diff --git a/.example.env b/.example.env
new file mode 100644
index 0000000..2cb6bad
--- /dev/null
+++ b/.example.env
@@ -0,0 +1,7 @@
+ENV=dev
+AWS_REGION=us-west-2
+STATE_BUCKET_NAME=ghgc-features-tf-state-bucket
+PROJECT_NAME=ghgc-features-api
+REGISTRY_NAME=ghgc-features-api-registry
+SERVICE_PORT=8080
+VPC_ID=
diff --git a/.github/actions/terraform-deploy/action.yml b/.github/actions/terraform-deploy/action.yml
new file mode 100644
index 0000000..0d436db
--- /dev/null
+++ b/.github/actions/terraform-deploy/action.yml
@@ -0,0 +1,59 @@
+name: Deploy
+inputs:
+  env_aws_secret_name:
+    required: true
+    type: string
+  env-file:
+    type: string
+    default: ".env"
+  dir:
+    required: false
+    type: string
+    default: "."
+  script_path:
+    type: string
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.10"
+        cache: "pip"
+
+    - name: Install python dependencies
+      shell: bash
+      working-directory: ${{ inputs.dir }}
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install boto3
+
+    - name: Get relevant environment configuration from aws secrets
+      shell: bash
+      working-directory: ${{ inputs.dir }}
+      run: |
+        if [[ -z "${{ inputs.script_path }}" ]]; then
+        ./scripts/sync-env.sh ${{ inputs.env_aws_secret_name }}
+        else
+        python ${{ inputs.script_path }} --secret-id ${{ inputs.env_aws_secret_name }}
+        source ${{ inputs.env-file }}
+        echo "PREFIX=feature-api-${STAGE}" >> ${{ inputs.env-file }}
+        echo "REGISTRY_NAME=feature-api-${STAGE}" >> ${{ inputs.env-file }}
+        echo "ENV=${STAGE}" >> ${{ inputs.env-file }}
+        echo "PROJECT_NAME=veda-${STAGE}" >> ${{ inputs.env-file }}
+        fi
+
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v2
+      with:
+        terraform_version: 1.3.9
+
+    - name: Deploy
+      shell: bash
+      working-directory: ${{ inputs.dir }}
+      run: |
+        bash ./scripts/deploy.sh .env <<< init
+        bash ./scripts/deploy.sh .env <<< deploy
+
diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
new file mode 100644
index 0000000..5a2f99f
--- /dev/null
+++ b/.github/workflows/cicd.yml
@@ -0,0 +1,60 @@
+name: CICD 🚀
+
+permissions:
+  id-token: write
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+      - production
+      - update-workflows
+
+jobs:
+  define-environment:
+    name: Set ✨ environment ✨
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set the environment based on the branch
+        id: define_environment
+        run: |
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "env_name=staging" >> $GITHUB_OUTPUT
+          elif [ "${{ github.ref }}" = "refs/heads/dev" ]; then
+            echo "env_name=development" >> $GITHUB_OUTPUT
+          elif [ "${{ github.ref }}" = "refs/heads/production" ]; then
+            echo "env_name=production" >> $GITHUB_OUTPUT
+          elif [ "${{ github.ref }}" = "refs/heads/update-workflows" ]; then
+            echo "env_name=development" >> $GITHUB_OUTPUT
+          fi
+      - name: Print the environment
+        run: echo "The environment is ${{ steps.define_environment.outputs.env_name }}"
+
+    outputs:
+      env_name: ${{ steps.define_environment.outputs.env_name }}
+
+  deploy:
+    name: Deploy to ${{ needs.define-environment.outputs.env_name }} 🚀
+    runs-on: ubuntu-latest
+    needs: [define-environment]
+    if: ${{ needs.define-environment.outputs.env_name }}
+    environment: ${{ needs.define-environment.outputs.env_name }}
+    concurrency: ${{ needs.define-environment.outputs.env_name }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.DEPLOYMENT_ROLE_ARN }}
+          role-session-name: "ghgc-features-api-github-${{ needs.define-environment.outputs.env_name }}-deployment"
+          aws-region: "us-west-2"
+
+      - name: Run deployment
+        uses: "./.github/actions/terraform-deploy"
+        with:
+          env_aws_secret_name: ${{ secrets.ENV_AWS_SECRET_NAME }}
diff --git a/README.md b/README.md
index f48cd6e..8add51e 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
-# VEDA Features API
+# GHGC Features API
 
-Hosting and serving collections of vector data features for VEDA
+Hosting and serving collections of vector data features for GHGC
 
 ---
 
diff --git a/db/Dockerfile b/db/Dockerfile
new file mode 100644
index 0000000..8cc4921
--- /dev/null
+++ b/db/Dockerfile
@@ -0,0 +1,13 @@
+FROM --platform=linux/amd64 public.ecr.aws/lambda/python:3.9
+
+# WORKDIR /tmp
+
+RUN pip install boto3 requests "urllib3<2" psycopg["binary"] -t "${LAMBDA_TASK_ROOT}"
+
+COPY ./handler.py ${LAMBDA_TASK_ROOT}
+
+# https://stackoverflow.com/a/61746719
+# Turns out, asyncio is part of python
+# RUN rm -rf /asset/asyncio*
+
+CMD ["handler.handler"]
diff --git a/db/handler.py b/db/handler.py
new file mode 100644
index 0000000..16b4702
--- /dev/null
+++ b/db/handler.py
@@ -0,0 +1,200 @@
+# """Bootstrap Postgres db."""
+
+import asyncio
+import json
+
+import boto3
+import psycopg
+# import requests
+from psycopg import sql
+from psycopg.conninfo import make_conninfo
+import os
+
+# def send(
+#     event,
+#     context,
+#     responseStatus,
+#     responseData,
+#     physicalResourceId=None,
+#     noEcho=False,
+# ):
+#     """
+#     Copyright 2016 Amazon Web Services, Inc. or its affiliates. All Rights Reserved.
+#     This file is licensed to you under the AWS Customer Agreement (the "License").
+#     You may not use this file except in compliance with the License.
+#     A copy of the License is located at http://aws.amazon.com/agreement/ .
+#     This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied.
+#     See the License for the specific language governing permissions and limitations under the License.
+
+#     Send response from AWS Lambda.
+
+#     Note: The cfnresponse module is available only when you use the ZipFile property to write your source code.
+#     It isn't available for source code that's stored in Amazon S3 buckets.
+#     For code in buckets, you must write your own functions to send responses.
+#     """
+#     responseUrl = event["ResponseURL"]
+
+#     print(responseUrl)
+
+#     responseBody = {}
+#     responseBody["Status"] = responseStatus
+#     responseBody["Reason"] = (
+#         "See the details in CloudWatch Log Stream: " + context.log_stream_name
+#     )
+#     responseBody["PhysicalResourceId"] = physicalResourceId or context.log_stream_name
+#     responseBody["StackId"] = event["StackId"]
+#     responseBody["RequestId"] = event["RequestId"]
+#     responseBody["LogicalResourceId"] = event["LogicalResourceId"]
+#     responseBody["NoEcho"] = noEcho
+#     responseBody["Data"] = responseData
+
+#     json_responseBody = json.dumps(responseBody)
+
+#     print("Response body:\n" + json_responseBody)
+
+#     headers = {"content-type": "", "content-length": str(len(json_responseBody))}
+
+#     try:
+#         response = requests.put(responseUrl, data=json_responseBody, headers=headers)
+#         print("Status code: " + response.reason)
+#     except Exception as e:
+#         print("send(..) failed executing requests.put(..): " + str(e))
+
+
+def get_secret(secret_name):
+    """Get Secrets from secret manager."""
+    print(f"Fetching {secret_name}...")
+    client = boto3.client(service_name="secretsmanager")
+    response = client.get_secret_value(SecretId=secret_name)
+    return json.loads(response["SecretString"])
+
+
+def create_db(cursor, db_name: str) -> None:
+    """Create DB."""
+    cursor.execute(
+        sql.SQL("SELECT 1 FROM pg_catalog.pg_database " "WHERE datname = %s"), [db_name]
+    )
+    if cursor.fetchone():
+        print(f"database {db_name} exists, not creating DB")
+    else:
+        print(f"database {db_name} not found, creating...")
+        cursor.execute(
+            sql.SQL("CREATE DATABASE {db_name}").format(db_name=sql.Identifier(db_name))
+        )
+
+
+def create_user(cursor, username: str, password: str) -> None:
+    """Create User."""
+    cursor.execute(
+        sql.SQL(
+            "DO $$ "
+            "BEGIN "
+            "  IF NOT EXISTS ( "
+            "       SELECT 1 FROM pg_roles "
+            "       WHERE rolname = {user}) "
+            "  THEN "
+            "    CREATE USER {username} "
+            "    WITH PASSWORD {password}; "
+            "  ELSE "
+            "    ALTER USER {username} "
+            "    WITH PASSWORD {password}; "
+            "  END IF; "
+            "END "
+            "$$; "
+        ).format(username=sql.Identifier(username), password=password, user=username)
+    )
+
+
+def create_permissions(cursor, db_name: str, username: str) -> None:
+    """Add permissions."""
+    cursor.execute(
+        sql.SQL(
+            "GRANT CONNECT ON DATABASE {db_name} TO {username};"
+            "GRANT CREATE ON DATABASE {db_name} TO {username};"  # Allow schema creation
+            "GRANT USAGE ON SCHEMA public TO {username};"
+            "ALTER DEFAULT PRIVILEGES IN SCHEMA public "
+            "GRANT ALL PRIVILEGES ON TABLES TO {username};"
+            "ALTER DEFAULT PRIVILEGES IN SCHEMA public "
+            "GRANT ALL PRIVILEGES ON SEQUENCES TO {username};"
+        ).format(
+            db_name=sql.Identifier(db_name),
+            username=sql.Identifier(username),
+        )
+    )
+
+
+def register_extensions(cursor) -> None:
+    """Add PostGIS extension."""
+    cursor.execute(sql.SQL("CREATE EXTENSION IF NOT EXISTS postgis;"))
+
+
+def handler(event, context):
+    """Lambda Handler."""
+    print(f"Event: {event}")
+
+    if event["tf"]["action"] not in ["create", "update"]:
+        print("failed")
+        return 0
+        # return send(event, context, "SUCCESS", {"msg": "No action to be taken"})
+
+    try:
+        connection_params = get_secret(os.environ['CONN_SECRET_ARN'])
+        user_params = event["user_params"]
+        print("Connecting to DB...")
+        con_str = make_conninfo(
+            dbname=connection_params.get("dbname", "postgres"),
+            user=connection_params["username"],
+            password=connection_params["password"],
+            host=connection_params["host"],
+            port=connection_params["port"],
+        )
+        with psycopg.connect(con_str, autocommit=True) as conn:
+            with conn.cursor() as cur:
+                print("Creating database...")
+                create_db(
+                    cursor=cur,
+                    db_name=user_params["dbname"],
+                )
+
+                print("Creating user...")
+                create_user(
+                    cursor=cur,
+                    username=user_params["username"],
+                    password=user_params["password"],
+                )
+
+                print("Setting permissions...")
+                create_permissions(
+                    cursor=cur,
+                    db_name=user_params["dbname"],
+                    username=user_params["username"],
+                )
+
+        # Install extensions on the user DB with
+        # superuser permissions, since they will
+        # otherwise fail to install when run as
+        # the non-superuser within the pgstac
+        # migrations.
+        print("Connecting to DB...")
+        con_str = make_conninfo(
+            dbname=user_params["dbname"],
+            user=connection_params["username"],
+            password=connection_params["password"],
+            host=connection_params["host"],
+            port=connection_params["port"],
+        )
+        with psycopg.connect(con_str, autocommit=True) as conn:
+            with conn.cursor() as cur:
+                print("Registering PostGIS ...")
+                register_extensions(cursor=cur)
+
+    except Exception as e:
+        print(e)
+        return {
+        'message' : e
+        }
+    
+    print("Event Complete")
+    return {
+        'message' : connection_params
+    }
\ No newline at end of file
diff --git a/docs/IACHOWTO.md b/docs/IACHOWTO.md
index 82c6162..287a448 100644
--- a/docs/IACHOWTO.md
+++ b/docs/IACHOWTO.md
@@ -22,6 +22,8 @@ $ tfenv use 1.3.9
 5. we also use Terraform "workspaces" so our infra state stays nicely separated in the same S3 bucket. Some quick samples of how to interact with that:
 
 ```bash
+$ AWS_PROFILE=<account> terraform workspace new west2-staging
+
 $ AWS_PROFILE=<account> terraform workspace list        
 * default
   west2-staging
diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100644
index 0000000..91f2016
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+export TARGET_ENVIRONMENT=dev
+export TARGET_PROJECT_NAME=ghgc-features-api
+
+cd wfs3-app/
+
+aws ecr describe-repositories \
+   | jq '.repositories | map(.repositoryUri)' \
+   | grep $TARGET_PROJECT_NAME | grep $TARGET_ENVIRONMENT \
+   | xargs -I {} bash -c "aws ecr get-login-password | docker login --username AWS --password-stdin {}"
+
+aws ecr describe-repositories \
+    | jq '.repositories | map(.repositoryUri)' \
+    | grep $TARGET_PROJECT_NAME | grep $TARGET_ENVIRONMENT \
+    | sed -E 's/"|,//g' \
+    | xargs -I {} docker build -t {}:latest ../wfs3-app/
+
+aws ecr describe-repositories \
+    | jq '.repositories | map(.repositoryUri)' \
+    | grep $TARGET_PROJECT_NAME | grep $TARGET_ENVIRONMENT \
+    | sed -E 's/"|,//g' \
+    | xargs -I {} docker images --format "{{json . }}" {} \
+    | grep '"Tag":"latest"' \
+    | jq '"\(.Repository):\(.Tag)"' \
+    | xargs -I{} docker push {}
\ No newline at end of file
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100644
index 0000000..4b495c1
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,86 @@
+#! /bin/bash
+# Check .env file
+
+
+DOT_ENV=$1
+
+if [ -f $DOT_ENV ]
+then
+  set -a; source $DOT_ENV; set +a
+else
+  echo "Run: ./scripts/deploy.sh <.env_file>"
+  echo "Please create $DOT_ENV file first and try again"
+  exit 1
+fi
+
+function create_state_bucket {
+  # $1 region
+  # $2 bucket_name
+
+  aws s3 mb  s3://$2  --region $1
+  aws s3api put-bucket-versioning \
+    --bucket $2 \
+    --versioning-configuration Status=Enabled
+}
+
+function generate_terraform_variables {
+  tf_vars=(tf tfvars)
+    for tf_var in "${tf_vars[@]}"; do
+    (
+      echo "cat <<EOF"
+      cat terraform.${tf_var}.tmpl
+      echo EOF
+    ) | sh > terraform.${tf_var}
+  done
+
+}
+
+function check_create_remote_state {
+  # $1 aws_region
+  # $2 bucket name
+  # $3 dynamotable_name
+  AWS_REGION=$1
+  STATE_BUCKET_NAME=$2
+
+  bucketstatus=$(aws s3api head-bucket --bucket $STATE_BUCKET_NAME  2>&1)
+
+  if echo "${bucketstatus}" | grep 'Not Found';
+  then
+        echo "Creating TF remote state"
+        create_state_bucket $AWS_REGION $STATE_BUCKET_NAME
+  elif echo "${bucketstatus}" | grep 'Forbidden';
+  then
+    echo "Bucket $STATE_BUCKET_NAME exists but not owned"
+    exit 1
+  elif echo "${bucketstatus}" | grep 'Bad Request';
+  then
+    echo "Bucket $STATE_BUCKET_NAME specified is less than 3 or greater than 63 characters"
+    exit 1
+  else
+    echo "State Bucket $STATE_BUCKET_NAME owned and exists. Continue...";
+  fi
+}
+
+
+cd ./terraform/features-api
+generate_terraform_variables
+check_create_remote_state $AWS_REGION $STATE_BUCKET_NAME
+
+read -rp 'action [init|plan|deploy]: ' ACTION
+case $ACTION in
+  init)
+    terraform init
+    ;;
+  plan)
+    terraform plan
+    ;;
+
+  deploy)
+    terraform apply --auto-approve
+    ;;
+  *)
+    echo "Choose from 'init', 'plan' or 'deploy'"
+    exit 1
+    ;;
+esac
+
diff --git a/scripts/sync-env.sh b/scripts/sync-env.sh
new file mode 100755
index 0000000..c13e14c
--- /dev/null
+++ b/scripts/sync-env.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Use this script to load environment variables for a deployment from AWS Secrets
+echo Loading environment secrets from $1
+aws secretsmanager get-secret-value --secret-id $1 --query SecretString --output text | jq -r "to_entries|map(\"\(.key)=\(.value|tostring)\")|.[]" > .env
diff --git a/terraform/veda-wfs3/.gitignore b/terraform/features-api/.gitignore
similarity index 100%
rename from terraform/veda-wfs3/.gitignore
rename to terraform/features-api/.gitignore
diff --git a/terraform/features-api/.terraform.lock.hcl b/terraform/features-api/.terraform.lock.hcl
new file mode 100644
index 0000000..16eeaeb
--- /dev/null
+++ b/terraform/features-api/.terraform.lock.hcl
@@ -0,0 +1,63 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.1.0"
+  constraints = ">= 3.29.0, ~> 5.0"
+  hashes = [
+    "h1:iDyYmwv8q94Dvr4DRG1KBxTWPZRFkRmKGa3cjCEsPZU=",
+    "zh:0c48f157b804c1f392adb5c14b81e756c652755e358096300ea8dd1283021129",
+    "zh:1a50495a6c0e5665e51df57dac6e781ec71439b11ebf05f971b6f3a3eb4eb7b2",
+    "zh:2959ff472c05e56d59e012118dd8d55022f005534c0ae961ce81136de9f66a4d",
+    "zh:2dfda9133581b99ed6e709e89a453fd2974ce88c703d3e073ec31bf99d7508ce",
+    "zh:2f3d92cc7a6624da42cee2202f8fb23e6d38f156ab7851884d637282cb0dc709",
+    "zh:3bc2a34d09cbaf439a1815846904f070c782cd8dfd60b5e0116827cda25f7549",
+    "zh:4ef43f1a247aa8de8690ac3bbc2b00ebaf6b2872fc8d0f5130e4a8130c874b87",
+    "zh:5477cb272dcaeb0030091bcf23a9f0f33b5410e44e317e9d3d49446f545dbaa4",
+    "zh:734c8fb4c0b79c82dd757566761dda5b91ee1ef9a2b848a748ade11e0e1cc69f",
+    "zh:80346c051b677f4f018da7fe06318b87c5bd0f1ec67ce78ab33baed3bb8b031a",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:a865b2f88dfee13df14116c5cf53d033d2c15855f4b59b9c65337309a928df2c",
+    "zh:c0345f266eedaece5612c1000722b302f895d1bc5af1d5a4265f0e7000ca48bb",
+    "zh:d59703c8e6a9d8b4fbd3b4583b945dfff9cb2844c762c0b3990e1cef18282279",
+    "zh:d8d04a6a6cd2dfcb23b57e551db7b15e647f6166310fb7d883d8ec67bdc9bdc8",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.1"
+  hashes = [
+    "h1:ydA0/SNRVB1o95btfshvYsmxA+jZFRZcvKzZSB+4S1M=",
+    "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840",
+    "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb",
+    "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5",
+    "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238",
+    "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc",
+    "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970",
+    "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2",
+    "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5",
+    "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f",
+    "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version = "3.5.1"
+  hashes = [
+    "h1:IL9mSatmwov+e0+++YX2V6uel+dV6bn+fC/cnGDK3Ck=",
+    "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
+    "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
+    "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
+    "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
+    "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
+    "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
+    "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
+    "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
+    "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
+    "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
+  ]
+}
diff --git a/terraform/features-api/dns.tf b/terraform/features-api/dns.tf
new file mode 100644
index 0000000..ebde0e6
--- /dev/null
+++ b/terraform/features-api/dns.tf
@@ -0,0 +1,34 @@
+# data "aws_route53_zone" "zone" {
+#   provider = aws.west2
+#   name     = var.dns_zone_name
+# }
+
+# resource "aws_acm_certificate" "cert" {
+#   provider          = aws.west2
+#   domain_name       = "*.${data.aws_route53_zone.zone.name}"
+#   validation_method = "DNS"
+#   tags              = var.tags
+
+#   lifecycle {
+#     create_before_destroy = true
+#   }
+# }
+
+# resource "aws_route53_record" "subdomain_record" {
+#   provider = aws.west2
+#   name     = "${var.dns_subdomain}.${data.aws_route53_zone.zone.name}"
+#   zone_id  = data.aws_route53_zone.zone.id
+#   type     = "A"
+
+#   alias {
+#     name                   = aws_alb.alb_ecs.dns_name
+#     zone_id                = aws_alb.alb_ecs.zone_id
+#     evaluate_target_health = true
+#   }
+# }
+
+# resource "aws_lb_listener_certificate" "cert" {
+#   provider        = aws.west2
+#   listener_arn    = aws_alb_listener.alb_listener_ecs.arn
+#   certificate_arn = aws_acm_certificate.cert.arn
+# }
\ No newline at end of file
diff --git a/terraform/features-api/ecr.tf b/terraform/features-api/ecr.tf
new file mode 100644
index 0000000..64a239d
--- /dev/null
+++ b/terraform/features-api/ecr.tf
@@ -0,0 +1,57 @@
+module "ecr_registry_wfs" {
+  source                   = "github.com/developmentseed/tf-seed/modules/aws_ecr"
+  environment              = var.env
+  registry_name            = var.project_name
+  enable_registry_scanning = true
+  mutable_image_tags       = true
+  enable_deploy_user       = false
+  iam_deploy_username = null
+  tags                     = var.tags
+}
+
+module "ecr_registry_db" {
+  source                   = "github.com/developmentseed/tf-seed/modules/aws_ecr"
+  environment              = var.env
+  registry_name            = "${var.project_name}-db"
+  enable_registry_scanning = true
+  mutable_image_tags       = true
+  enable_deploy_user       = false
+  iam_deploy_username = null
+  tags                     = var.tags
+}
+
+resource "null_resource" "build_ecr_image_wfs" {
+  triggers = {
+    folder_path = sha1(join("", [for f in fileset("../../wfs3-app", "**") : filesha1("../../wfs3-app/${f}")]))
+    # handler_file_path = filemd5("../../wfs3-app/fast_api_main.py")
+    # docker_file_path  = filemd5("../../wfs3-app/Dockerfile")
+  }
+
+  provisioner "local-exec" {
+    command = <<EOF
+          cd ../../wfs3-app
+          aws ecr get-login-password --region ${var.region} | docker login --username AWS --password-stdin ${module.ecr_registry_wfs.repository_url}
+          docker build -t ${module.ecr_registry_wfs.repository_url}:latest .
+          docker push ${module.ecr_registry_wfs.repository_url}:latest
+          cd -
+       EOF
+  }
+}
+
+resource "null_resource" "build_ecr_image_db_init" {
+  triggers = {
+    folder_path = sha1(join("", [for f in fileset("../../db", "**") : filesha1("../../db/${f}")]))
+    # handler_file_path = filemd5("../../db/handler.py")
+    # docker_file_path  = filemd5("../../db/Dockerfile")
+  }
+
+  provisioner "local-exec" {
+    command = <<EOF
+          cd ../../db
+          aws ecr get-login-password --region ${var.region} | docker login --username AWS --password-stdin ${module.ecr_registry_db.repository_url}
+          docker build -t ${module.ecr_registry_db.repository_url}:latest .
+          docker push ${module.ecr_registry_db.repository_url}:latest
+          cd -
+       EOF
+  }
+}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/ecs_api.tf b/terraform/features-api/ecs_api.tf
similarity index 64%
rename from terraform/veda-wfs3/ecs_api.tf
rename to terraform/features-api/ecs_api.tf
index a791f6e..66c9e3b 100644
--- a/terraform/veda-wfs3/ecs_api.tf
+++ b/terraform/features-api/ecs_api.tf
@@ -1,9 +1,20 @@
+data "aws_subnets" "private" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+
+  tags = {
+    "Scope" = "private"
+  }
+}
+
 module "ecs_cluster" {
-  source = "../modules/aws_ecs_service"
+  source      = "../modules/aws_ecs_service"
   environment = var.env
   region      = var.region
-  vpc_id      = module.networking.vpc_id
-  subnet_ids  = module.networking.private_subnets_id
+  vpc_id      = var.vpc_id
+  subnet_ids  = data.aws_subnets.private.ids
 
   service_name       = "${var.project_name}-service"
   service_port       = var.service_port
@@ -18,11 +29,11 @@ module "ecs_cluster" {
 
   container_secrets = [
     {
-      name = "AWS_CONFIG"
+      name      = "AWS_CONFIG"
       valueFrom = aws_secretsmanager_secret.config.arn
     },
     {
-      name = "DB_CONFIG"
+      name      = "DB_CONFIG"
       valueFrom = aws_secretsmanager_secret.db_config.arn
     },
   ]
@@ -37,55 +48,57 @@ module "ecs_cluster" {
       value = "True"
     },
     {
-      name = "OTEL_PROPAGATORS"
+      name  = "OTEL_PROPAGATORS"
       value = "xray"
     },
     {
-      name = "OTEL_PYTHON_ID_GENERATOR"
+      name  = "OTEL_PYTHON_ID_GENERATOR"
       value = "xray"
     },
     {
-      name = "OTEL_RESOURCE_ATTRIBUTES"
+      name  = "OTEL_RESOURCE_ATTRIBUTES"
       value = "service.name=veda-wfs3-${var.env}"
     },
     {
-      name = "OTEL_RESOURCE_ATTRIBUTES"
+      name  = "OTEL_RESOURCE_ATTRIBUTES"
       value = "service.name=veda-wfs3-${var.env}"
     },
     {
-      name = "OTEL_TRACES_SAMPLER"
+      name  = "OTEL_TRACES_SAMPLER"
       value = "traceidratio"
     },
     {
-      name = "OTEL_TRACES_SAMPLER_ARG"
+      name  = "OTEL_TRACES_SAMPLER_ARG"
       value = "0.5"
     },
     {
-      name = "FORWARDED_ALLOW_IPS"
+      name  = "FORWARDED_ALLOW_IPS"
       value = "*"
     },
     {
       // stupid hack b/c of FastAPI and Starlette bug
-      name = "FAST_API_SCHEME"
-      value = var.env == "west2-staging" ? "https" : "http"
+      name  = "FAST_API_SCHEME"
+      value = "http" //quick hack for now, TODO: include 'contains' function
     }
   ]
 
-  container_ingress_cidrs = ["0.0.0.0/0"]
+  container_ingress_cidrs  = ["0.0.0.0/0"]
   container_ingress_sg_ids = []
 
-  use_adot_as_sidecar = true
-  use_ecr = true
-  ecr_repository_name = module.ecr_registry.registry_name
-  image = "${module.ecr_registry.repository_url}:latest"
+  use_adot_as_sidecar = false
+  use_ecr             = true
+  ecr_repository_name = module.ecr_registry_wfs.registry_name
+  ecr_repository_arn  = module.ecr_registry_wfs.registry_arn
+  image               = "${module.ecr_registry_wfs.repository_url}:latest"
 
-  load_balancer = true
-  lb_type = "application"
-  lb_target_group_arn = aws_alb_target_group.alb_target_group.arn
+  load_balancer        = true
+  lb_type              = "application"
+  lb_target_group_arn  = aws_alb_target_group.alb_target_group.arn
   lb_security_group_id = aws_security_group.web_inbound_sg.id
-  lb_container_port = var.service_port
+  lb_container_port    = var.service_port
 
   tags = var.tags
+  permissions_boundary_policy_name = var.permissions_boundary_policy_name
 }
 
 ##############################################################
diff --git a/terraform/features-api/github_deploy_user.tf b/terraform/features-api/github_deploy_user.tf
new file mode 100644
index 0000000..4926230
--- /dev/null
+++ b/terraform/features-api/github_deploy_user.tf
@@ -0,0 +1,32 @@
+# resource "aws_iam_user" "deploy_user" {
+#   name = "${var.project_name}-${var.env}-deploy-user"
+#   path = "/"
+#   tags = var.tags
+# }
+
+# // NOTE: we need to have extra policies added to our
+# // deploy user for Github AWS Actions to work
+# resource "aws_iam_user_policy" "deploy" {
+#   name   = "${var.registry_name}_deploy_extended"
+#   user   = aws_iam_user.deploy_user.name
+#   policy = data.aws_iam_policy_document.extended_deploy.json
+# }
+
+# data "aws_iam_policy_document" "extended_deploy" {
+#   statement {
+#     actions = [
+#       "iam:PassRole",
+#       "ecr:InitiateLayerUpload",
+#       "ecs:RegisterTaskDefinition",
+#       "ecs:DescribeServices",
+#       "ecs:UpdateService",
+#     ]
+
+#     resources = [
+#       module.ecr_registry_wfs.registry_arn,
+#       module.ecs_cluster.service_cluster_arn,
+#       module.ecs_cluster.service_arn,
+#       module.ecs_cluster.ecs_execution_role_arn,
+#     ]
+#   }
+# }
\ No newline at end of file
diff --git a/terraform/features-api/lambda.tf b/terraform/features-api/lambda.tf
new file mode 100644
index 0000000..b9789a0
--- /dev/null
+++ b/terraform/features-api/lambda.tf
@@ -0,0 +1,149 @@
+data "aws_caller_identity" "current" {}
+locals {
+  permissions_boundary = var.permissions_boundary_policy_name == "" ? null : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.permissions_boundary_policy_name}"
+}
+resource "aws_lambda_function" "lambda_init_db" {
+  code_signing_config_arn = ""
+  description             = "Lambda function to init medium DB"
+  image_uri               = "${module.ecr_registry_db.repository_url}:latest"
+  function_name           = "${var.project_name}-${var.env}-initdb-function"
+  role                    = aws_iam_role.iam_for_lambda.arn
+  package_type            = "Image"
+
+  image_config {
+    command = ["handler.handler"]
+  }
+
+  depends_on = [
+    aws_iam_role_policy.lambda_execution_role_policy,
+    aws_cloudwatch_log_group.lambda_cloudwatch_group,
+    aws_db_instance.db
+  ]
+
+  vpc_config {
+    subnet_ids         = data.aws_subnets.private.ids
+    security_group_ids = [aws_security_group.lambda-db-init.id]
+  }
+  environment {
+    variables = {
+      CONN_SECRET_ARN = aws_secretsmanager_secret.db_config.arn
+    }
+  }
+}
+
+resource "aws_lambda_invocation" "db_init" {
+  function_name = aws_lambda_function.lambda_init_db.function_name
+
+  input = jsonencode({
+    "user_params" : {
+      "username" : "username"
+      "password" : "password"
+      "dbname" : "ghgc"
+    }
+  })
+
+  # triggers = {
+  #   folder_path = sha1(join("", [for f in fileset("../../db", "*") : filesha1("../../db/${f}")]))
+  # }
+
+  # triggers = {
+  #   handler_file_path = filemd5("../../db/handler.py")
+  #   docker_file_path  = filemd5("../../db/Dockerfile")
+  # }
+
+  lifecycle_scope = "CRUD"
+  qualifier       = "$LATEST"
+}
+
+data "aws_iam_policy_document" "lambda_assume_role_policy" {
+
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+
+}
+
+data "aws_iam_policy_document" "lambda_policy" {
+  statement {
+
+    actions = [
+      "secretsmanager:DescribeSecret",
+      "secretsmanager:GetSecretValue",
+      "kms:Decrypt",
+      "ecr:SetRepositoryPolicy",
+      "ecr:GetRepositoryPolicy"
+    ]
+
+    resources = [
+      aws_secretsmanager_secret.config.arn,
+      aws_secretsmanager_secret.db_config.arn,
+      module.ecr_registry_wfs.registry_arn
+    ]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:CreateNetworkInterface",
+      "ec2:DeleteNetworkInterface",
+      "ec2:DescribeInstances",
+      "ec2:AttachNetworkInterface"
+    ]
+
+    resources = ["*"]
+  }
+
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "logs:CreateLogGroup",
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+
+    resources = ["arn:aws:logs:*:*:*"]
+  }
+
+
+  # statement {
+  #   effect = "Allow"
+
+  #   actions = [
+  #     "logs:CreateLogStream",
+  #     "logs:PutLogEvents"
+  #   ]
+
+  #   resources = [aws_cloudwatch_log_group.example.arn]
+  # }
+}
+
+resource "aws_iam_role" "iam_for_lambda" {
+  name               = "${var.project_name}-${var.env}-lambda-initdb-role"
+  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json
+  permissions_boundary = local.permissions_boundary
+}
+
+resource "aws_iam_role_policy" "lambda_execution_role_policy" {
+  name   = "${var.project_name}-${var.env}-api-access-secret-manager-lambda"
+  role   = aws_iam_role.iam_for_lambda.id
+  policy = data.aws_iam_policy_document.lambda_policy.json
+}
+
+resource "aws_cloudwatch_log_group" "lambda_cloudwatch_group" {
+  name              = "/aws/lambda/${var.project_name}-${var.env}-initdb-function"
+  retention_in_days = 1
+  tags              = var.tags
+  skip_destroy = false
+}
+
+
+
diff --git a/terraform/veda-wfs3/load_balancer_west_2.tf b/terraform/features-api/load_balancer.tf
similarity index 60%
rename from terraform/veda-wfs3/load_balancer_west_2.tf
rename to terraform/features-api/load_balancer.tf
index b9ca611..0d81ec9 100644
--- a/terraform/veda-wfs3/load_balancer_west_2.tf
+++ b/terraform/features-api/load_balancer.tf
@@ -1,9 +1,33 @@
+data "aws_subnets" "public" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+
+  tags = {
+    "Scope" = "public"
+  }
+}
+
+data "aws_security_groups" "security_groups" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+}
 
 /* security group for ALB */
 resource "aws_security_group" "web_inbound_sg" {
   name        = "tf-${var.project_name}-${var.env}-web-inbound-sg"
   description = "Allow HTTP from Anywhere into ALB"
-  vpc_id      = module.networking.vpc_id
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
 
   ingress {
     from_port   = 80
@@ -34,7 +58,7 @@ resource "aws_security_group" "web_inbound_sg" {
 resource "aws_security_group" "https_web_inbound_sg" {
   name        = "tf-${var.project_name}-${var.env}-https-web-inbound-sg"
   description = "Allow HTTPS from Anywhere into ALB"
-  vpc_id      = module.networking.vpc_id
+  vpc_id      = var.vpc_id
 
   ingress {
     from_port   = 443
@@ -64,11 +88,11 @@ resource "aws_security_group" "https_web_inbound_sg" {
 
 resource "aws_alb" "alb_ecs" {
   name            = "tf-${var.project_name}-${var.env}-alb"
-  subnets         = module.networking.public_subnets_id
-  security_groups = concat(module.networking.security_groups_ids, [aws_security_group.https_web_inbound_sg.id])
+  subnets         = data.aws_subnets.public.ids
+  security_groups = [aws_security_group.web_inbound_sg.id]
 
   tags = merge({
-    Name        = "tf-${var.project_name}-alb"
+    Name = "tf-${var.project_name}-alb"
   }, var.tags)
 }
 
@@ -76,7 +100,7 @@ resource "aws_alb_target_group" "alb_target_group" {
   name                 = "tf-${var.project_name}-${var.env}-tgp"
   port                 = var.service_port
   protocol             = "HTTP"
-  vpc_id               = module.networking.vpc_id
+  vpc_id               = var.vpc_id
   target_type          = "ip"
   deregistration_delay = 60
 
@@ -100,28 +124,27 @@ resource "aws_alb_target_group" "alb_target_group" {
   ]
 }
 
-#resource "aws_alb_listener" "alb_listener_ecs" {
-#  load_balancer_arn = aws_alb.alb_ecs.arn
-#  port              = 80
-#  protocol          = var.alb_protocol
-#  depends_on        = [aws_alb_target_group.alb_target_group]
-#
-#  default_action {
-#    target_group_arn = aws_alb_target_group.alb_target_group.arn
-#    type             = "forward"
-#  }
-#}
-
 resource "aws_alb_listener" "alb_listener_ecs" {
-  load_balancer_arn = aws_alb.alb_ecs.arn
-  port              = 443
-  protocol          = var.alb_protocol
-  ssl_policy        = "ELBSecurityPolicy-2016-08"
-  certificate_arn   = aws_acm_certificate.cert.arn
-  depends_on        = [aws_alb_target_group.alb_target_group]
-
-  default_action {
-    target_group_arn = aws_alb_target_group.alb_target_group.arn
-    type             = "forward"
-  }
-}
\ No newline at end of file
+ load_balancer_arn = aws_alb.alb_ecs.arn
+ port              = 80
+ depends_on        = [aws_alb_target_group.alb_target_group]
+ protocol = "HTTP"
+ default_action {
+   target_group_arn = aws_alb_target_group.alb_target_group.arn
+   type             = "forward"
+ }
+}
+
+# resource "aws_alb_listener" "alb_listener_ecs" {
+#   load_balancer_arn = aws_alb.alb_ecs.arn
+#   port              = 443
+#   protocol          = var.alb_protocol
+#   ssl_policy        = "ELBSecurityPolicy-2016-08"
+#   certificate_arn   = aws_acm_certificate.cert.arn
+#   depends_on        = [aws_alb_target_group.alb_target_group]
+
+#   default_action {
+#     target_group_arn = aws_alb_target_group.alb_target_group.arn
+#     type             = "forward"
+#   }
+# }
\ No newline at end of file
diff --git a/terraform/veda-wfs3/outputs.tf b/terraform/features-api/outputs.tf
similarity index 79%
rename from terraform/veda-wfs3/outputs.tf
rename to terraform/features-api/outputs.tf
index b76568d..a10a013 100644
--- a/terraform/veda-wfs3/outputs.tf
+++ b/terraform/features-api/outputs.tf
@@ -18,6 +18,6 @@ output "protocol_on_aws_alb_listener" {
   value       = aws_alb_listener.alb_listener_ecs.protocol
 }
 
-output "s3_event_bridge_lambda_arn" {
-  value = "${aws_lambda_function.lambda.arn}:${aws_lambda_function.lambda.version}"
+output "alb_url" {
+  value = "http://${aws_alb.alb_ecs.dns_name}"
 }
diff --git a/terraform/features-api/rds.tf b/terraform/features-api/rds.tf
new file mode 100644
index 0000000..a2eca28
--- /dev/null
+++ b/terraform/features-api/rds.tf
@@ -0,0 +1,65 @@
+resource "aws_db_subnet_group" "db" {
+  name       = "tf-${var.project_name}-${var.env}-subnet-group"
+  subnet_ids = data.aws_subnets.private.ids
+  tags = {
+    Name = "tf-${var.project_name}-subnet-group"
+  }
+}
+
+resource "aws_db_parameter_group" "default" {
+  name   = "tf-${var.project_name}-${var.env}-postgres14-param-group"
+  family = "postgres14"
+
+  parameter {
+    name = "work_mem"
+    # NOTE: I had `work_mem` set to ~100MB and `max_connections` around 75 and TileJSON completely failed
+    # 16MB
+    value = var.env == "staging" ? "16384" : "8192"
+  }
+
+  parameter {
+    name         = "max_connections"
+    value        = "475"
+    apply_method = "pending-reboot"
+  }
+
+  #  NOTE: here to show what shared_buffers are but doesn't really make sense why it won't provision with these
+  #  parameter {
+  #    name  = "shared_buffers"
+  #    value = var.env == "staging" ? "8064856" : "4032428"
+  #    apply_method = "pending-reboot"
+  #  }
+
+  parameter {
+    name  = "seq_page_cost"
+    value = "1"
+  }
+
+  parameter {
+    name  = "random_page_cost"
+    value = "1.2"
+  }
+}
+
+resource "aws_db_instance" "db" {
+  db_name        = "ghgc"
+  identifier     = "${var.project_name}-${var.env}"
+  engine         = "postgres"
+  engine_version = "14.3"
+  // https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
+  allocated_storage           = 100
+  max_allocated_storage       = 500
+  storage_type                = "gp2"
+  instance_class              = var.env == "staging" ? "db.r5.xlarge" : "db.r5.large"
+  db_subnet_group_name        = aws_db_subnet_group.db.name
+  skip_final_snapshot         = true
+  apply_immediately           = true
+  backup_retention_period     = 7
+  vpc_security_group_ids      = [aws_security_group.default_sg.id]
+  username                    = "postgres"
+  password                    = random_password.master_password.result
+  allow_major_version_upgrade = true
+  parameter_group_name        = aws_db_parameter_group.default.name
+}
+
+
diff --git a/terraform/veda-wfs3/secret_manager.tf b/terraform/features-api/secret_manager.tf
similarity index 52%
rename from terraform/veda-wfs3/secret_manager.tf
rename to terraform/features-api/secret_manager.tf
index 49ef400..34205c7 100644
--- a/terraform/veda-wfs3/secret_manager.tf
+++ b/terraform/features-api/secret_manager.tf
@@ -13,16 +13,37 @@ resource "random_id" "sm_suffix" {
   byte_length = 2
 }
 
+resource "random_password" "master_password" {
+  length  = 16
+  special = false
+}
+
 resource "aws_secretsmanager_secret" "config" {
-  name                    = "aws-config-${random_id.sm_suffix.hex}"
-  kms_key_id              = data.aws_kms_key.secretsmanager.id
-  tags                    = var.tags
+  name       = "aws-config-${random_id.sm_suffix.hex}"
+  kms_key_id = data.aws_kms_key.secretsmanager.id
+  tags       = var.tags
+  recovery_window_in_days = 0
 }
 
 resource "aws_secretsmanager_secret" "db_config" {
-  name                    = "veda-wfs3-${var.env}-db-config-v3"
-  kms_key_id              = data.aws_kms_key.secretsmanager.id
-  tags                    = var.tags
+  name       = "${var.project_name}-wfs3-${var.env}-db-secrets"
+  kms_key_id = data.aws_kms_key.secretsmanager.id
+  tags       = var.tags
+  recovery_window_in_days = 0
+}
+
+resource "aws_secretsmanager_secret_version" "db_credentials" {
+  secret_id     = aws_secretsmanager_secret.db_config.id
+  secret_string = <<EOF
+{
+  "username": "${aws_db_instance.db.username}",
+  "password": "${random_password.master_password.result}",
+  "engine": "${aws_db_instance.db.engine}",
+  "host": "${aws_db_instance.db.address}",
+  "port": "${aws_db_instance.db.port}",
+  "dbname": "${aws_db_instance.db.db_name}"
+}
+EOF
 }
 
 ########################################################################
diff --git a/terraform/features-api/security_group.tf b/terraform/features-api/security_group.tf
new file mode 100644
index 0000000..568282a
--- /dev/null
+++ b/terraform/features-api/security_group.tf
@@ -0,0 +1,68 @@
+resource "aws_security_group" "default_sg" {
+  name   = "$${var.project_name}-${var.env}-default-sg"
+  vpc_id = var.vpc_id
+  egress {
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+}
+
+resource "aws_security_group" "lambda-db-init" {
+  name   = "${var.project_name}-${var.env}-lambda-db-init"
+  vpc_id = var.vpc_id
+  egress {
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+}
+
+resource "aws_security_group_rule" "ecs_service_port_addon" {
+  description              = "opened for ECS service port"
+  type                     = "ingress"
+  from_port                = var.service_port
+  to_port                  = var.service_port
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.default_sg.id
+  source_security_group_id = aws_security_group.default_sg.id
+
+  lifecycle {
+    # Necessary if changing 'name' or 'name_prefix' properties.
+    create_before_destroy = true
+  }
+}
+
+resource "aws_security_group_rule" "rds_ingress_addon" {
+  description              = "Allow ESC to talk to RDS"
+  type                     = "ingress"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.default_sg.id
+  source_security_group_id = module.ecs_cluster.service_security_group_id
+
+  lifecycle {
+    # Necessary if changing 'name' or 'name_prefix' properties.
+    create_before_destroy = true
+  }
+}
+
+resource "aws_security_group_rule" "rds_ingress_lambda" {
+  description              = "Allow Lambda to talk to RDS"
+  type                     = "ingress"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.default_sg.id
+  source_security_group_id = aws_security_group.lambda-db-init.id
+
+  lifecycle {
+    # Necessary if changing 'name' or 'name_prefix' properties.
+    create_before_destroy = true
+  }
+}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/init.tf b/terraform/features-api/terraform.tf
similarity index 66%
rename from terraform/veda-wfs3/init.tf
rename to terraform/features-api/terraform.tf
index ef5e99c..b57e150 100644
--- a/terraform/veda-wfs3/init.tf
+++ b/terraform/features-api/terraform.tf
@@ -13,12 +13,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
   }
   backend "s3" {
-    bucket         = "veda-wfs3-tf-state-bucket"
-    key            = "root"
-    region         = "us-west-1"
+    bucket = "ghgc-smce-tf-shared-state"
+    key    = "root/features-api"
+    region = "us-west-2"
   }
 }
diff --git a/terraform/features-api/terraform.tf.tmpl b/terraform/features-api/terraform.tf.tmpl
new file mode 100644
index 0000000..646acac
--- /dev/null
+++ b/terraform/features-api/terraform.tf.tmpl
@@ -0,0 +1,24 @@
+provider "aws" {
+  alias  = "west1"
+  region = "us-west-1"
+}
+
+provider "aws" {
+  alias  = "west2"
+  region = "us-west-2"
+}
+
+terraform {
+  required_version = "1.3.9"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+  backend "s3" {
+    bucket = "${STATE_BUCKET_NAME}"
+    key    = "root/features-api"
+    region = "${AWS_REGION}"
+  }
+}
diff --git a/terraform/features-api/terraform.tfvars b/terraform/features-api/terraform.tfvars
new file mode 100644
index 0000000..18f1643
--- /dev/null
+++ b/terraform/features-api/terraform.tfvars
@@ -0,0 +1,6 @@
+region             = "us-west-2"
+registry_name      = "feature-api-pre-dev"
+env                = "pre-dev"
+project_name       = "veda-pre-dev"
+service_port       = 8080
+vpc_id = "vpc-0c6727f22063d860f"
diff --git a/terraform/features-api/terraform.tfvars.tmpl b/terraform/features-api/terraform.tfvars.tmpl
new file mode 100644
index 0000000..fd1d991
--- /dev/null
+++ b/terraform/features-api/terraform.tfvars.tmpl
@@ -0,0 +1,7 @@
+region             = "${AWS_REGION}"
+registry_name      = "${REGISTRY_NAME}"
+env                = "${ENV}"
+project_name       = "${PROJECT_NAME}"
+service_port       = ${SERVICE_PORT:-8080}
+vpc_id = "${VPC_ID}"
+permissions_boundary_policy_name = "${PERMISSIONS_BOUNDARY_POLICY_NAME}"
diff --git a/terraform/features-api/variables.tf b/terraform/features-api/variables.tf
new file mode 100755
index 0000000..7354246
--- /dev/null
+++ b/terraform/features-api/variables.tf
@@ -0,0 +1,58 @@
+variable "region" {
+}
+
+variable "registry_name" {
+}
+
+variable "env" {
+}
+
+variable "project_name" {
+}
+
+variable "tags" {
+  type        = map(any)
+  default     = {"project": "ghgc", "service": "ghgc-features-api-dev"}
+  description = "Optional tags to add to resources"
+}
+
+variable "availability_zones" {
+  type        = list(any)
+  description = "The az that the resources will be launched"
+  default = ["us-west-2a", "us-west-2b"]
+}
+
+variable "service_port" {
+  default = 8080
+}
+
+# Key/Value default to prevent task definitions from stopping at runtime
+variable "default_secret" {
+  default = {
+    noop : "noop"
+  }
+  type = map(any)
+}
+
+# variable "db_password" {
+#   description = "RDS root user password"
+#   type        = string
+#   sensitive   = true
+# }
+
+variable "dns_zone_name" {
+  default = null
+}
+
+variable "dns_subdomain" {
+  default = null
+}
+
+variable "alb_protocol" {
+  default = "HTTP"
+}
+
+variable "vpc_id" {}
+variable "permissions_boundary_policy_name" {
+  default = ""
+}
\ No newline at end of file
diff --git a/terraform/modules/aws_ecs_service/container_definition.json b/terraform/modules/aws_ecs_service/container_definition.tftpl
similarity index 100%
rename from terraform/modules/aws_ecs_service/container_definition.json
rename to terraform/modules/aws_ecs_service/container_definition.tftpl
diff --git a/terraform/modules/aws_ecs_service/main.tf b/terraform/modules/aws_ecs_service/main.tf
index 1a2666c..aa5684d 100755
--- a/terraform/modules/aws_ecs_service/main.tf
+++ b/terraform/modules/aws_ecs_service/main.tf
@@ -1,12 +1,15 @@
 ########################################################################
 # Data Bits
 ########################################################################
-data "aws_ecr_repository" "service" {
-  count = var.use_ecr ? 1 : 0
-  name  = var.ecr_repository_name
+# data "aws_ecr_repository" "service" {
+#   count = var.use_ecr ? 1 : 0
+#   name  = var.ecr_repository_name
+# }
+
+data "aws_caller_identity" "current" {}
+locals {
+  permissions_boundary = var.permissions_boundary_policy_name == "" ? null : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.permissions_boundary_policy_name}"
 }
-
-
 ########################################################################
 # IAM
 ########################################################################
@@ -25,6 +28,7 @@ resource "aws_iam_role" "ecs_execution_role" {
   name               = "${var.service_name}-${var.environment}_ecs_task_execution_role"
   assume_role_policy = data.aws_iam_policy_document.ecs_assume_role_policy.json
   tags               = var.tags
+  permissions_boundary = local.permissions_boundary
 }
 
 data "aws_iam_policy_document" "ecs_execution_attachment" {
@@ -64,7 +68,7 @@ data "aws_iam_policy_document" "ecs_ecr_access_attachment" {
     ]
 
     resources = [
-      data.aws_ecr_repository.service[0].arn,
+      var.ecr_repository_arn,
     ]
   }
 
@@ -207,29 +211,6 @@ resource "aws_ecs_service" "service" {
   }
 }
 
-data "template_file" "container_definition" {
-  // NOTE: the container definition `name` has to be the same as the service 
-  // for the load balancer to attach and discover correctly even though 
-  // this ticket says it should work otherwise :shrug:
-  // https://github.com/hashicorp/terraform/issues/2888
-  template = file("${path.module}/container_definition.json")
-
-  vars = {
-    service_name          = var.service_name
-    environment           = var.environment
-    image                 = var.image
-    container_command     = length(var.container_command) > 0 ? jsonencode(var.container_command) : ""
-    working_directory     = var.container_working_directory
-    container_secrets     = jsonencode(var.container_secrets)
-    container_environment = jsonencode(var.container_environment)
-    service_protocol      = var.service_protocol
-    service_port          = var.service_port
-    use_adot_as_sidecar   = var.use_adot_as_sidecar ? "on" : ""
-    log_group             = aws_cloudwatch_log_group.service.name
-    region                = var.region
-  }
-}
-
 resource "aws_ecs_task_definition" "service" {
   family                   = "tf-${var.service_name}-${var.environment}"
   requires_compatibilities = ["FARGATE"]
@@ -239,7 +220,22 @@ resource "aws_ecs_task_definition" "service" {
   tags                     = var.tags
   execution_role_arn       = aws_iam_role.ecs_execution_role.arn
   task_role_arn            = aws_iam_role.ecs_execution_role.arn
-  container_definitions    = data.template_file.container_definition.rendered
+  container_definitions    = templatefile("${path.module}/container_definition.tftpl",
+      {
+          service_name          = var.service_name
+          environment           = var.environment
+          image                 = var.image
+          container_command     = length(var.container_command) > 0 ? jsonencode(var.container_command) : ""
+          working_directory     = var.container_working_directory
+          container_secrets     = jsonencode(var.container_secrets)
+          container_environment = jsonencode(var.container_environment)
+          service_protocol      = var.service_protocol
+          service_port          = var.service_port
+          use_adot_as_sidecar   = var.use_adot_as_sidecar ? "on" : ""
+          log_group             = aws_cloudwatch_log_group.service.name
+          region                = var.region
+        }
+      )
 }
 
 #######################################################################
diff --git a/terraform/modules/aws_ecs_service/variables.tf b/terraform/modules/aws_ecs_service/variables.tf
index bba749f..ecf52ea 100755
--- a/terraform/modules/aws_ecs_service/variables.tf
+++ b/terraform/modules/aws_ecs_service/variables.tf
@@ -11,7 +11,9 @@ variable "tags" {
 }
 
 variable "service_name" {}
-variable "service_port" {}
+variable "service_port" {
+  type    = number
+}
 
 variable "service_protocol" {
   type    = string
@@ -114,6 +116,8 @@ variable "use_adot_as_sidecar" {
 }
 
 variable "ecr_repository_name" {}
+variable "ecr_repository_arn" {}
+
 variable "image" {}
 
 variable "load_balancer" {
@@ -131,3 +135,4 @@ variable "lb_type" {
 variable "lb_target_group_arn" {}
 variable "lb_security_group_id" {}
 variable "lb_container_port" {}
+variable "permissions_boundary_policy_name" {}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/.terraform.lock.hcl b/terraform/veda-wfs3/.terraform.lock.hcl
deleted file mode 100644
index a758db9..0000000
--- a/terraform/veda-wfs3/.terraform.lock.hcl
+++ /dev/null
@@ -1,80 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/archive" {
-  version = "2.3.0"
-  hashes = [
-    "h1:pTPG9Kf1Qg2aPsZLXDa6OvLqsEXaMrKnp0Z4Q/TIBPA=",
-    "zh:0869128d13abe12b297b0cd13b8767f10d6bf047f5afc4215615aabc39c2eb4f",
-    "zh:481ed837d63ba3aa45dd8736da83e911e3509dee0e7961bf5c00ed2644f807b3",
-    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:9f08fe2977e2166849be24fb9f394e4d2697414d463f7996fd0d7beb4e19a29c",
-    "zh:9fe566deeafd460d27999ca0bbfd85426a5fcfcb40007b23884deb76da127b6f",
-    "zh:a1bd9a60925d9769e0da322e4523330ee86af9dc2e770cba1d0247a999ef29cb",
-    "zh:bb4094c8149f74308b22a87e1ac19bcccca76e8ef021b571074d9bccf1c0c6f0",
-    "zh:c8984c9def239041ce41ec8e19bbd76a49e74ed2024ff736dad60429dee89bcc",
-    "zh:ea4bb5ae73db1de3a586e62f39106f5e56770804a55aa5e6b4f642df973e0e75",
-    "zh:f44a9d596ecc3a8c5653f56ba0cd202ad93b49f76767f4608daf7260b813289e",
-    "zh:f5c5e6cc9f7f070020ab7d95fcc9ed8e20d5cf219978295a71236e22cbb6d508",
-    "zh:fd2273f51dcc8f43403bf1e425ba9db08a57c3ddcba5ad7a51742ccde21ca611",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/aws" {
-  version     = "4.58.0"
-  constraints = "~> 4.0"
-  hashes = [
-    "h1:znLROwEAINbYzAG5X7Ep04whM7KxkQGrvhFdhSvNKEk=",
-    "zh:14b2b2dfbc7ee705c412d762b1485ee08958c816a64ac74f5769e946e4a1d265",
-    "zh:17a37e6825e2023b18987d31c0cbb9336654ea146b68e6c90710ea4636af71ae",
-    "zh:273127c69fb244577e5c136c46164d34f77b0c956c18d27f63d1072dd558f924",
-    "zh:4b2b6416d34fb3e1051c99d2a84045b136976140e34381d5fbf90e32db15272e",
-    "zh:7e6a8571ff15d51f892776265642ee01004b8553fd4f6f2014b6f3f2834670c7",
-    "zh:847c76ab2381b66666d0f79cf1ac697b5bfd0d9c3009fd11bc6ad6545d1eb427",
-    "zh:9a52cae08ba8d27d0639a8d2b8c61591027883058bf0cc5a639cffe1e299f019",
-    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:9df647e8322d6f94f1843366ba39d21c4b36c8e7dcdc03711d52e27f73b0e974",
-    "zh:9e52037e68409802ff913b166c30e3f2035af03865cbef0c1b03762bce853941",
-    "zh:a30288e7c3c904d6998d1709835d7c5800a739f8608f0837f960286a2b8b6e59",
-    "zh:a7f24e3bda3be566468e4ad62cef1016f68c6f5a94d2e3e979485bc05626281b",
-    "zh:ba326ba80f5e39829b67a6d1ce54ba52b171e5e13a0a91ef5f9170a9b0cc9ce4",
-    "zh:c4e3fe9f2be6e244a3dfce599f4b0be9e8fffaece64cbc65f3195f825f65489b",
-    "zh:f20a251af37039bb2c7612dbd2c5df3a25886b4cc78f902385a2850ea6e30d08",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/random" {
-  version = "3.4.3"
-  hashes = [
-    "h1:tL3katm68lX+4lAncjQA9AXL4GR/VM+RPwqYf4D2X8Q=",
-    "zh:41c53ba47085d8261590990f8633c8906696fa0a3c4b384ff6a7ecbf84339752",
-    "zh:59d98081c4475f2ad77d881c4412c5129c56214892f490adf11c7e7a5a47de9b",
-    "zh:686ad1ee40b812b9e016317e7f34c0d63ef837e084dea4a1f578f64a6314ad53",
-    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:84103eae7251384c0d995f5a257c72b0096605048f757b749b7b62107a5dccb3",
-    "zh:8ee974b110adb78c7cd18aae82b2729e5124d8f115d484215fd5199451053de5",
-    "zh:9dd4561e3c847e45de603f17fa0c01ae14cae8c4b7b4e6423c9ef3904b308dda",
-    "zh:bb07bb3c2c0296beba0beec629ebc6474c70732387477a65966483b5efabdbc6",
-    "zh:e891339e96c9e5a888727b45b2e1bb3fcbdfe0fd7c5b4396e4695459b38c8cb1",
-    "zh:ea4739860c24dfeaac6c100b2a2e357106a89d18751f7693f3c31ecf6a996f8d",
-    "zh:f0c76ac303fd0ab59146c39bc121c5d7d86f878e9a69294e29444d4c653786f8",
-    "zh:f143a9a5af42b38fed328a161279906759ff39ac428ebcfe55606e05e1518b93",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/template" {
-  version = "2.2.0"
-  hashes = [
-    "h1:0wlehNaxBX7GJQnPfQwTNvvAf38Jm0Nv7ssKGMaG6Og=",
-    "zh:01702196f0a0492ec07917db7aaa595843d8f171dc195f4c988d2ffca2a06386",
-    "zh:09aae3da826ba3d7df69efeb25d146a1de0d03e951d35019a0f80e4f58c89b53",
-    "zh:09ba83c0625b6fe0a954da6fbd0c355ac0b7f07f86c91a2a97849140fea49603",
-    "zh:0e3a6c8e16f17f19010accd0844187d524580d9fdb0731f675ffcf4afba03d16",
-    "zh:45f2c594b6f2f34ea663704cc72048b212fe7d16fb4cfd959365fa997228a776",
-    "zh:77ea3e5a0446784d77114b5e851c970a3dde1e08fa6de38210b8385d7605d451",
-    "zh:8a154388f3708e3df5a69122a23bdfaf760a523788a5081976b3d5616f7d30ae",
-    "zh:992843002f2db5a11e626b3fc23dc0c87ad3729b3b3cff08e32ffb3df97edbde",
-    "zh:ad906f4cebd3ec5e43d5cd6dc8f4c5c9cc3b33d2243c89c5fc18f97f7277b51d",
-    "zh:c979425ddb256511137ecd093e23283234da0154b7fa8b21c2687182d9aea8b2",
-  ]
-}
diff --git a/terraform/veda-wfs3/dns.tf b/terraform/veda-wfs3/dns.tf
deleted file mode 100644
index 9ad8883..0000000
--- a/terraform/veda-wfs3/dns.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-data "aws_route53_zone" "zone" {
-  provider = aws.west2
-  name     = var.dns_zone_name
-}
-
-resource "aws_acm_certificate" "cert" {
-  provider = aws.west2
-  domain_name               = "*.${data.aws_route53_zone.zone.name}"
-  validation_method         = "DNS"
-  tags                      = var.tags
-
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_route53_record" "subdomain_record" {
-  provider = aws.west2
-  name     = "${var.dns_subdomain}.${data.aws_route53_zone.zone.name}"
-  zone_id  = data.aws_route53_zone.zone.id
-  type     = "A"
-
-  alias {
-    name                   = aws_alb.alb_ecs.dns_name
-    zone_id                = aws_alb.alb_ecs.zone_id
-    evaluate_target_health = true
-  }
-}
-
-resource "aws_lb_listener_certificate" "cert" {
-  provider = aws.west2
-  listener_arn    = aws_alb_listener.alb_listener_ecs.arn
-  certificate_arn = aws_acm_certificate.cert.arn
-}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/ecr.tf b/terraform/veda-wfs3/ecr.tf
deleted file mode 100644
index 5d8d7ab..0000000
--- a/terraform/veda-wfs3/ecr.tf
+++ /dev/null
@@ -1,10 +0,0 @@
-module "ecr_registry" {
-  source = "github.com/developmentseed/tf-seed/modules/aws_ecr"
-  environment              = var.env
-  registry_name            = var.registry_name
-  enable_registry_scanning = true
-  mutable_image_tags       = true
-  enable_deploy_user       = true
-  iam_deploy_username      = aws_iam_user.deploy_user.name
-  tags = var.tags
-}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/lambda_function.py b/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/lambda_function.py
deleted file mode 100644
index d524d83..0000000
--- a/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/lambda_function.py
+++ /dev/null
@@ -1,57 +0,0 @@
-import boto3
-import http.client
-import os
-import base64
-import ast
-import json
-mwaa_env_name = 'veda-pipeline-staging-mwaa'
-dag_name = 'veda_discover'
-mwaa_cli_command = 'dags trigger'
-client = boto3.client('mwaa')
-
-
-def lambda_handler(event, context):
-    for record in event['Records']:
-        print(f"[ RECORD ]: {record}")
-        s3_event_key = record['s3']['object']['key']
-        print(f"[ S3 EVENT KEY ]: {s3_event_key}")
-        s3_filename_target = os.path.split(s3_event_key)[-1]
-        print(f"[ S3 FILENAME TARGET ]: {s3_filename_target}")
-        s3_filename_no_ext = os.path.splitext(s3_filename_target)[0]
-        print(f"[ S3 FILENAME NO EXT ]: {s3_filename_no_ext}")
-
-        bucket_key_prefix = "EIS/FEDSoutput/Snapshot/"
-        if s3_filename_no_ext.startswith("lf_"):
-            bucket_key_prefix = "EIS/FEDSoutput/LFArchive/"
-
-        # get web token
-        mwaa_cli_token = client.create_cli_token(
-            Name=mwaa_env_name
-        )
-        print(f"[ CLI TOKEN ]: {mwaa_cli_token}")
-        serialized_args = json.dumps({
-                    "discovery": "s3",
-                    "collection": s3_filename_no_ext,
-                    "prefix": bucket_key_prefix,
-                    "bucket": "veda-data-store-staging",
-                    "filename_regex": f"^(.*){s3_filename_target}$",
-                    "vector": True
-        })
-        conn = http.client.HTTPSConnection(mwaa_cli_token['WebServerHostname'])
-        payload = f"{mwaa_cli_command} {dag_name} --conf '{serialized_args}'"
-        print(f"[ CLI PAYLOAD ]: {payload}")
-        headers = {
-          'Authorization': 'Bearer ' + mwaa_cli_token['CliToken'],
-          'Content-Type': 'text/plain'
-        }
-        conn.request("POST", "/aws_mwaa/cli", payload, headers)
-        res = conn.getresponse()
-        data = res.read()
-        dict_str = data.decode("UTF-8")
-        mydata = ast.literal_eval(dict_str)
-        print(f"[ DATA ]: {mydata}")
-        print(f"[ STDOUT ]: {base64.b64decode(mydata['stdout'])}")
-    return {
-        'statusCode': 200,
-        'body': json.dumps('Hello from Lambda!')
-    }
\ No newline at end of file
diff --git a/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/requirements.txt b/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/requirements.txt
deleted file mode 100644
index 1db657b..0000000
--- a/terraform/veda-wfs3/functions/s3_event_bridge_to_sfn_execute/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
-boto3
\ No newline at end of file
diff --git a/terraform/veda-wfs3/github_deploy_user.tf b/terraform/veda-wfs3/github_deploy_user.tf
deleted file mode 100644
index ad737c6..0000000
--- a/terraform/veda-wfs3/github_deploy_user.tf
+++ /dev/null
@@ -1,32 +0,0 @@
-resource "aws_iam_user" "deploy_user" {
-  name = "veda-wfs3-${var.env}-deploy-user"
-  path = "/"
-  tags = var.tags
-}
-
-// NOTE: we need to have extra policies added to our
-// deploy user for Github AWS Actions to work
-resource "aws_iam_user_policy" "deploy" {
-  name   = "${var.registry_name}_deploy_extended"
-  user   = aws_iam_user.deploy_user.name
-  policy = data.aws_iam_policy_document.extended_deploy.json
-}
-
-data "aws_iam_policy_document" "extended_deploy" {
-  statement {
-    actions = [
-      "iam:PassRole",
-      "ecr:InitiateLayerUpload",
-      "ecs:RegisterTaskDefinition",
-      "ecs:DescribeServices",
-      "ecs:UpdateService",
-    ]
-
-    resources = [
-      module.ecr_registry.registry_arn,
-      module.ecs_cluster.service_cluster_arn,
-      module.ecs_cluster.service_arn,
-      module.ecs_cluster.ecs_execution_role_arn,
-    ]
-  }
-}
\ No newline at end of file
diff --git a/terraform/veda-wfs3/rds.tf b/terraform/veda-wfs3/rds.tf
deleted file mode 100644
index e75f047..0000000
--- a/terraform/veda-wfs3/rds.tf
+++ /dev/null
@@ -1,65 +0,0 @@
-resource "aws_db_subnet_group" "db" {
-  name       = "tf-${var.project_name}-${var.env}-subnet-group"
-  subnet_ids = module.networking.private_subnets_id
-  tags = {
-    Name = "tf-${var.project_name}-subnet-group"
-  }
-}
-
-resource "aws_db_parameter_group" "default" {
-  name   = "tf-${var.project_name}-${var.env}-postgres14-param-group"
-  family = "postgres14"
-
-  parameter {
-    name  = "work_mem"
-    # NOTE: I had `work_mem` set to ~100MB and `max_connections` around 75 and TileJSON completely failed
-    # 16MB
-    value = var.env == "staging" ? "16384" : "8192"
-  }
-
-  parameter {
-    name  = "max_connections"
-    value = "475"
-    apply_method = "pending-reboot"
-  }
-
-#  NOTE: here to show what shared_buffers are but doesn't really make sense why it won't provision with these
-#  parameter {
-#    name  = "shared_buffers"
-#    value = var.env == "staging" ? "8064856" : "4032428"
-#    apply_method = "pending-reboot"
-#  }
-
-  parameter {
-    name  = "seq_page_cost"
-    value = "1"
-  }
-
-  parameter {
-    name  = "random_page_cost"
-    value = "1.2"
-  }
-}
-
-resource "aws_db_instance" "db" {
-  db_name                  = "veda"
-  identifier               = "${var.project_name}-${var.env}"
-  engine                   = "postgres"
-  engine_version           = "14.3"
-  // https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
-  allocated_storage        = 100
-  max_allocated_storage    = 500
-  storage_type             = "gp2"
-  instance_class           = var.env == "staging" ? "db.r5.xlarge" : "db.r5.large"
-  db_subnet_group_name     = aws_db_subnet_group.db.name
-  vpc_security_group_ids   = module.networking.security_groups_ids
-  skip_final_snapshot      = true
-  apply_immediately        = true
-  backup_retention_period  = 7
-  username                 = "postgres"
-  password                 = var.db_password
-  allow_major_version_upgrade = true
-  parameter_group_name     = aws_db_parameter_group.default.name
-}
-
-
diff --git a/terraform/veda-wfs3/s3_event_bridge_lambda.tf b/terraform/veda-wfs3/s3_event_bridge_lambda.tf
deleted file mode 100644
index 77ae894..0000000
--- a/terraform/veda-wfs3/s3_event_bridge_lambda.tf
+++ /dev/null
@@ -1,167 +0,0 @@
-#####################################################
-# Execution Role
-#####################################################
-resource "aws_iam_role" "lambda_exec_role" {
-  provider = aws.west2
-  name = "lambda-exec-role-s3-event-bridge-${var.project_name}-${var.env}"
-  tags = var.tags
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "lambda.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-###############################
-# Logging
-###############################
-resource "aws_iam_policy" "lambda_logging" {
-  provider = aws.west2
-  name        = "lambda-logging-${var.project_name}-${var.env}"
-  path        = "/"
-  description = "IAM policy for logging from a lambda"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "logs:CreateLogGroup",
-        "logs:CreateLogStream",
-        "logs:PutLogEvents"
-      ],
-      "Resource": "${aws_cloudwatch_log_group.group.arn}",
-      "Effect": "Allow"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy_attachment" "lambda_logs" {
-  provider = aws.west2
-  role       = aws_iam_role.lambda_exec_role.name
-  policy_arn = aws_iam_policy.lambda_logging.arn
-}
-
-###############################
-# SFN StartExecution Policy
-###############################
-resource "aws_iam_policy" "lambda_sfn_start_exec" {
-  provider = aws.west2
-  name        = "lambda-startexec-on-sfn-${var.project_name}-${var.env}"
-  path        = "/"
-  description = "IAM policy for allowing lambda to start execution on SFN"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "states:StartExecution"
-      ],
-      "Resource": "arn:aws:states:us-west-1:853558080719:stateMachine:veda-data-pipelines-dev-vector-stepfunction-discover",
-      "Effect": "Allow"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy_attachment" "lambda_sfn_start_exec" {
-  provider = aws.west2
-  role       = aws_iam_role.lambda_exec_role.name
-  policy_arn = aws_iam_policy.lambda_sfn_start_exec.arn
-}
-
-###############################
-# MWAA Trigger Permissions
-###############################
-resource "aws_iam_policy" "lambda_trigger_mwaa_job" {
-  provider = aws.west2
-  name        = "lambda-trigger-mwaa-${var.project_name}-${var.env}"
-  path        = "/"
-  description = "IAM policy for allowing lambda to trigger MWAA"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-      {
-          "Effect": "Allow",
-          "Action": "airflow:ListEnvironments",
-          "Resource": "*"
-      },
-      {
-          "Effect": "Allow",
-          "Action": "airflow:*",
-          "Resource": [
-              "arn:aws:airflow:us-west-2:853558080719:environment/veda-pipeline-staging-mwaa",
-              "arn:aws:airflow:us-west-2:853558080719:environment/veda-pipeline-dev-mwaa",
-              "arn:aws:airflow:us-west-2:853558080719:environment/veda-pipeline-sit-mwaa"
-          ]
-      }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy_attachment" "lambda_trigger_mwaa_job" {
-  provider = aws.west2
-  role       = aws_iam_role.lambda_exec_role.name
-  policy_arn = aws_iam_policy.lambda_trigger_mwaa_job.arn
-}
-
-#####################################################
-# Lambda
-#####################################################
-data "archive_file" "archive" {
-  type        = "zip"
-  source_dir  = "functions/s3_event_bridge_to_sfn_execute"
-  output_path = "s3_event_bridge_to_sfn_execute.zip"
-}
-
-resource "aws_lambda_function" "lambda" {
-  provider = aws.west2
-  filename         = "s3_event_bridge_to_sfn_execute.zip"
-  function_name    = "s3-event-bridge-to-sfn-execute-${var.project_name}-${var.env}"
-  role             = aws_iam_role.lambda_exec_role.arn
-  handler          = "lambda_function.lambda_handler"
-  source_code_hash = data.archive_file.archive.output_base64sha256
-  runtime          = "python3.7"
-  publish          = true
-  tags             = var.tags
-}
-
-resource "aws_cloudwatch_log_group" "group" {
-  provider = aws.west2
-  name              = "/aws/lambda/${aws_lambda_function.lambda.function_name}"
-  retention_in_days = 5
-  tags              = var.tags
-}
-
-#####################################################
-# RESOURCE POLICY for EVENT INVOCATION
-#####################################################
-resource "aws_lambda_permission" "s3_invoke" {
-  provider = aws.west2
-  action           = "lambda:InvokeFunction"
-  function_name    = aws_lambda_function.lambda.function_name
-  principal        = "s3.amazonaws.com"
-  statement_id     = "AllowInvocationFromS3Bucket-${var.project_name}-${var.env}"
-  source_account   = "114506680961"
-  source_arn       = "arn:aws:s3:::veda-data-store-staging"
-}
diff --git a/terraform/veda-wfs3/variables.tf b/terraform/veda-wfs3/variables.tf
deleted file mode 100755
index 7645237..0000000
--- a/terraform/veda-wfs3/variables.tf
+++ /dev/null
@@ -1,48 +0,0 @@
-variable "region" {
-}
-
-variable "registry_name" {
-}
-
-variable "env" {
-}
-
-variable "project_name" {
-}
-
-variable "tags" {
-  type        = map
-  default     = {}
-  description = "Optional tags to add to resources"
-}
-
-variable "availability_zones" {
-  type        = list
-  description = "The az that the resources will be launched"
-}
-
-variable service_port {}
-
-# Key/Value default to prevent task definitions from stopping at runtime
-variable default_secret {
-  default = {
-    noop: "noop"
-  }
-  type = map
-}
-
-variable "db_password" {
-  description = "RDS root user password"
-  type        = string
-  sensitive   = true
-}
-
-variable "dns_zone_name" {
-}
-
-variable "dns_subdomain" {
-
-}
-
-variable "alb_protocol" {}
-
diff --git a/terraform/veda-wfs3/vars/dev.tf b/terraform/veda-wfs3/vars/dev.tf
deleted file mode 100644
index 13c5122..0000000
--- a/terraform/veda-wfs3/vars/dev.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-region             = "us-west-1"
-registry_name      = "veda-wfs3-registry"
-env                = "dev"
-project_name       = "veda-wfs3"
-availability_zones = ["us-west-1a", "us-west-1b"]
-service_port       = 8080
-dns_zone_name      = ""
-dns_subdomain      = ""
-tags               = {"project": "veda", "service": "wfs3"}
-default_secret     = {
-    "noop": "boop",
-}
diff --git a/terraform/veda-wfs3/vars/west2-staging.tf b/terraform/veda-wfs3/vars/west2-staging.tf
deleted file mode 100644
index 8b6ab5c..0000000
--- a/terraform/veda-wfs3/vars/west2-staging.tf
+++ /dev/null
@@ -1,13 +0,0 @@
-region             = "us-west-2"
-registry_name      = "veda-wfs3-registry"
-env                = "west2-staging"
-project_name       = "veda-wfs3"
-availability_zones = ["us-west-2a", "us-west-2b"]
-service_port       = 8080
-dns_zone_name      = "delta-backend.com"
-dns_subdomain      = "firenrt"
-alb_protocol       = "HTTPS"
-tags               = {"project": "veda", "service": "wfs3"}
-default_secret     = {
-    "noop": "boop",
-}
diff --git a/terraform/veda-wfs3/vpc.tf b/terraform/veda-wfs3/vpc.tf
deleted file mode 100644
index 053d865..0000000
--- a/terraform/veda-wfs3/vpc.tf
+++ /dev/null
@@ -1,41 +0,0 @@
-module "networking" {
-  source               = "github.com/developmentseed/tf-seed/modules/networking"
-  project_name         = var.project_name
-  env                  = "${var.env}"
-  vpc_cidr             = "10.0.0.0/16"
-  public_subnets_cidr  = ["10.0.1.0/24", "10.0.2.0/24"]
-  private_subnets_cidr = ["10.0.10.0/24", "10.0.20.0/24"]
-  region               = "${var.region}"
-  availability_zones   = "${var.availability_zones}"
-  tags                 = "${var.tags}"
-}
-
-resource "aws_security_group_rule" "ecs_service_port_addon" {
-  description = "opened for ECS service port"
-  type        = "ingress"
-  from_port   = var.service_port
-  to_port     = var.service_port
-  protocol    = "tcp"
-  security_group_id        = module.networking.default_sg_id
-  source_security_group_id = module.networking.default_sg_id
-
-  lifecycle {
-    # Necessary if changing 'name' or 'name_prefix' properties.
-    create_before_destroy = true
-  }
-}
-
-resource "aws_security_group_rule" "rds_ingress_addon" {
-  description = "Allow ESC to talk to RDS"
-  type        = "ingress"
-  from_port   = 5432
-  to_port     = 5432
-  protocol    = "tcp"
-  security_group_id        = module.networking.default_sg_id
-  source_security_group_id = module.ecs_cluster.service_security_group_id
-
-  lifecycle {
-    # Necessary if changing 'name' or 'name_prefix' properties.
-    create_before_destroy = true
-  }
-}
diff --git a/veda-wfs3-app/startup.sh b/veda-wfs3-app/startup.sh
deleted file mode 100644
index 867512f..0000000
--- a/veda-wfs3-app/startup.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-################################################################
-# FAST API
-#################################################################
-opentelemetry-bootstrap --action=install \
-  && opentelemetry-instrument python /opt/bitnami/python/bin/uvicorn \
-  fast_api_main:app --proxy-headers --forwarded-allow-ips="*"  --host 0.0.0.0 --port 8080
diff --git a/veda-wfs3-app/Dockerfile b/wfs3-app/Dockerfile
similarity index 100%
rename from veda-wfs3-app/Dockerfile
rename to wfs3-app/Dockerfile
diff --git a/veda-wfs3-app/cd.sh b/wfs3-app/cd.sh
similarity index 100%
rename from veda-wfs3-app/cd.sh
rename to wfs3-app/cd.sh
diff --git a/veda-wfs3-app/dbconntest.py b/wfs3-app/dbconntest.py
similarity index 100%
rename from veda-wfs3-app/dbconntest.py
rename to wfs3-app/dbconntest.py
diff --git a/veda-wfs3-app/fast_api_main.py b/wfs3-app/fast_api_main.py
similarity index 91%
rename from veda-wfs3-app/fast_api_main.py
rename to wfs3-app/fast_api_main.py
index 4fb55b3..5e747e4 100644
--- a/veda-wfs3-app/fast_api_main.py
+++ b/wfs3-app/fast_api_main.py
@@ -130,13 +130,13 @@ async def ping():
     return JSONResponse(status_code=200, content={"ping": "pong"})
 
 
-@app.get("/refresh")
-async def refresh(request: Request):
-    """Return parsed catalog data for testing."""
-    with tracer.start_as_current_span("refresh"):
-        refresh_counter.add(1, {"refresh": "count"})
-        await connect_to_db(app, settings=postgresql_settings)
-        await register_collection_catalog(app)
-        return JSONResponse(status_code=200, content={"status": "refreshed"})
+# @app.get("/refresh")
+# async def refresh(request: Request):
+#     """Return parsed catalog data for testing."""
+#     with tracer.start_as_current_span("refresh"):
+#         refresh_counter.add(1, {"refresh": "count"})
+#         await connect_to_db(app, settings=postgresql_settings)
+#         await register_collection_catalog(app)
+#         return JSONResponse(status_code=200, content={"status": "refreshed"})
 
 FastAPIInstrumentor.instrument_app(app, excluded_urls="/conformance,/healthz")
diff --git a/veda-wfs3-app/requirements.txt b/wfs3-app/requirements.txt
similarity index 100%
rename from veda-wfs3-app/requirements.txt
rename to wfs3-app/requirements.txt
diff --git a/wfs3-app/startup.sh b/wfs3-app/startup.sh
new file mode 100644
index 0000000..4ad0687
--- /dev/null
+++ b/wfs3-app/startup.sh
@@ -0,0 +1,9 @@
+################################################################
+# FAST API
+#################################################################
+# opentelemetry-bootstrap --action=install \
+#   && opentelemetry-instrument python /opt/bitnami/python/bin/uvicorn \
+#   fast_api_main:app --proxy-headers --forwarded-allow-ips="*"  --host 0.0.0.0 --port 8080
+
+python /opt/bitnami/python/bin/uvicorn \
+fast_api_main:app --proxy-headers --forwarded-allow-ips="*"  --host 0.0.0.0 --port 8080