte53args=".HostedZones | .[] |  select(.Name == \"${domain}.\") | .Id"
-rte53zone=$(aws route53 list-hosted-zones | jq "$rte53args" | tr -d '"')
-cat <<EOF >createRS.json
-{
-     "Comment": "Creating Alias resource record sets in Route 53",
-     "Changes": [{
-                "Action": "CREATE",
-                "ResourceRecordSet": {
-                            "Name": "*.apps.${clustername}.${domain}",
-                            "Type": "A",
-                            "AliasTarget":{
-                                    "HostedZoneId": "$lbzone",
-                                    "DNSName": "$lbhost",
-                                    "EvaluateTargetHealth": false
-                              }}
-                          }]
-}
-EOF
-
-if [ $airgapped -ne "true" ]; then
-  aws route53 change-resource-record-sets --hosted-zone-id $rte53zone --change-batch file://createRS.json
-fi
-
-rm createRS.json
-
-exit 0
diff --git a/8_postinstall/variables.tf b/8_postinstall/variables.tf
deleted file mode 100644
index 5b44298..0000000
--- a/8_postinstall/variables.tf
+++ /dev/null
@@ -1,29 +0,0 @@
-####### AWS Access and Region Details #############################
-variable "aws_region" {
-  default  = "us-east-2"
-  description = "One of us-east-2, us-east-1, us-west-1, us-west-2, ap-south-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, us-west-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1"
-}
-
-variable "aws_azs" {
-  type  = list(string)
-  description = "The availability zone letter appendix you want to deploy to in the selected region "
-  default = ["a", "b", "c"]
-}
-
-variable "default_tags" {
-    default = {}
-}
-
-variable "infrastructure_id" {
-  default = ""
-}
-
-variable "clustername" { default = "ocp4" }
-
-variable "domain" {
-  default = "example.com"
-}
-
-variable "airgapped" {
-  default = false
-}
diff --git a/8_postinstall/wait.tf b/8_postinstall/wait.tf
deleted file mode 100644
index b6f9544..0000000
--- a/8_postinstall/wait.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-resource "null_resource" "postinstall" {
-
-  provisioner "local-exec" {
-    when = create
-    command = "${path.module}/postinstall.sh ${var.infrastructure_id} ${var.clustername} ${var.domain} ${var.airgapped}"
-  }
-}
diff --git a/8_postinstall/worker_config.tftemplate b/8_postinstall/worker_config.tftemplate
deleted file mode 100644
index f85300e..0000000
--- a/8_postinstall/worker_config.tftemplate
+++ /dev/null
@@ -1,44 +0,0 @@
-data "aws_ami" "rhcos" {
-    most_recent = true
-    owners = ["531415883065"]
-}
-
-resource "aws_instance" "worker_machines" {
-  count           = 3
-
-  ami           =  data.aws_ami.rhcos.id
-  instance_type =  "m4.large"
-}
-
-resource "aws_elb" "ocp_compute_elb"  {
- listener {
-    instance_port     = 80
-    instance_protocol = "http"
-    lb_port           = 80
-    lb_protocol       = "http"
-  }
-}
-
-resource "aws_security_group" "compute_elb" {
-}
-
-#data "aws_route53_zone" "ocp_private" {
-#  name = "${var.clustername}.${var.domain}"
-#}
-
-#data "aws_route53_zone" "ocp_public" {
-#  name =  var.domain
-#}
-
-resource "aws_route53_record" "compute_apps" {
-  name      = "*.apps.${var.clustername}.${var.domain}"
-  type      = "A"
-  zone_id = "aaa"
-}
-
-resource "aws_route53_record" "compute_apps_public" {
-  count     = var.airgapped ? 0 : 1
-  name      =  "*.apps.${var.clustername}.${var.domain}"
-  type      =  "A"
-  zone_id = "aaa"
-}
diff --git a/8_postinstall/worker_import.sh b/8_postinstall/worker_import.sh
deleted file mode 100644
index 3b1052b..0000000
--- a/8_postinstall/worker_import.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin.bash
-# Invoked woth the implementation ID
-# Collect AWS ids and insert into terraform
-clusterid=$1 # "ocp42ss-gse01"
-clustername=$2 #"ocp42ss"
-domain=$3 # "vbudi.cf"
-
-if [ -z $domain ]; then
-  echo "Arguments are clusterID clusterName Domain airgapped"
-  exit 999
-fi
-
-MY_PATH=$(dirname "$0")              # relative
-cp $MY_PATH/worker_config.tftemplate $MY_PATH/worker_config.tf
-
-instList=$(aws ec2 describe-instances --filters "Name=instance.group-name,Values=${clusterid}-worker"  --query "Reservations[*].Instances[*].{Instance:InstanceId}" | grep Instance | cut -d\" -f4)
-i=0
-echo $instList
-for instName in $instList
-do
-  terraform import "module.postinstall.aws_instance.workermachines[$i]" $instName
-  i=$((i+1))
-done
-
-lb_list=$(aws elb describe-load-balancers | jq '."LoadBalancerDescriptions" | .[]."LoadBalancerName"')
-for lbname in $lb_list; do
-    lbname=$(echo $lbname | tr -d '"')
-    jqargs=".\"TagDescriptions\" | .[].Tags | .[] | select(.Key == \"kubernetes.io/cluster/${clusterid}\") | .Value"
-    klval=$(aws elb describe-tags --load-balancer-names ${lbname} | jq "$jqargs" )
-    if [ $klval = '"owned"' ]; then
-      found=1
-      created_lb=$lbname
-    fi
-done
-terraform import module.postinstall.aws_elb.ocp_compute_elb ${created_lb}
-
-sg_elb=$(aws ec2 describe-security-groups --query "SecurityGroups[*].GroupName" | grep "k8s-elb" | cut -d\" -f2)
-sg_name=$(aws ec2 describe-security-groups --query "SecurityGroups[*].GroupId" --filter "Name=group-name,Values=$sg_elb" | grep sg | cut -d\" -f2)
-terraform import module.postinstall.aws_security_group.compute_elb ${sg_name}
-
-if [ $airgapped -ne "true" ]; then
-  rte53pubargs=".HostedZones | .[] |  select(.Name == \"${domain}.\") | .Id"
-  rte53pubzone=$(aws route53 list-hosted-zones | jq "$rte53pubargs" | tr -d '"')
-  terraform import module.postinstall.aws_route53_record.compute_apps_public[0] ${rte53pubzone}_*.apps.${clustername}.${domain}_A
-fi
-
-rte53priargs=".HostedZones | .[] |  select(.Name == \"${clustername}.${domain}.\") | .Id"
-rte53prizone=$(aws route53 list-hosted-zones | jq "$rte53priargs" | tr -d '"')
-terraform import module.postinstall.aws_route53_record.compute_apps ${rte53prizone}_*.apps.${clustername}.${domain}_A
-
-
-# must decouple Security group  $sg_name from $clusterid-master and $clusterid-worker
-
-aws ec2 revoke-security-group-ingress --group-name $clusterid-master --source_group $sg_name
-aws ec2 revoke-security-group-ingress --group-name $clusterid-worker --source_group $sg_name
diff --git a/OWNERS b/OWNERS
new file mode 100644
index 0000000..6e59d68
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+# This file just uses aliases defined in OWNERS_ALIASES.
+
+approvers:
+  - aws-approvers
+reviewers:
+  - aws-reviewers
diff --git a/bootstrap/README.md b/bootstrap/README.md
new file mode 100644
index 0000000..b91c4e9
--- /dev/null
+++ b/bootstrap/README.md
@@ -0,0 +1,48 @@
+# Bootstrap Module
+
+This [Terraform][] [module][] manages [AWS][] resources only needed during cluster bootstrapping.
+It uses [implicit provider inheritance][implicit-provider-inheritance] to access the [AWS provider][AWS-provider].
+
+## Example
+
+Set up a `main.tf` with:
+
+```hcl
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_vpc" "example" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+}
+
+resource "aws_subnet" "example" {
+  vpc_id     = "${aws_vpc.example.id}"
+  cidr_block = "${aws_vpc.example.cidr_block}"
+}
+
+module "bootstrap" {
+  source = "github.com/openshift/installer//data/data/aws/bootstrap"
+
+  ami            = "ami-0af8953af3ec06b7c"
+  cluster_id     = "my-cluster"
+  ignition       = "{\"ignition\": {\"version\": \"2.2.0\"}}",
+  subnet_id      = "${aws_subnet.example.id}"
+  vpc_id         = "${aws_vpc.example.id}"
+}
+```
+
+Then run:
+
+```console
+$ terraform init
+$ terraform plan
+```
+
+[AWS]: https://aws.amazon.com/
+[AWS-provider]: https://www.terraform.io/docs/providers/aws/
+[implicit-provider-inheritance]: https://www.terraform.io/docs/modules/usage.html#implicit-provider-inheritance
+[module]: https://www.terraform.io/docs/modules/
+[Terraform]: https://www.terraform.io/
diff --git a/bootstrap/main.tf b/bootstrap/main.tf
new file mode 100644
index 0000000..2b5cbfa
--- /dev/null
+++ b/bootstrap/main.tf
@@ -0,0 +1,196 @@
+locals {
+  public_endpoints = var.publish_strategy == "External" ? true : false
+}
+
+resource "aws_s3_bucket" "ignition" {
+  acl = "private"
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-bootstrap"
+    },
+    var.tags,
+  )
+
+  lifecycle {
+    ignore_changes = all
+  }
+}
+
+resource "aws_s3_bucket_object" "ignition" {
+  bucket  = aws_s3_bucket.ignition.id
+  key     = "bootstrap.ign"
+  content = var.ignition
+  acl     = "private"
+
+  server_side_encryption = "AES256"
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-bootstrap"
+    },
+    var.tags,
+  )
+
+  lifecycle {
+    ignore_changes = all
+  }
+}
+
+data "ignition_config" "redirect" {
+  replace {
+    source = "s3://${aws_s3_bucket.ignition.id}/bootstrap.ign"
+  }
+}
+
+resource "aws_iam_instance_profile" "bootstrap" {
+  name = "${var.cluster_id}-bootstrap-profile"
+
+  role = aws_iam_role.bootstrap.name
+}
+
+resource "aws_iam_role" "bootstrap" {
+  name = "${var.cluster_id}-bootstrap-role"
+  path = "/"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-bootstrap-role"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_iam_role_policy" "bootstrap" {
+  name = "${var.cluster_id}-bootstrap-policy"
+  role = aws_iam_role.bootstrap.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "ec2:Describe*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:AttachVolume",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:DetachVolume",
+      "Resource": "*"
+    },
+    {
+      "Action" : [
+        "s3:GetObject"
+      ],
+      "Resource": "arn:aws:s3:::*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+
+}
+
+resource "aws_instance" "bootstrap" {
+  ami = var.ami
+
+  iam_instance_profile        = aws_iam_instance_profile.bootstrap.name
+  instance_type               = var.instance_type
+  subnet_id                   = var.subnet_id
+  user_data                   = data.ignition_config.redirect.rendered
+  vpc_security_group_ids      = flatten([var.vpc_security_group_ids, aws_security_group.bootstrap.id])
+  associate_public_ip_address = local.public_endpoints
+
+  lifecycle {
+    # Ignore changes in the AMI which force recreation of the resource. This
+    # avoids accidental deletion of nodes whenever a new OS release comes out.
+    ignore_changes = [ami]
+  }
+
+  tags = merge(
+    {
+    "Name" = "${var.cluster_id}-bootstrap"
+    },
+    var.tags,
+  )
+
+  root_block_device {
+    volume_type = var.volume_type
+    volume_size = var.volume_size
+    iops        = var.volume_type == "io1" ? var.volume_iops : 0
+  }
+
+  volume_tags = merge(
+    {
+    "Name" = "${var.cluster_id}-bootstrap-vol"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_lb_target_group_attachment" "bootstrap" {
+  // Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot use a dynamic list for count
+  // and therefore are force to implicitly assume that the list is of aws_lb_target_group_arns_length - 1, in case there is no api_external
+  count = local.public_endpoints ? var.target_group_arns_length : var.target_group_arns_length - 1
+
+  target_group_arn = var.target_group_arns[count.index]
+  target_id        = aws_instance.bootstrap.private_ip
+}
+
+resource "aws_security_group" "bootstrap" {
+  vpc_id = var.vpc_id
+
+  timeouts {
+    create = "20m"
+  }
+
+  tags = merge(
+    {
+    "Name" = "${var.cluster_id}-bootstrap-sg"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_security_group_rule" "ssh" {
+  type              = "ingress"
+  security_group_id = aws_security_group.bootstrap.id
+
+  protocol    = "tcp"
+  cidr_blocks = local.public_endpoints ? ["0.0.0.0/0"] : var.vpc_cidrs
+  from_port   = 22
+  to_port     = 22
+}
+
+resource "aws_security_group_rule" "bootstrap_journald_gateway" {
+  type              = "ingress"
+  security_group_id = aws_security_group.bootstrap.id
+
+  protocol    = "tcp"
+  cidr_blocks = local.public_endpoints ? ["0.0.0.0/0"] : var.vpc_cidrs
+  from_port   = 19531
+  to_port     = 19531
+}
+
diff --git a/bootstrap/variables.tf b/bootstrap/variables.tf
new file mode 100644
index 0000000..a37e961
--- /dev/null
+++ b/bootstrap/variables.tf
@@ -0,0 +1,80 @@
+variable "ami" {
+  type        = string
+  description = "The AMI ID for the bootstrap node."
+}
+
+variable "cluster_id" {
+  type        = string
+  description = "The identifier for the cluster."
+}
+
+variable "ignition" {
+  type        = string
+  description = "The content of the bootstrap ignition file."
+}
+
+variable "instance_type" {
+  type        = string
+  description = "The instance type of the bootstrap node."
+}
+
+variable "subnet_id" {
+  type        = string
+  description = "The subnet ID for the bootstrap node."
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS tags to be applied to created resources."
+}
+
+variable "target_group_arns" {
+  type        = list(string)
+  default     = []
+  description = "The list of target group ARNs for the load balancer."
+}
+
+variable "target_group_arns_length" {
+  description = "The length of the 'target_group_arns' variable, to work around https://github.com/hashicorp/terraform/issues/12570."
+}
+
+variable "volume_iops" {
+  type        = string
+  default     = "100"
+  description = "The amount of IOPS to provision for the disk."
+}
+
+variable "volume_size" {
+  type        = string
+  default     = "30"
+  description = "The volume size (in gibibytes) for the bootstrap node's root volume."
+}
+
+variable "volume_type" {
+  type        = string
+  default     = "gp2"
+  description = "The volume type for the bootstrap node's root volume."
+}
+
+variable "vpc_id" {
+  type        = string
+  description = "VPC ID is used to create resources like security group rules for bootstrap machine."
+}
+
+variable "vpc_cidrs" {
+  type        = list(string)
+  default     = []
+  description = "VPC CIDR blocks."
+}
+
+variable "vpc_security_group_ids" {
+  type        = list(string)
+  default     = []
+  description = "VPC security group IDs for the bootstrap node."
+}
+
+variable "publish_strategy" {
+  type        = string
+  description = "The publishing strategy for endpoints like load balancers"
+}
diff --git a/config.tf b/config.tf
new file mode 100644
index 0000000..5649f55
--- /dev/null
+++ b/config.tf
@@ -0,0 +1,80 @@
+terraform {
+  required_version = ">= 0.12"
+}
+
+variable "machine_cidr" {
+  type = string
+
+  description = <<EOF
+The IP address space from which to assign machine IPs.
+EOF
+
+}
+
+variable "master_count" {
+  type = string
+  default = "1"
+
+  description = <<EOF
+The number of master nodes to be created.
+This applies only to cloud platforms.
+EOF
+
+}
+
+variable "base_domain" {
+  type = string
+
+  description = <<EOF
+The base DNS domain of the cluster. It must NOT contain a trailing period. Some
+DNS providers will automatically add this if necessary.
+
+Example: `openshift.example.com`.
+
+Note: This field MUST be set manually prior to creating the cluster.
+This applies only to cloud platforms.
+EOF
+
+}
+
+variable "clustername" {
+  type = string
+
+  description = <<EOF
+The name of the cluster. It must NOT contain a trailing period. Some
+DNS providers will automatically add this if necessary.
+
+Note: This field MUST be set manually prior to creating the cluster.
+EOF
+
+}
+
+// This variable is generated by OpenShift internally. Do not modify
+variable "cluster_id" {
+  type = string
+
+  description = <<EOF
+(internal) The OpenShift cluster id.
+
+This cluster id must be of max length 27 and must have only alphanumeric or hyphen characters.
+EOF
+
+}
+
+variable "use_ipv4" {
+  type = bool
+
+  description = <<EOF
+Should the cluster be created with ipv4 networking.
+EOF
+
+}
+
+variable "use_ipv6" {
+  type = bool
+
+  description = <<EOF
+Should the cluster be created with ipv6 networking.
+EOF
+
+}
diff --git a/iam/main.tf b/iam/main.tf
new file mode 100644
index 0000000..29d2ad2
--- /dev/null
+++ b/iam/main.tf
@@ -0,0 +1,57 @@
+locals {
+  arn = "aws"
+}
+
+resource "aws_iam_instance_profile" "worker" {
+  name = "${var.cluster_id}-worker-profile"
+
+  role = aws_iam_role.worker_role.name
+}
+
+resource "aws_iam_role" "worker_role" {
+  name = "${var.cluster_id}-worker-role"
+  path = "/"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-worker-role"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_iam_role_policy" "worker_policy" {
+  name = "${var.cluster_id}-worker-policy"
+  role = aws_iam_role.worker_role.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "ec2:Describe*",
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+
+}
+
diff --git a/iam/variables.tf b/iam/variables.tf
new file mode 100644
index 0000000..8f45376
--- /dev/null
+++ b/iam/variables.tf
@@ -0,0 +1,10 @@
+variable "cluster_id" {
+  type = string
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS tags to be applied to created resources."
+}
+
diff --git a/6_bootstrap/installer.tf b/install/installer.tf
similarity index 52%
rename from 6_bootstrap/installer.tf
rename to install/installer.tf
index 3569d8d..576f628 100644
--- a/6_bootstrap/installer.tf
+++ b/install/installer.tf
@@ -1,3 +1,8 @@
+locals {
+#  infrastructure_id = "${var.infrastructure_id != "" ? "${var.infrastructure_id}" : "${var.clustername}-${random_id.clusterid.hex}"}"
+  infrastructure_id = var.infrastructure_id
+}
+
 resource "null_resource" "openshift_installer" {
   provisioner "local-exec" {
     command = <<EOF
@@ -24,10 +29,6 @@ EOF
 }
 
 resource "null_resource" "openshift_client" {
-  depends_on = [
-    null_resource.openshift_installer
-  ]
-
   provisioner "local-exec" {
     command = <<EOF
 case $(uname -s) in
@@ -53,18 +54,6 @@ EOF
   }
 }
 
-resource "null_resource" "load_ecr" {
-  count = var.airgapped ? 1 : 0
-
-  depends_on = [
-    null_resource.openshift_client
-  ]
-
-  provisioner "local-exec" {
-    command = "${path.module}/replicate.sh ${var.openshift_pull_secret} ${local.infrastructure_id}"
-  }
-}
-
 resource "null_resource" "aws_credentials" {
   provisioner "local-exec" {
     command = "mkdir -p ~/.aws"
@@ -91,34 +80,26 @@ baseDomain: ${var.domain}
 compute:
 - hyperthreading: Enabled
   name: worker
-  replicas: ${var.use_worker_machinesets ? lookup(var.worker, "count", 3) : 0}
+  replicas: 0
 controlPlane:
   hyperthreading: Enabled
   name: master
-  replicas: ${lookup(var.control_plane, "count", 3)}
+  replicas: ${var.master_count}
 metadata:
   name: ${var.clustername}
 networking:
   clusterNetworks:
   - cidr: ${var.cluster_network_cidr}
     hostPrefix: ${var.cluster_network_host_prefix}
-  machineCIDR:  ${data.aws_vpc.ocp_vpc.cidr_block}
+  machineCIDR:  ${var.vpc_cidr_block}
   networkType: OpenShiftSDN
   serviceNetwork:
   - ${var.service_network_cidr}
 platform:
   aws:
-    region: ${data.aws_region.current.name}
-pullSecret: %{if var.airgapped}'${file("newPullSecret.json")}'%{else}'${file(var.openshift_pull_secret)}'%{endif}
+    region: ${var.aws_region}
+pullSecret: '${file(var.openshift_pull_secret)}'
 sshKey: '${tls_private_key.installkey.public_key_openssh}'
-%{if var.airgapped}imageContentSources:
-- mirrors:
-  - ${var.repository}
-  source: quay.io/openshift-release-dev/ocp-release
-- mirrors:
-  - ${var.repository}
-  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-%{endif}
 EOF
 }
 
@@ -136,7 +117,6 @@ resource "null_resource" "generate_manifests" {
     local_file.install_config,
     null_resource.aws_credentials,
     null_resource.openshift_installer,
-    null_resource.load_ecr
   ]
 
   provisioner "local-exec" {
@@ -172,102 +152,6 @@ resource "null_resource" "manifest_cleanup_control_plane_machineset" {
   }
 }
 
-# remove these machinesets, we will rewrite them using the security group and subnets that we created
-resource "null_resource" "manifest_cleanup_worker_machineset" {
-  depends_on = [
-    null_resource.generate_manifests
-  ]
-
-  triggers = {
-    install_config =  data.template_file.install_config_yaml.rendered
-    local_file     =  local_file.install_config.id
-  }
-
-  provisioner "local-exec" {
-    command = "rm -f ${path.module}/temp/openshift/99_openshift-cluster-api_worker-machines*.yaml"
-  }
-}
-
-## Moving the machineset to the manifests dir
-resource "local_file" "worker_machineset" {
-  count           = var.use_worker_machinesets ? length(var.aws_azs) : 0
-  file_permission = "0644"
-  depends_on = [
-    null_resource.manifest_cleanup_worker_machineset
-  ]
-
-  filename =  "${path.module}/temp/openshift/99_openshift-cluster-api_worker-machineset-${count.index}.yaml"
-
-  content = <<-EOF
-apiVersion: machine.openshift.io/v1beta1
-kind: MachineSet
-metadata:
-  creationTimestamp: null
-  labels:
-    machine.openshift.io/cluster-api-cluster: ${local.infrastructure_id}
-  name: ${local.infrastructure_id}-worker-${element(data.aws_availability_zone.aws_azs.*.name, count.index)}
-  namespace: openshift-machine-api
-spec:
-  replicas: ${floor(lookup(var.worker, "count", 3) / length(data.aws_availability_zone.aws_azs))}
-  selector:
-    matchLabels:
-      machine.openshift.io/cluster-api-cluster: ${local.infrastructure_id}
-      machine.openshift.io/cluster-api-machineset: ${local.infrastructure_id}-worker-${element(data.aws_availability_zone.aws_azs.*.name, count.index)}
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        machine.openshift.io/cluster-api-cluster: ${local.infrastructure_id}
-        machine.openshift.io/cluster-api-machine-role: worker
-        machine.openshift.io/cluster-api-machine-type: worker
-        machine.openshift.io/cluster-api-machineset: ${local.infrastructure_id}-worker-${element(data.aws_availability_zone.aws_azs.*.name, count.index)}
-    spec:
-      metadata:
-        creationTimestamp: null
-      providerSpec:
-        value:
-          ami:
-            id: ${data.aws_ami.rhcos.id}
-          apiVersion: awsproviderconfig.openshift.io/v1beta1
-          blockDevices:
-          - ebs:
-              iops: 0
-              volumeSize: ${lookup(var.worker, "disk", 120)}
-              volumeType: gp2
-          credentialsSecret:
-            name: aws-cloud-credentials
-          deviceIndex: 0
-          iamInstanceProfile:
-            id: ${data.aws_iam_instance_profile.ocp_ec2_worker_instance_profile.name}
-          instanceType: ${lookup(var.worker, "type", "m4.large")}
-          kind: AWSMachineProviderConfig
-          metadata:
-            creationTimestamp: null
-          placement:
-            availabilityZone: ${element(data.aws_availability_zone.aws_azs.*.name, count.index)}
-            region: ${data.aws_region.current.name}
-          publicIp: null
-          securityGroups:
-          - filters:
-            - name: group-id
-              values:
-              - ${data.aws_security_group.worker.id}
-          subnet:
-            filters:
-            - name: subnet-id
-              values:
-              - ${element(data.aws_subnet.ocp_pri_subnet.*.id, count.index)}
-          tags:
-          - name: kubernetes.io/cluster/${local.infrastructure_id}
-            value: owned
-          userDataSecret:
-            name: worker-user-data
-status:
-  replicas: 0
-EOF
-
-}
-
 # rewrite the domains and the infrastructure id we use in the cluster
 resource "local_file" "cluster_infrastructure_config" {
   depends_on = [
@@ -293,51 +177,22 @@ status:
   platform: AWS
   platformStatus:
     aws:
-      region: ${data.aws_region.current.name}
+      region: ${var.aws_region}
     type: AWS
 EOF
 }
 
-# remove public DNS domain management, just manage the private hosted zone
-resource "local_file" "cluster_dns_config" {
-  depends_on = [
-    null_resource.generate_manifests
-  ]
-  file_permission = "0644"
-  filename        =  "${path.module}/temp/manifests/cluster-dns-02-config.yml"
-
-  content = <<EOF
-apiVersion: config.openshift.io/v1
-kind: DNS
-metadata:
-  creationTimestamp: null
-  name: cluster
-spec:
-  baseDomain: ${var.clustername}.${var.domain}
-  privateZone:
-    tags:
-      Name: ${data.aws_route53_zone.ocp_private.name}
-      kubernetes.io/cluster/${local.infrastructure_id}: owned
-status: {}
-EOF
-}
-
 # build the bootstrap ignition config
 resource "null_resource" "generate_ignition_config" {
   depends_on = [
     null_resource.manifest_cleanup_control_plane_machineset,
-    null_resource.manifest_cleanup_worker_machineset,
-    local_file.worker_machineset,
     local_file.cluster_infrastructure_config,
-    local_file.cluster_dns_config,
   ]
 
   triggers = {
     install_config                   =  data.template_file.install_config_yaml.rendered
     local_file_install_config        =  local_file.install_config.id
     local_file_infrastructure_config =  local_file.cluster_infrastructure_config.id
-    local_file_dns_config            =  local_file.cluster_dns_config.id
-    local_file_worker_machineset     = "${join(",", local_file.worker_machineset.*.id)}"
   }
 
   provisioner "local-exec" {
@@ -362,11 +217,6 @@ resource "null_resource" "generate_ignition_config" {
 }
 
 resource "null_resource" "cleanup" {
-  depends_on = [
-    aws_instance.bootstrap,
-    aws_s3_bucket_object.bootstrap_ign
-  ]
-
   provisioner "local-exec" {
     when    = destroy
     command = "rm -rf ${path.module}/temp"
@@ -431,30 +281,3 @@ resource "null_resource" "get_auth_config" {
     command = "rm ${path.root}/kubeconfig ${path.root}/kubeadmin-password "
   }
 }
-
-data "template_file" "airgapped_registry_upgrades" {
-  count    = var.airgapped ? 1 : 0
-  template = <<EOF
-apiVersion: operator.openshift.io/v1alpha1
-kind: ImageContentSourcePolicy
-metadata:
-  name: airgapped
-spec:
-  repositoryDigestMirrors:
-  - mirrors:
-    - ${var.repository}
-    source: quay.io/openshift-release-dev/ocp-release
-  - mirrors:
-    - ${var.repository}
-    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-EOF
-}
-
-resource "local_file" "airgapped_registry_upgrades" {
-  count    = var.airgapped ? 1 : 0
-  content  = element(data.template_file.airgapped_registry_upgrades.*.rendered, count.index)
-  filename = "${path.module}/temp/manifests/airgapped_registry_upgrades.yaml"
-  depends_on = [
-    null_resource.generate_manifests,
-  ]
-}
diff --git a/6_bootstrap/output.tf b/install/output.tf
similarity index 65%
rename from 6_bootstrap/output.tf
rename to install/output.tf
index 4a26c51..18d4a9d 100644
--- a/6_bootstrap/output.tf
+++ b/install/output.tf
@@ -1,10 +1,9 @@
-
-output "clustername" {
-    value =  var.clustername
+output master_ign {
+    value = data.local_file.master_ign.content
 }
 
-output "infrastructure_id" {
-    value =  local.infrastructure_id
+output bootstrap_ign {
+    value = data.local_file.bootstrap_ign.content
 }
 
 output "master_ign_64" {
@@ -23,6 +22,3 @@ output "public_ssh_key" {
     value =  tls_private_key.installkey.public_key_openssh
 }
 
-output "bootstrap_ip" {
-    value =  aws_instance.bootstrap.private_ip
-}
diff --git a/6_bootstrap/ssh_key.tf b/install/ssh_key.tf
similarity index 100%
rename from 6_bootstrap/ssh_key.tf
rename to install/ssh_key.tf
diff --git a/install/variables.tf b/install/variables.tf
new file mode 100644
index 0000000..23454c6
--- /dev/null
+++ b/install/variables.tf
@@ -0,0 +1,67 @@
+variable "infrastructure_id" {
+  type        = string
+  description = "The identifier for infra resources."
+}
+
+variable "clustername" {
+  type        = string
+  description = "The identifier for the cluster."
+}
+
+variable "domain" {
+  type        = string
+  description = "The DNS domain for the cluster."
+}
+
+variable "cluster_network_cidr" {
+  type        = string
+  default     = "192.168.0.0/17"
+}
+
+variable "service_network_cidr" {
+  type        = string
+  default     = "192.168.128.0/24"
+}
+
+variable "vpc_cidr_block" {
+  type        = string
+  default     = "192.168.0.0/24"
+}
+
+variable "cluster_network_host_prefix" {
+  type        = string
+  default     = "23"
+}
+
+variable "master_count" {
+  type        = number
+  description = "The number of master nodes."
+  default     = 3
+}
+
+variable "openshift_pull_secret" {
+  type        = string
+  default     = "./openshift_pull_secret.json"
+}
+
+variable "openshift_installer_url" {
+  type        = string
+  description = "The URL to download OpenShift installer."
+  default     = "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest"
+}
+
+variable "aws_access_key_id" {
+  type        = string
+  description = "AWS access key"
+}
+
+variable "aws_secret_access_key" {
+  type        = string
+  description = "AWS Secret"
+}
+
+variable "aws_region" {
+  type        = string
+  description = "AWS region"
+  default     = "us-east-1"
+}
diff --git a/instvar.tf b/instvar.tf
new file mode 100644
index 0000000..0c89198
--- /dev/null
+++ b/instvar.tf
@@ -0,0 +1,21 @@
+variable "openshift_pull_secret" {
+  type        = string
+  default     = "./openshift_pull_secret.json"
+}
+
+variable "openshift_installer_url" {
+  type        = string
+  description = "The URL to download OpenShift installer."
+  default     = "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest"
+}
+
+variable "aws_access_key_id" {
+  type        = string
+  description = "AWS access key"
+}
+
+variable "aws_secret_access_key" {
+  type        = string
+  description = "AWS Secret"
+}
+
diff --git a/main.tf b/main.tf
index 8d66a1e..c65f7de 100644
--- a/main.tf
+++ b/main.tf
@@ -1,171 +1,132 @@
-resource "random_id" "clusterid" {
-  byte_length = "2"
+locals {
+  tags = merge(
+    {
+      "kubernetes.io/cluster/${var.cluster_id}" = "owned"
+    },
+    var.aws_extra_tags,
+  )
 }
 
-locals {
-  infrastructure_id = var.infrastructure_id != "" ? var.infrastructure_id :  "${var.clustername}-${random_id.clusterid.hex}"
+provider "aws" {
+  region = var.aws_region
+
+  # Validation of AWS Bahrain region was added in AWS TF provider v2.22
+  # so we skip when installing in me-south-1.
+  skip_region_validation = var.aws_region == "me-south-1"
 }
 
-module "private_network" {
-  source = "./1_private_network"
-  aws_region = var.aws_region
-  aws_azs = var.aws_azs
-  default_tags = var.default_tags
-  infrastructure_id = local.infrastructure_id
-  clustername = var.clustername
-  vpc_cidr = var.private_vpc_cidr
-  vpc_private_subnet_cidrs = var.vpc_private_subnet_cidrs
-  vpc_public_subnet_cidrs = var.vpc_public_subnet_cidrs
-  airgapped = var.airgapped
+module "iam" {
+  source = "./iam"
+
+  cluster_id = var.cluster_id
+
+  tags = local.tags
 }
-# ---------------------------
-#      module.private_network.infrastructure_id
-#      module.private_network.clustername
-#      module.private_network.private_vpc_id
-#      module.private_network.private_vpc_private_subnet_ids
-#     XX module.private_network.private_vpc_public_subnet_ids
-#      module.private_network.private_ecr_repository_url
-# ---------------------------
-module "load_balancer" {
-  source = "./2_load_balancer"
-  aws_region =  var.aws_region
-  default_tags =  var.default_tags
-  infrastructure_id =  local.infrastructure_id
-  clustername =  var.clustername
-  private_vpc_id =  module.private_network.private_vpc_id
-  private_vpc_private_subnet_ids =  module.private_network.private_vpc_private_subnet_ids
+
+module "installer" {
+  source = "./install"
+
+  infrastructure_id = var.cluster_id
+  clustername = var.cluster_id
+  domain = var.base_domain
+  aws_access_key_id = var.aws_access_key_id
+  aws_secret_access_key = var.aws_secret_access_key
+  vpc_cidr_block = var.machine_cidr
+  master_count = var.master_count
+  openshift_pull_secret = var.openshift_pull_secret
+  openshift_installer_url = var.openshift_installer_url
 }
-# ---------------------------
-#      module.load_balancer.private_vpc_id
-#      module.load_balancer.infrastructure_id
-#      module.load_balancer.clustername
-#      module.load_balancer.ocp_control_plane_lb_int_arn
-#      module.load_balancer.ocp_control_plane_lb_int_6443_tg_arn
-#      module.load_balancer.ocp_control_plane_lb_int_22623_tg_arn
-# ---------------------------
-module "dns" {
-  source = "./3_dns"
-  aws_region =  var.aws_region
-  default_tags =  var.default_tags
-  infrastructure_id =  local.infrastructure_id
-  private_vpc_id =  module.private_network.private_vpc_id
-  ocp_control_plane_lb_int_arn =  module.load_balancer.ocp_control_plane_lb_int_arn
-  clustername =  var.clustername
-  domain =  var.domain
+
+module "vpc" {
+  source = "./vpc"
+
+  cidr_block       = var.machine_cidr
+  cluster_id       = var.cluster_id
+  region           = var.aws_region
+  vpc              = var.aws_vpc
+  public_subnets   = var.aws_public_subnets
+  private_subnets  = var.aws_private_subnets
+  publish_strategy = var.aws_publish_strategy
+
+  availability_zones = distinct(
+    concat(
+      var.aws_master_availability_zones,
+      var.aws_worker_availability_zones,
+    ),
+  )
+
+  tags = local.tags
 }
-# ---------------------------
-#      module.dns.ocp_route53_private_zone_id
-#      module.dns.private_vpc_id
-#      module.dns.infrastructure_id
-#      module.dns.clustername
-#      module.dns.ocp_control_plane_lb_int_arn
-# ---------------------------
-module "security_group" {
-  source = "./4_security_group"
-  aws_region =  var.aws_region
-  default_tags =  var.default_tags
-  clustername =  var.clustername
-  infrastructure_id =  local.infrastructure_id
-  private_vpc_id =  module.private_network.private_vpc_id
+
+module "dns" {
+  source = "./route53"
+
+  api_external_lb_dns_name = module.vpc.aws_lb_api_external_dns_name
+  api_external_lb_zone_id  = module.vpc.aws_lb_api_external_zone_id
+  api_internal_lb_dns_name = module.vpc.aws_lb_api_internal_dns_name
+  api_internal_lb_zone_id  = module.vpc.aws_lb_api_internal_zone_id
+  base_domain              = var.base_domain
+  cluster_domain           = "${var.clustername}.${var.base_domain}"
+  cluster_id               = var.cluster_id
+  etcd_count               = var.master_count
+  etcd_ip_addresses        = flatten(module.masters.ip_addresses)
+  tags                     = local.tags
+  vpc_id                   = module.vpc.vpc_id
+  publish_strategy         = var.aws_publish_strategy
 }
-# ---------------------------
-#      module.security_group.infrastructure_id
-#      module.security_group.clustername
-#      module.security_group.ocp_control_plane_security_group_id
-#      module.security_group.ocp_worker_security_group_id
-# ---------------------------
-module "iam" {
-  source = "./5_iam"
-  aws_region =  var.aws_region
-  default_tags =  var.default_tags
-  infrastructure_id =  local.infrastructure_id
-  clustername =  var.clustername
+
+resource "aws_ami_copy" "main" {
+  name              = "${var.cluster_id}-master"
+  source_ami_id     = var.aws_ami
+  source_ami_region = var.aws_region
+  encrypted         = true
+
+  tags = merge(
+    {
+      "Name"         = "${var.cluster_id}-master"
+      "sourceAMI"    = var.aws_ami
+      "sourceRegion" = var.aws_region
+    },
+    local.tags,
+  )
 }
-# ---------------------------
-#      module.iam.infrastructure_id
-#      module.iam.clustername
-#      module.iam.ocp_master_instance_profile_id
-#      module.iam.ocp_worker_instance_profile_id
-# ---------------------------
+
 module "bootstrap" {
-  source = "./6_bootstrap"
-  aws_region =  var.aws_region
-  aws_azs =  var.aws_azs
-  default_tags =  var.default_tags
-  ami =  var.ami
-  aws_access_key_id =  var.aws_access_key_id
-  aws_secret_access_key =  var.aws_secret_access_key
-  infrastructure_id =  local.infrastructure_id
-  clustername =  var.clustername
-  private_vpc_id =  module.private_network.private_vpc_id
-  private_vpc_private_subnet_ids =  module.private_network.private_vpc_private_subnet_ids
-  domain =  var.domain
-  cluster_network_cidr =  var.cluster_network_cidr
-  cluster_network_host_prefix =  var.cluster_network_host_prefix
-  service_network_cidr =  var.service_network_cidr
-  bootstrap =  var.bootstrap
-  control_plane =  var.control_plane
-  worker =  var.worker
-  openshift_pull_secret =  var.openshift_pull_secret
-  use_worker_machinesets =  var.use_worker_machinesets
-  openshift_installer_url =  var.openshift_installer_url
-  ocp_control_plane_security_group_id =  module.security_group.ocp_control_plane_security_group_id
-  ocp_worker_security_group_id =  module.security_group.ocp_worker_security_group_id
-  ocp_master_instance_profile_id =  module.iam.ocp_master_instance_profile_id
-  ocp_worker_instance_profile_id =  module.iam.ocp_worker_instance_profile_id
-  ocp_control_plane_lb_int_arn =  module.load_balancer.ocp_control_plane_lb_int_arn
-  ocp_control_plane_lb_int_22623_tg_arn =  module.load_balancer.ocp_control_plane_lb_int_22623_tg_arn
-  ocp_control_plane_lb_int_6443_tg_arn =  module.load_balancer.ocp_control_plane_lb_int_6443_tg_arn
-  ocp_route53_private_zone_id =  module.dns.ocp_route53_private_zone_id
-  airgapped = var.airgapped
-  repository = module.private_network.private_ecr_repository_url
-}
-# ---------------------------
-#      module.bootstrap.clustername
-#      module.bootstrap.infrastructure_id
-#      module.bootstrap.master_ign_64
-#      module.bootstrap.worker_ign_64
-#      module.bootstrap.private_ssh_key
-#      module.bootstrap.public_ssh_key
-# ---------------------------
-module "control_plane" {
-  source = "./7_control_plane"
-  aws_region =  var.aws_region
-  aws_azs =  var.aws_azs
-  default_tags =  var.default_tags
-  ami =  var.ami
-  infrastructure_id =  local.infrastructure_id
-  clustername =  var.clustername
-  private_vpc_id =  module.private_network.private_vpc_id
-  private_vpc_private_subnet_ids =  module.private_network.private_vpc_private_subnet_ids
-  domain =  var.domain
-  control_plane =  var.control_plane
-  worker =  var.worker
-  openshift_pull_secret =  var.openshift_pull_secret
-  use_worker_machinesets =  var.use_worker_machinesets
-  ocp_control_plane_security_group_id =  module.security_group.ocp_control_plane_security_group_id
-  ocp_worker_security_group_id =  module.security_group.ocp_worker_security_group_id
-  ocp_master_instance_profile_id =  module.iam.ocp_master_instance_profile_id
-  ocp_worker_instance_profile_id =  module.iam.ocp_worker_instance_profile_id
-  ocp_control_plane_lb_int_arn =  module.load_balancer.ocp_control_plane_lb_int_arn
-  ocp_control_plane_lb_int_22623_tg_arn =  module.load_balancer.ocp_control_plane_lb_int_22623_tg_arn
-  ocp_control_plane_lb_int_6443_tg_arn =  module.load_balancer.ocp_control_plane_lb_int_6443_tg_arn
-  ocp_route53_private_zone_id =  module.dns.ocp_route53_private_zone_id
-  master_ign_64 =  module.bootstrap.master_ign_64
-  worker_ign_64 =  module.bootstrap.worker_ign_64
+  source = "./bootstrap"
+
+  ami                      = aws_ami_copy.main.id
+  instance_type            = var.aws_bootstrap_instance_type
+  cluster_id               = var.cluster_id
+  ignition                 = module.installer.bootstrap_ign
+  subnet_id                = var.aws_publish_strategy == "External" ? module.vpc.az_to_public_subnet_id[var.aws_master_availability_zones[0]] : module.vpc.az_to_private_subnet_id[var.aws_master_availability_zones[0]]
+  target_group_arns        = module.vpc.aws_lb_target_group_arns
+  target_group_arns_length = module.vpc.aws_lb_target_group_arns_length
+  vpc_id                   = module.vpc.vpc_id
+  vpc_cidrs                = module.vpc.vpc_cidrs
+  vpc_security_group_ids   = [module.vpc.master_sg_id]
+  publish_strategy         = var.aws_publish_strategy
+
+  tags = local.tags
 }
-# ---------------------------
-#      module.control_plane.clustername
-#      module.control_plane.infrastructure_id
-# ---------------------------
-# module post install - waiting for aws load balancer
-#
-module "postinstall" {
-  source = "./8_postinstall"
-  aws_region =  var.aws_region
-  aws_azs =  var.aws_azs
-  default_tags =  var.default_tags
-  infrastructure_id =  module.control_plane.infrastructure_id
-  clustername =  module.control_plane.clustername
-  domain =  var.domain
+
+module "masters" {
+  source = "./master"
+
+  cluster_id    = var.cluster_id
+  instance_type = var.aws_master_instance_type
+
+  tags = local.tags
+
+  availability_zones       = var.aws_master_availability_zones
+  az_to_subnet_id          = module.vpc.az_to_private_subnet_id
+  instance_count           = var.master_count
+  master_sg_ids            = [module.vpc.master_sg_id]
+  root_volume_iops         = var.aws_master_root_volume_iops
+  root_volume_size         = var.aws_master_root_volume_size
+  root_volume_type         = var.aws_master_root_volume_type
+  target_group_arns        = module.vpc.aws_lb_target_group_arns
+  target_group_arns_length = module.vpc.aws_lb_target_group_arns_length
+  ec2_ami                  = aws_ami_copy.main.id
+  user_data_ign            = module.installer.master_ign
+  publish_strategy         = var.aws_publish_strategy
 }
diff --git a/master/main.tf b/master/main.tf
new file mode 100644
index 0000000..6a74f78
--- /dev/null
+++ b/master/main.tf
@@ -0,0 +1,140 @@
+locals {
+  arn = "aws"
+
+  // Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot use a dynamic list for count
+  // and therefore are force to implicitly assume that the list is of aws_lb_target_group_arns_length - 1, in case there is no api_external
+  target_group_arns_length = var.publish_strategy == "External" ? var.target_group_arns_length : var.target_group_arns_length - 1
+}
+
+resource "aws_iam_instance_profile" "master" {
+  name = "${var.cluster_id}-master-profile"
+
+  role = aws_iam_role.master_role.name
+}
+
+resource "aws_iam_role" "master_role" {
+  name = "${var.cluster_id}-master-role"
+  path = "/"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-master-role"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_iam_role_policy" "master_policy" {
+  name = "${var.cluster_id}-master-policy"
+  role = aws_iam_role.master_role.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "ec2:*",
+      "Resource": "*",
+      "Effect": "Allow"
+    },
+    {
+      "Action": "iam:PassRole",
+      "Resource": "*",
+      "Effect": "Allow"
+    },
+    {
+      "Action" : [
+        "s3:GetObject"
+      ],
+      "Resource": "arn:${local.arn}:s3:::*",
+      "Effect": "Allow"
+    },
+    {
+      "Action": "elasticloadbalancing:*",
+      "Resource": "*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+
+}
+
+resource "aws_network_interface" "master" {
+  count     = var.instance_count
+  subnet_id = var.az_to_subnet_id[var.availability_zones[count.index]]
+  
+  security_groups = var.master_sg_ids
+  
+  tags = merge(
+    {
+    "Name" = "${var.cluster_id}-master-${count.index}"
+    },
+    var.tags,
+  )
+}
+  
+resource "aws_instance" "master" {
+  count = var.instance_count
+  ami   = var.ec2_ami
+
+  iam_instance_profile = aws_iam_instance_profile.master.name
+  instance_type        = var.instance_type
+  user_data            = var.user_data_ign
+
+  network_interface {
+    network_interface_id = aws_network_interface.master[count.index].id
+    device_index         = 0
+  }
+
+  lifecycle {
+    # Ignore changes in the AMI which force recreation of the resource. This
+    # avoids accidental deletion of nodes whenever a new CoreOS Release comes
+    # out.
+    ignore_changes = [ami]
+  }
+
+  tags = merge(
+    {
+    "Name" = "${var.cluster_id}-master-${count.index}"
+    },
+    var.tags,
+  )
+
+  root_block_device {
+    volume_type = var.root_volume_type
+    volume_size = var.root_volume_size
+    iops        = var.root_volume_type == "io1" ? var.root_volume_iops : 0
+  }
+
+  volume_tags = merge(
+    {
+    "Name" = "${var.cluster_id}-master-${count.index}-vol"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_lb_target_group_attachment" "master" {
+  count = var.instance_count * local.target_group_arns_length
+
+  target_group_arn = var.target_group_arns[count.index % local.target_group_arns_length]
+  target_id        = aws_instance.master[floor(count.index / local.target_group_arns_length)].private_ip
+}
+
diff --git a/master/outputs.tf b/master/outputs.tf
new file mode 100644
index 0000000..06c0653
--- /dev/null
+++ b/master/outputs.tf
@@ -0,0 +1,4 @@
+output "ip_addresses" {
+  value = aws_network_interface.master.*.private_ips
+}
+
diff --git a/master/variables.tf b/master/variables.tf
new file mode 100644
index 0000000..8ff122e
--- /dev/null
+++ b/master/variables.tf
@@ -0,0 +1,82 @@
+variable "availability_zones" {
+  type        = list(string)
+  description = "List of the availability zones in which to create the masters. The length of this list must match instance_count."
+}
+
+variable "az_to_subnet_id" {
+  type        = map(string)
+  description = "Map from availability zone name to the ID of the subnet in that availability zone"
+}
+
+variable "cluster_id" {
+  type = string
+}
+
+variable "instance_type" {
+  type = string
+}
+
+variable "ec2_ami" {
+  type    = string
+  default = ""
+}
+
+variable "instance_count" {
+  type = string
+}
+
+variable "kubeconfig_content" {
+  type    = string
+  default = ""
+}
+
+variable "master_sg_ids" {
+  type        = list(string)
+  description = "The security group IDs to be applied to the master nodes."
+}
+
+variable "root_volume_iops" {
+  type        = string
+  description = "The amount of provisioned IOPS for the root block device."
+}
+
+variable "root_volume_size" {
+  type        = string
+  description = "The size of the volume in gigabytes for the root block device."
+}
+
+variable "root_volume_type" {
+  type        = string
+  description = "The type of volume for the root block device."
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS tags to be applied to created resources."
+}
+
+variable "target_group_arns" {
+  type        = list(string)
+  default     = []
+  description = "The list of target group ARNs for the load balancer."
+}
+
+variable "target_group_arns_length" {
+  description = "The length of the 'target_group_arns' variable, to work around https://github.com/hashicorp/terraform/issues/12570."
+}
+
+variable "user_data_ign" {
+  type = string
+}
+
+variable "publish_strategy" {
+  type        = string
+  description = <<EOF
+The publishing strategy for endpoints like load balancers.
+
+Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot use a dynamic list for count
+and therefore are force to implicitly assume that the list is of aws_lb_target_group_arns_length - 1, in case there is no api_external. And that's where this variable
+helps to decide if the target_group_arns is of length (target_group_arns_length) or (target_group_arns_length - 1)
+EOF
+}
diff --git a/openshift_pull_secret.json b/openshift_pull_secret.json
new file mode 100644
index 0000000..a433c27
--- /dev/null
+++ b/openshift_pull_secret.json
@@ -0,0 +1 @@
+{"auths":{"cloud.openshift.com":{"auth":"b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K3ZidWRpdXNpYm1jb20xbm1qOXVlYXV0eXp6NmVmNDBveGRrdmVxZWw6Q003MVZNQlUxQVIzVENCTVU0MFpPSjRBUzZZVFlBSExQQzhVVk5LU0EzS1BHWTcwVlhaTkZLREdWT0dDV0VPUA==","email":"vbudi@us.ibm.com"},"quay.io":{"auth":"b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K3ZidWRpdXNpYm1jb20xbm1qOXVlYXV0eXp6NmVmNDBveGRrdmVxZWw6Q003MVZNQlUxQVIzVENCTVU0MFpPSjRBUzZZVFlBSExQQzhVVk5LU0EzS1BHWTcwVlhaTkZLREdWT0dDV0VPUA==","email":"vbudi@us.ibm.com"},"registry.connect.redhat.com":{"auth":"NTI1ODU3Mzd8dWhjLTFObWo5VUVhVVRZeno2ZWY0ME9YRGtWZXFlbDpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSmlaR1poTTJGaU1EWmhORFUwTmpoa09UYzBaRFEwWVRGbU16RTFNMlkwWWlKOS5TV04zUWs2d2I2dkp4REw5a3dKTWM4dDdYV2dSWG5sLXI1M3VwUEp5eWlDd2d6S1RlUzl4cE9CT21hQXFqOS01Q3puNFZvRHV6cmJSaEcxV2ttZTBjSVZlRDFiOFNxNmhDYV85OVByMzEwaHRhWmNGNlNNN2wxMEVieXFzVnZRWXoya2hTc3hGOUxWdUZOMVVIZHdFYlhpM1RNRGRra0taVlhRdklpVDIzb3ZTWm1HZjdTVVZ4a3kxWklNUjFNck85aDRxYW5ERDRTQkxLRjlDQ3B3cXNIOWJDZzZQMlBBTExjSFoxMjhOeHg3RUJuUW1BVHdNREszVkFyQmlvMkE0ZWE3MWpya2plLXNyeTZ6bWxxdVFqc09EZFRlcTN6c0VnQm1kVjhrRGxZTGx1clZ6YlJjbTN5ZmJVSEppLVBUY284WTlQeERkYlNLZVI4WUZsT19WYlFfQ2xjNkYtWGtOa1hUZzh2MzJ2WDdfR1ZfUzg2ZG5BSVBNN1dJbGdla3o2VWp2bGl1UEg1a0ZMWkk2VnVTS3J3TlV1czZCR0dhQkwwSmNsSk1yLU8wU2IwYkswR2Fmd2JpVUF6cS00WEFMcG9WLWtZbWFKOElwMWRYa2dJUWpMOW9SUXc4c1p0ZGppSFRDOGlNOEZEVjVKMDd3Zl96NXM4akJoQ0Rpal92XzZtOE12V2FDOFNqaUVjcXc1d1FTOTBFYUdzQ000Q01hR3VkZ3NFRmt5TE9TMW1LbGhjaFBvdGJydlh1Ukpxb0haQlAtRC1icDVFc055YlExOWxlRUhzYW9fUHJIUU9ueUcyS05wZUVXSlhvT2lCRmNORUhESC02Y1pfWkVxSHFqcS1aREV6N0JRVWNDUm9WTG9uQkYwQ1pDaVNpb0VmMlZqaHlZTVgtam4zWQ==","email":"vbudi@us.ibm.com"},"registry.redhat.io":{"auth":"NTI1ODU3Mzd8dWhjLTFObWo5VUVhVVRZeno2ZWY0ME9YRGtWZXFlbDpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSmlaR1poTTJGaU1EWmhORFUwTmpoa09UYzBaRFEwWVRGbU16RTFNMlkwWWlKOS5TV04zUWs2d2I2dkp4REw5a3dKTWM4dDdYV2dSWG5sLXI1M3VwUEp5eWlDd2d6S1RlUzl4cE9CT21hQXFqOS01Q3puNFZvRHV6cmJSaEcxV2ttZTBjSVZlRDFiOFNxNmhDYV85OVByMzEwaHRhWmNGNlNNN2wxMEVieXFzVnZRWXoya2hTc3hGOUxWdUZOMVVIZHdFYlhpM1RNRGRra0taVlhRdklpVDIzb3ZTWm1HZjdTVVZ4a3kxWklNUjFNck85aDRxYW5ERDRTQkxLRjlDQ3B3cXNIOWJDZzZQMlBBTExjSFoxMjhOeHg3RUJuUW1BVHdNREszVkFyQmlvMkE0ZWE3MWpya2plLXNyeTZ6bWxxdVFqc09EZFRlcTN6c0VnQm1kVjhrRGxZTGx1clZ6YlJjbTN5ZmJVSEppLVBUY284WTlQeERkYlNLZVI4WUZsT19WYlFfQ2xjNkYtWGtOa1hUZzh2MzJ2WDdfR1ZfUzg2ZG5BSVBNN1dJbGdla3o2VWp2bGl1UEg1a0ZMWkk2VnVTS3J3TlV1czZCR0dhQkwwSmNsSk1yLU8wU2IwYkswR2Fmd2JpVUF6cS00WEFMcG9WLWtZbWFKOElwMWRYa2dJUWpMOW9SUXc4c1p0ZGppSFRDOGlNOEZEVjVKMDd3Zl96NXM4akJoQ0Rpal92XzZtOE12V2FDOFNqaUVjcXc1d1FTOTBFYUdzQ000Q01hR3VkZ3NFRmt5TE9TMW1LbGhjaFBvdGJydlh1Ukpxb0haQlAtRC1icDVFc055YlExOWxlRUhzYW9fUHJIUU9ueUcyS05wZUVXSlhvT2lCRmNORUhESC02Y1pfWkVxSHFqcS1aREV6N0JRVWNDUm9WTG9uQkYwQ1pDaVNpb0VmMlZqaHlZTVgtam4zWQ==","email":"vbudi@us.ibm.com"}}}
diff --git a/output.tf b/output.tf
deleted file mode 100644
index e98e20f..0000000
--- a/output.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-
-output "clustername" {
-    value =  var.clustername
-}
-
-output "infrastructure_id" {
-    value =  local.infrastructure_id
-}
-
-output "domain" {
-    value =  var.domain
-}
diff --git a/route53/base.tf b/route53/base.tf
new file mode 100644
index 0000000..681b0e6
--- /dev/null
+++ b/route53/base.tf
@@ -0,0 +1,95 @@
+locals {
+
+  // Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot count 0/1
+  // based on if api_external_lb_dns_name for example, which will be null when there is no external lb for API.
+  // So publish_strategy serves an coordinated proxy for that decision.
+  public_endpoints = var.publish_strategy == "External" ? true : false
+}
+
+data "aws_route53_zone" "public" {
+  count = local.public_endpoints ? 1 : 0
+
+  name = var.base_domain
+}
+
+resource "aws_route53_zone" "int" {
+  name          = var.cluster_domain
+  force_destroy = true
+
+  vpc {
+    vpc_id = var.vpc_id
+  }
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-int"
+    },
+    var.tags,
+  )
+
+  depends_on = [aws_route53_record.api_external]
+}
+
+resource "aws_route53_record" "api_external" {
+  count = local.public_endpoints ? 1 : 0
+
+  zone_id = data.aws_route53_zone.public[0].zone_id
+  name    = "api.${var.cluster_domain}"
+  type    = "A"
+
+  alias {
+    name                   = var.api_external_lb_dns_name
+    zone_id                = var.api_external_lb_zone_id
+    evaluate_target_health = false
+  }
+}
+
+resource "aws_route53_record" "api_internal" {
+  zone_id = aws_route53_zone.int.zone_id
+  name    = "api-int.${var.cluster_domain}"
+  type    = "A"
+
+  alias {
+    name                   = var.api_internal_lb_dns_name
+    zone_id                = var.api_internal_lb_zone_id
+    evaluate_target_health = false
+  }
+}
+
+resource "aws_route53_record" "api_external_internal_zone" {
+  zone_id = aws_route53_zone.int.zone_id
+  name    = "api.${var.cluster_domain}"
+  type    = "A"
+
+  alias {
+    name                   = var.api_internal_lb_dns_name
+    zone_id                = var.api_internal_lb_zone_id
+    evaluate_target_health = false
+  }
+}
+
+resource "aws_route53_record" "etcd_a_nodes" {
+  count   = var.etcd_count
+  type    = "A"
+  ttl     = "60"
+  zone_id = aws_route53_zone.int.zone_id
+  name    = "etcd-${count.index}.${var.cluster_domain}"
+  # TF-UPGRADE-TODO: In Terraform v0.10 and earlier, it was sometimes necessary to
+  # force an interpolation expression to be interpreted as a list by wrapping it
+  # in an extra set of list brackets. That form was supported for compatibilty in
+  # v0.11, but is no longer supported in Terraform v0.12.
+  #
+  # If the expression in the following list itself returns a list, remove the
+  # brackets to avoid interpretation as a list of lists. If the expression
+  # returns a single list item then leave it as-is and remove this TODO comment.
+  records = [var.etcd_ip_addresses[count.index]]
+}
+
+resource "aws_route53_record" "etcd_cluster" {
+  type    = "SRV"
+  ttl     = "60"
+  zone_id = aws_route53_zone.int.zone_id
+  name    = "_etcd-server-ssl._tcp"
+  records = formatlist("0 10 2380 %s", aws_route53_record.etcd_a_nodes.*.fqdn)
+}
+
diff --git a/route53/variables.tf b/route53/variables.tf
new file mode 100644
index 0000000..0674692
--- /dev/null
+++ b/route53/variables.tf
@@ -0,0 +1,66 @@
+variable "cluster_domain" {
+  description = "The domain for the cluster that all DNS records must belong"
+  type        = string
+}
+
+variable "etcd_count" {
+  description = "The number of etcd members."
+  type        = string
+}
+
+variable "etcd_ip_addresses" {
+  description = "List of string IPs for machines running etcd members."
+  type        = list(string)
+  default     = []
+}
+
+variable "base_domain" {
+  description = "The base domain used for public records."
+  type        = string
+}
+
+variable "vpc_id" {
+  description = "The VPC used to create the private route53 zone."
+}
+
+variable "cluster_id" {
+  type        = string
+  description = "The identifier for the cluster."
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS tags to be applied to created resources."
+}
+
+variable "api_external_lb_dns_name" {
+  description = "External API's LB DNS name"
+  type        = string
+}
+
+variable "api_external_lb_zone_id" {
+  description = "External API's LB Zone ID"
+  type        = string
+}
+
+variable "api_internal_lb_dns_name" {
+  description = "Internal API's LB DNS name"
+  type        = string
+}
+
+variable "api_internal_lb_zone_id" {
+  description = "Internal API's LB Zone ID"
+  type        = string
+}
+
+variable "publish_strategy" {
+  type        = string
+  description = <<EOF
+The publishing strategy for endpoints like load balancers
+
+Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot count 0/1
+based on if api_external_lb_dns_name for example, which will be null when there is no external lb for API.
+So publish_strategy serves an coordinated proxy for that decision.
+EOF
+}
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
deleted file mode 100644
index 34b4ff6..0000000
--- a/terraform.tfvars.example
+++ /dev/null
@@ -1,21 +0,0 @@
-aws_region = "us-east-2"
-aws_azs = ["a", "b", "c"]
-default_tags = { "owner" = "ocp42" }
-infrastructure_id = "ocp42-abcde"
-clustername = "ocp42"
-private_vpc_cidr = "10.10.0.0/16"
-vpc_private_subnet_cidrs = ["10.10.10.0/24","10.10.11.0/24","10.10.12.0/24"]
-vpc_public_subnet_cidrs = ["10.10.20.0/24","10.10.21.0/24","10.10.22.0/24"]
-domain = "example.com"
-ami = "ami-0bc59aaa7363b805d"
-aws_access_key_id = ""
-aws_secret_access_key = ""
-cluster_network_cidr = "192.168.0.0/17"
-cluster_network_host_prefix = "23"
-service_network_cidr = "192.168.128.0/24"
-bootstrap = { type = "i3.xlarge" }
-control_plane = { count = "3" , type = "m4.xlarge", disk = "120" }
-use_worker_machinesets = true
-# worker = {        count = "3" , type = "m4.large" , disk = "120" }
-openshift_pull_secret = "./openshift_pull_secret.json"
-openshift_installer_url = "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest"
diff --git a/variables-aws.tf b/variables-aws.tf
new file mode 100644
index 0000000..0710490
--- /dev/null
+++ b/variables-aws.tf
@@ -0,0 +1,93 @@
+variable "aws_config_version" {
+  description = <<EOF
+(internal) This declares the version of the AWS configuration variables.
+It has no impact on generated assets but declares the version contract of the configuration.
+EOF
+
+  default = "1.0"
+}
+
+variable "aws_bootstrap_instance_type" {
+  type = string
+  description = "Instance type for the bootstrap node. Example: `m4.large`."
+}
+
+variable "aws_master_instance_type" {
+  type = string
+  description = "Instance type for the master node(s). Example: `m4.large`."
+}
+
+variable "aws_ami" {
+  type = string
+  description = "AMI for all nodes.  An encrypted copy of this AMI will be used.  Example: `ami-foobar123`."
+}
+
+variable "aws_extra_tags" {
+  type = map(string)
+
+  description = <<EOF
+(optional) Extra AWS tags to be applied to created resources.
+
+Example: `{ "key" = "value", "foo" = "bar" }`
+EOF
+
+  default = {}
+}
+
+variable "aws_master_root_volume_type" {
+  type        = string
+  description = "The type of volume for the root block device of master nodes."
+}
+
+variable "aws_master_root_volume_size" {
+  type        = string
+  description = "The size of the volume in gigabytes for the root block device of master nodes."
+}
+
+variable "aws_master_root_volume_iops" {
+  type = string
+
+  description = <<EOF
+The amount of provisioned IOPS for the root block device of master nodes.
+Ignored if the volume type is not io1.
+EOF
+
+}
+
+variable "aws_region" {
+  type = string
+  description = "The target AWS region for the cluster."
+}
+
+variable "aws_master_availability_zones" {
+  type = list(string)
+  description = "The availability zones in which to create the masters. The length of this list must match master_count."
+}
+
+variable "aws_worker_availability_zones" {
+  type = list(string)
+  description = "The availability zones to provision for workers.  Worker instances are created by the machine-API operator, but this variable controls their supporting infrastructure (subnets, routing, etc.)."
+}
+
+variable "aws_vpc" {
+  type = string
+  default = null
+  description = "(optional) An existing network (VPC ID) into which the cluster should be installed."
+}
+
+variable "aws_public_subnets" {
+  type = list(string)
+  default = null
+  description = "(optional) Existing public subnets into which the cluster should be installed."
+}
+
+variable "aws_private_subnets" {
+  type = list(string)
+  default = null
+  description = "(optional) Existing private subnets into which the cluster should be installed."
+}
+
+variable "aws_publish_strategy" {
+  type = string
+  description = "The cluster publishing strategy, either Internal or External"
+}
diff --git a/variables.tf b/variables.tf
deleted file mode 100644
index 25527ce..0000000
--- a/variables.tf
+++ /dev/null
@@ -1,22 +0,0 @@
-variable "aws_region" { default = "us-east-2" }
-variable "aws_azs" { default = ["a", "b", "c"] }
-variable "default_tags" { default = {} }
-variable "infrastructure_id" {  }
-variable "clustername" { }
-variable "private_vpc_cidr" { default = "10.10.0.0/16" }
-variable "domain" { }
-variable "vpc_private_subnet_cidrs" { default = ["10.10.10.0/24","10.10.11.0/24","10.10.12.0/24"] }
-variable "vpc_public_subnet_cidrs" { default = ["10.10.20.0/24","10.10.21.0/24","10.10.22.0/24"] }
-variable "ami" { default = "ami-0bc59aaa7363b805d" }
-variable "aws_access_key_id" {  }
-variable "aws_secret_access_key" {  }
-variable "cluster_network_cidr" { default = "192.168.0.0/17" }
-variable "cluster_network_host_prefix" { default = "23" }
-variable "service_network_cidr" { default = "192.168.128.0/24" }
-variable "bootstrap" { default = { type = "i3.xlarge"} }
-variable "control_plane" { default = { count = "3", type = "m4.xlarge", disk = "120"} }
-variable "worker" {        default = { count = "3", type = "m4.large",  disk = "120"} }
-variable "openshift_pull_secret" { default = "./openshift_pull_secret.json" }
-variable "use_worker_machinesets" { default = true }
-variable "openshift_installer_url" { default = "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest" }
-variable "airgapped" { default = false }
diff --git a/vpc/common.tf b/vpc/common.tf
new file mode 100644
index 0000000..1f585f3
--- /dev/null
+++ b/vpc/common.tf
@@ -0,0 +1,25 @@
+# Canonical internal state definitions for this module.
+# read only: only locals and data source definitions allowed. No resources or module blocks in this file
+
+locals {
+  public_endpoints = var.publish_strategy == "External" ? true : false
+}
+
+# all data sources should be input variable-agnostic and used as canonical source for querying "state of resources" and building outputs
+# (ie: we don't want "aws.new_vpc" and "data.aws_vpc.cluster_vpc", just "data.aws_vpc.cluster_vpc" used everwhere).
+
+data "aws_vpc" "cluster_vpc" {
+  id = var.vpc == null ? aws_vpc.new_vpc[0].id : var.vpc
+}
+
+data "aws_subnet" "public" {
+  count = var.public_subnets == null ? length(var.availability_zones) : length(var.public_subnets)
+
+  id = var.public_subnets == null ? aws_subnet.public_subnet[count.index].id : var.public_subnets[count.index]
+}
+
+data "aws_subnet" "private" {
+  count = var.private_subnets == null ? length(var.availability_zones) : length(var.private_subnets)
+
+  id = var.private_subnets == null ? aws_subnet.private_subnet[count.index].id : var.private_subnets[count.index]
+}
diff --git a/vpc/master-elb.tf b/vpc/master-elb.tf
new file mode 100644
index 0000000..fcf9fd0
--- /dev/null
+++ b/vpc/master-elb.tf
@@ -0,0 +1,156 @@
+resource "aws_lb" "api_internal" {
+  name                             = "${var.cluster_id}-int"
+  load_balancer_type               = "network"
+  subnets                          = data.aws_subnet.private.*.id
+  internal                         = true
+  enable_cross_zone_load_balancing = true
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-int"
+    },
+    var.tags,
+  )
+
+  timeouts {
+    create = "20m"
+  }
+
+  depends_on = [aws_internet_gateway.igw]
+}
+
+resource "aws_lb" "api_external" {
+  count = local.public_endpoints ? 1 : 0
+
+  name                             = "${var.cluster_id}-ext"
+  load_balancer_type               = "network"
+  subnets                          = data.aws_subnet.public.*.id
+  internal                         = false
+  enable_cross_zone_load_balancing = true
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-ext"
+    },
+    var.tags,
+  )
+
+  timeouts {
+    create = "20m"
+  }
+
+  depends_on = [aws_internet_gateway.igw]
+}
+
+resource "aws_lb_target_group" "api_internal" {
+  name     = "${var.cluster_id}-aint"
+  protocol = "TCP"
+  port     = 6443
+  vpc_id   = data.aws_vpc.cluster_vpc.id
+
+  target_type = "ip"
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-aint"
+    },
+    var.tags,
+  )
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 10
+    port                = 6443
+    protocol            = "HTTPS"
+    path                = "/readyz"
+  }
+}
+
+resource "aws_lb_target_group" "api_external" {
+  count = local.public_endpoints ? 1 : 0
+
+  name     = "${var.cluster_id}-aext"
+  protocol = "TCP"
+  port     = 6443
+  vpc_id   = data.aws_vpc.cluster_vpc.id
+
+  target_type = "ip"
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-aext"
+    },
+    var.tags,
+  )
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 10
+    port                = 6443
+    protocol            = "HTTPS"
+    path                = "/readyz"
+  }
+}
+
+resource "aws_lb_target_group" "services" {
+  name     = "${var.cluster_id}-sint"
+  protocol = "TCP"
+  port     = 22623
+  vpc_id   = data.aws_vpc.cluster_vpc.id
+
+  target_type = "ip"
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-sint"
+    },
+    var.tags,
+  )
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 10
+    port                = 22623
+    protocol            = "HTTPS"
+    path                = "/healthz"
+  }
+}
+
+resource "aws_lb_listener" "api_internal_api" {
+  load_balancer_arn = aws_lb.api_internal.arn
+  protocol          = "TCP"
+  port              = "6443"
+
+  default_action {
+    target_group_arn = aws_lb_target_group.api_internal.arn
+    type             = "forward"
+  }
+}
+
+resource "aws_lb_listener" "api_internal_services" {
+  load_balancer_arn = aws_lb.api_internal.arn
+  protocol          = "TCP"
+  port              = "22623"
+
+  default_action {
+    target_group_arn = aws_lb_target_group.services.arn
+    type             = "forward"
+  }
+}
+
+resource "aws_lb_listener" "api_external_api" {
+  count = local.public_endpoints ? 1 : 0
+
+  load_balancer_arn = aws_lb.api_external[0].arn
+  protocol          = "TCP"
+  port              = "6443"
+
+  default_action {
+    target_group_arn = aws_lb_target_group.api_external[0].arn
+    type             = "forward"
+  }
+}
+
diff --git a/vpc/outputs.tf b/vpc/outputs.tf
new file mode 100644
index 0000000..8f41010
--- /dev/null
+++ b/vpc/outputs.tf
@@ -0,0 +1,66 @@
+output "vpc_id" {
+  value = data.aws_vpc.cluster_vpc.id
+}
+
+output "vpc_cidrs" {
+  value = [data.aws_vpc.cluster_vpc.cidr_block]
+}
+
+output "az_to_private_subnet_id" {
+  value = zipmap(data.aws_subnet.private.*.availability_zone, data.aws_subnet.private.*.id)
+}
+
+output "az_to_public_subnet_id" {
+  value = zipmap(data.aws_subnet.public.*.availability_zone, data.aws_subnet.public.*.id)
+}
+
+output "public_subnet_ids" {
+  value = data.aws_subnet.public.*.id
+}
+
+output "private_subnet_ids" {
+  value = data.aws_subnet.private.*.id
+}
+
+output "master_sg_id" {
+  value = aws_security_group.master.id
+}
+
+output "worker_sg_id" {
+  value = aws_security_group.worker.id
+}
+
+output "aws_lb_target_group_arns" {
+  // The order of the list is very important because the consumers assume the 3rd item is the external aws_lb_target_group
+  // Because of the issue https://github.com/hashicorp/terraform/issues/12570, the consumers cannot use a dynamic list for count
+  // and therefore are force to implicitly assume that the list is of aws_lb_target_group_arns_length - 1, in case there is no api_external
+  value = compact(
+    concat(
+      aws_lb_target_group.api_internal.*.arn,
+      aws_lb_target_group.services.*.arn,
+      aws_lb_target_group.api_external.*.arn,
+    ),
+  )
+}
+
+output "aws_lb_target_group_arns_length" {
+  // 2 for private endpoints and 1 for public endpoints
+  value = "3"
+}
+
+output "aws_lb_api_external_dns_name" {
+  value = local.public_endpoints ? aws_lb.api_external[0].dns_name : null
+}
+
+output "aws_lb_api_external_zone_id" {
+  value = local.public_endpoints ? aws_lb.api_external[0].zone_id : null
+}
+
+output "aws_lb_api_internal_dns_name" {
+  value = aws_lb.api_internal.dns_name
+}
+
+output "aws_lb_api_internal_zone_id" {
+  value = aws_lb.api_internal.zone_id
+}
+
diff --git a/vpc/sg-master.tf b/vpc/sg-master.tf
new file mode 100644
index 0000000..3078c92
--- /dev/null
+++ b/vpc/sg-master.tf
@@ -0,0 +1,274 @@
+resource "aws_security_group" "master" {
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  timeouts {
+    create = "20m"
+  }
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-master-sg"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_security_group_rule" "master_mcs" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol    = "tcp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = 22623
+  to_port     = 22623
+}
+
+resource "aws_security_group_rule" "master_egress" {
+  type              = "egress"
+  security_group_id = aws_security_group.master.id
+
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+}
+
+resource "aws_security_group_rule" "master_ingress_icmp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol    = "icmp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = -1
+  to_port     = -1
+}
+
+resource "aws_security_group_rule" "master_ingress_ssh" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol    = "tcp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = 22
+  to_port     = 22
+}
+
+resource "aws_security_group_rule" "master_ingress_https" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol    = "tcp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = 6443
+  to_port     = 6443
+}
+
+resource "aws_security_group_rule" "master_ingress_vxlan" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 4789
+  to_port   = 4789
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_vxlan_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 4789
+  to_port   = 4789
+}
+
+resource "aws_security_group_rule" "master_ingress_geneve" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 6081
+  to_port   = 6081
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_geneve_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 6081
+  to_port   = 6081
+}
+
+resource "aws_security_group_rule" "master_ingress_ovndb" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 6641
+  to_port   = 6642
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_ovndb_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 6641
+  to_port   = 6642
+}
+
+resource "aws_security_group_rule" "master_ingress_internal" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 9000
+  to_port   = 9999
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_internal_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 9000
+  to_port   = 9999
+}
+
+resource "aws_security_group_rule" "master_ingress_internal_udp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 9000
+  to_port   = 9999
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_internal_from_worker_udp" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 9000
+  to_port   = 9999
+}
+
+resource "aws_security_group_rule" "master_ingress_kube_scheduler" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 10259
+  to_port   = 10259
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_kube_scheduler_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 10259
+  to_port   = 10259
+}
+
+resource "aws_security_group_rule" "master_ingress_kube_controller_manager" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 10257
+  to_port   = 10257
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_kube_controller_manager_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 10257
+  to_port   = 10257
+}
+
+resource "aws_security_group_rule" "master_ingress_kubelet_secure" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 10250
+  to_port   = 10250
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_kubelet_secure_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 10250
+  to_port   = 10250
+}
+
+resource "aws_security_group_rule" "master_ingress_etcd" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 2379
+  to_port   = 2380
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_services_tcp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 30000
+  to_port   = 32767
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_services_tcp_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 30000
+  to_port   = 32767
+}
+
+resource "aws_security_group_rule" "master_ingress_services_udp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 30000
+  to_port   = 32767
+  self      = true
+}
+
+resource "aws_security_group_rule" "master_ingress_services_udp_from_worker" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.master.id
+  source_security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 30000
+  to_port   = 32767
+}
diff --git a/vpc/sg-worker.tf b/vpc/sg-worker.tf
new file mode 100644
index 0000000..55ab6f9
--- /dev/null
+++ b/vpc/sg-worker.tf
@@ -0,0 +1,184 @@
+resource "aws_security_group" "worker" {
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  timeouts {
+    create = "20m"
+  }
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-worker-sg"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_security_group_rule" "worker_egress" {
+  type              = "egress"
+  security_group_id = aws_security_group.worker.id
+
+  from_port   = 0
+  to_port     = 0
+  protocol    = "-1"
+  cidr_blocks = ["0.0.0.0/0"]
+}
+
+resource "aws_security_group_rule" "worker_ingress_icmp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol    = "icmp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = -1
+  to_port     = -1
+}
+
+resource "aws_security_group_rule" "worker_ingress_ssh" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol    = "tcp"
+  cidr_blocks = [data.aws_vpc.cluster_vpc.cidr_block]
+  from_port   = 22
+  to_port     = 22
+}
+
+resource "aws_security_group_rule" "worker_ingress_vxlan" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 4789
+  to_port   = 4789
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_vxlan_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 4789
+  to_port   = 4789
+}
+
+resource "aws_security_group_rule" "worker_ingress_geneve" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 6081
+  to_port   = 6081
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_geneve_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 6081
+  to_port   = 6081
+}
+
+resource "aws_security_group_rule" "worker_ingress_internal" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 9000
+  to_port   = 9999
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_internal_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 9000
+  to_port   = 9999
+}
+
+resource "aws_security_group_rule" "worker_ingress_internal_udp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 9000
+  to_port   = 9999
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_internal_from_master_udp" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 9000
+  to_port   = 9999
+}
+
+resource "aws_security_group_rule" "worker_ingress_kubelet_insecure" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 10250
+  to_port   = 10250
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_kubelet_insecure_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 10250
+  to_port   = 10250
+}
+
+resource "aws_security_group_rule" "worker_ingress_services_tcp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "tcp"
+  from_port = 30000
+  to_port   = 32767
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_services_tcp_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "tcp"
+  from_port = 30000
+  to_port   = 32767
+}
+
+resource "aws_security_group_rule" "worker_ingress_services_udp" {
+  type              = "ingress"
+  security_group_id = aws_security_group.worker.id
+
+  protocol  = "udp"
+  from_port = 30000
+  to_port   = 32767
+  self      = true
+}
+
+resource "aws_security_group_rule" "worker_ingress_services_udp_from_master" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.worker.id
+  source_security_group_id = aws_security_group.master.id
+
+  protocol  = "udp"
+  from_port = 30000
+  to_port   = 32767
+}
diff --git a/vpc/variables.tf b/vpc/variables.tf
new file mode 100644
index 0000000..220a21c
--- /dev/null
+++ b/vpc/variables.tf
@@ -0,0 +1,43 @@
+variable "availability_zones" {
+  type        = list(string)
+  description = "The availability zones in which to provision subnets."
+}
+
+variable "cidr_block" {
+  type = string
+}
+
+variable "cluster_id" {
+  type = string
+}
+
+variable "publish_strategy" {
+  type        = string
+  description = "The publishing strategy for endpoints like load balancers"
+}
+
+variable "region" {
+  type        = string
+  description = "The target AWS region for the cluster."
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS tags to be applied to created resources."
+}
+
+variable "vpc" {
+  type        = string
+  description = "An existing network (VPC ID) into which the cluster should be installed."
+}
+
+variable "public_subnets" {
+  type        = list(string)
+  description = "Existing public subnets into which the cluster should be installed."
+}
+
+variable "private_subnets" {
+  type        = list(string)
+  description = "Existing private subnets into which the cluster should be installed."
+}
diff --git a/vpc/vpc-private.tf b/vpc/vpc-private.tf
new file mode 100644
index 0000000..15f98bf
--- /dev/null
+++ b/vpc/vpc-private.tf
@@ -0,0 +1,50 @@
+resource "aws_route_table" "private_routes" {
+  count = var.private_subnets == null ? length(var.availability_zones) : 0
+
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-private-${var.availability_zones[count.index]}"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_route" "to_nat_gw" {
+  count = var.private_subnets == null ? length(var.availability_zones) : 0
+
+  route_table_id         = aws_route_table.private_routes[count.index].id
+  destination_cidr_block = "0.0.0.0/0"
+  nat_gateway_id         = element(aws_nat_gateway.nat_gw.*.id, count.index)
+  depends_on             = [aws_route_table.private_routes]
+
+  timeouts {
+    create = "20m"
+  }
+}
+
+resource "aws_subnet" "private_subnet" {
+  count = var.private_subnets == null ? length(var.availability_zones) : 0
+
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  cidr_block = cidrsubnet(local.new_private_cidr_range, 3, count.index)
+
+  availability_zone = var.availability_zones[count.index]
+
+  tags = merge(
+    {
+      "Name"                            = "${var.cluster_id}-private-${var.availability_zones[count.index]}"
+      "kubernetes.io/role/internal-elb" = ""
+    },
+    var.tags,
+  )
+}
+
+resource "aws_route_table_association" "private_routing" {
+  count = var.private_subnets == null ? length(var.availability_zones) : 0
+
+  route_table_id = aws_route_table.private_routes[count.index].id
+  subnet_id      = aws_subnet.private_subnet[count.index].id
+}
diff --git a/vpc/vpc-public.tf b/vpc/vpc-public.tf
new file mode 100644
index 0000000..e85ac8e
--- /dev/null
+++ b/vpc/vpc-public.tf
@@ -0,0 +1,97 @@
+resource "aws_internet_gateway" "igw" {
+  count = var.vpc == null ? 1 : 0
+
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-igw"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_route_table" "default" {
+  count = var.vpc == null ? 1 : 0
+
+  vpc_id = data.aws_vpc.cluster_vpc.id
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-public"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_main_route_table_association" "main_vpc_routes" {
+  count = var.vpc == null ? 1 : 0
+
+  vpc_id         = data.aws_vpc.cluster_vpc.id
+  route_table_id = aws_route_table.default[0].id
+}
+
+resource "aws_route" "igw_route" {
+  count = var.vpc == null ? 1 : 0
+
+  destination_cidr_block = "0.0.0.0/0"
+  route_table_id         = aws_route_table.default[0].id
+  gateway_id             = aws_internet_gateway.igw[0].id
+
+  timeouts {
+    create = "20m"
+  }
+}
+
+resource "aws_subnet" "public_subnet" {
+  count = var.public_subnets == null ? length(var.availability_zones) : 0
+
+  vpc_id            = data.aws_vpc.cluster_vpc.id
+  cidr_block        = cidrsubnet(local.new_public_cidr_range, 3, count.index)
+  availability_zone = var.availability_zones[count.index]
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-public-${var.availability_zones[count.index]}"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_route_table_association" "route_net" {
+  count = var.public_subnets == null ? length(var.availability_zones) : 0
+
+  route_table_id = aws_route_table.default[0].id
+  subnet_id      = aws_subnet.public_subnet[count.index].id
+}
+
+resource "aws_eip" "nat_eip" {
+  count = var.public_subnets == null ? length(var.availability_zones) : 0
+  vpc   = true
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-eip-${var.availability_zones[count.index]}"
+    },
+    var.tags,
+  )
+
+  # Terraform does not declare an explicit dependency towards the internet gateway.
+  # this can cause the internet gateway to be deleted/detached before the EIPs.
+  # https://github.com/coreos/tectonic-installer/issues/1017#issuecomment-307780549
+  depends_on = [aws_internet_gateway.igw]
+}
+
+resource "aws_nat_gateway" "nat_gw" {
+  count = var.public_subnets == null ? length(var.availability_zones) : 0
+
+  allocation_id = aws_eip.nat_eip[count.index].id
+  subnet_id     = aws_subnet.public_subnet[count.index].id
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-nat-${var.availability_zones[count.index]}"
+    },
+    var.tags,
+  )
+}
diff --git a/vpc/vpc.tf b/vpc/vpc.tf
new file mode 100644
index 0000000..a253491
--- /dev/null
+++ b/vpc/vpc.tf
@@ -0,0 +1,46 @@
+locals {
+  new_private_cidr_range = cidrsubnet(data.aws_vpc.cluster_vpc.cidr_block, 1, 1)
+  new_public_cidr_range  = cidrsubnet(data.aws_vpc.cluster_vpc.cidr_block, 1, 0)
+}
+
+resource "aws_vpc" "new_vpc" {
+  count = var.vpc == null ? 1 : 0
+
+  cidr_block           = var.cidr_block
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = merge(
+    {
+      "Name" = "${var.cluster_id}-vpc"
+    },
+    var.tags,
+  )
+}
+
+resource "aws_vpc_endpoint" "s3" {
+  count = var.vpc == null ? 1 : 0
+
+  vpc_id       = data.aws_vpc.cluster_vpc.id
+  service_name = "com.amazonaws.${var.region}.s3"
+  route_table_ids = concat(
+    aws_route_table.private_routes.*.id,
+    aws_route_table.default.*.id,
+  )
+}
+
+resource "aws_vpc_dhcp_options" "main" {
+  count = var.vpc == null ? 1 : 0
+
+  domain_name         = var.region == "us-east-1" ? "ec2.internal" : format("%s.compute.internal", var.region)
+  domain_name_servers = ["AmazonProvidedDNS"]
+
+  tags = var.tags
+}
+
+resource "aws_vpc_dhcp_options_association" "main" {
+  count = var.vpc == null ? 1 : 0
+
+  vpc_id          = data.aws_vpc.cluster_vpc.id
+  dhcp_options_id = aws_vpc_dhcp_options.main[0].id
+}