diff --git a/README.md b/README.md
index 5aaf0f9..7f330ff 100644
--- a/README.md
+++ b/README.md
@@ -36,9 +36,9 @@ Use of `sshuttle` with private key:
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.9.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.12.0 |
 | <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | 1.14.0 |
-| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.22.0 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.23.0 |
 | <a name="provider_random"></a> [random](#provider\_random) | 3.5.1 |
 
 ## Modules
@@ -46,8 +46,10 @@ Use of `sshuttle` with private key:
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_aws_eks"></a> [aws\_eks](#module\_aws\_eks) | git::https://github.com/terraform-aws-modules/terraform-aws-eks.git | v19.15.3 |
+| <a name="module_calico"></a> [calico](#module\_calico) | git::https://github.com/aws-ia/terraform-aws-eks-blueprints-addon.git | v1.1.0 |
+| <a name="module_ebs_csi_driver_irsa"></a> [ebs\_csi\_driver\_irsa](#module\_ebs\_csi\_driver\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | ~> 5.20 |
 | <a name="module_efs"></a> [efs](#module\_efs) | terraform-aws-modules/efs/aws | ~> 1.0 |
-| <a name="module_eks_blueprints_kubernetes_addons"></a> [eks\_blueprints\_kubernetes\_addons](#module\_eks\_blueprints\_kubernetes\_addons) | git::https://github.com/aws-ia/terraform-aws-eks-blueprints.git//modules/kubernetes-addons | v4.32.1 |
+| <a name="module_eks_blueprints_kubernetes_addons"></a> [eks\_blueprints\_kubernetes\_addons](#module\_eks\_blueprints\_kubernetes\_addons) | git::https://github.com/aws-ia/terraform-aws-eks-blueprints-addons.git | v1.5.1 |
 
 ## Resources
 
@@ -67,20 +69,20 @@ Use of `sshuttle` with private key:
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_amazon_eks_aws_ebs_csi_driver_config"></a> [amazon\_eks\_aws\_ebs\_csi\_driver\_config](#input\_amazon\_eks\_aws\_ebs\_csi\_driver\_config) | configMap for AWS EBS CSI Driver add-on | `any` | `{}` | no |
 | <a name="input_aws_admin_usernames"></a> [aws\_admin\_usernames](#input\_aws\_admin\_usernames) | A list of one or more AWS usernames with authorized access to KMS and EKS resources, will automatically add the user running the terraform as an admin | `list(string)` | `[]` | no |
+| <a name="input_aws_auth_roles"></a> [aws\_auth\_roles](#input\_aws\_auth\_roles) | List of role maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
 | <a name="input_aws_auth_users"></a> [aws\_auth\_users](#input\_aws\_auth\_users) | List of map of users to add to aws-auth configmap | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| <a name="input_aws_node_termination_handler_helm_config"></a> [aws\_node\_termination\_handler\_helm\_config](#input\_aws\_node\_termination\_handler\_helm\_config) | AWS Node Termination Handler Helm Chart config | `any` | `{}` | no |
+| <a name="input_aws_efs_csi_driver"></a> [aws\_efs\_csi\_driver](#input\_aws\_efs\_csi\_driver) | AWS EFS CSI Driver helm chart config | `any` | `{}` | no |
+| <a name="input_aws_node_termination_handler"></a> [aws\_node\_termination\_handler](#input\_aws\_node\_termination\_handler) | AWS Node Termination Handler config for aws-ia/eks-blueprints-addon/aws | `any` | `{}` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | n/a | `string` | `""` | no |
-| <a name="input_bastion_role_arn"></a> [bastion\_role\_arn](#input\_bastion\_role\_arn) | ARN of role authorized kubectl access | `string` | `""` | no |
-| <a name="input_bastion_role_name"></a> [bastion\_role\_name](#input\_bastion\_role\_name) | Name of role authorized kubectl access | `string` | `""` | no |
-| <a name="input_calico_helm_config"></a> [calico\_helm\_config](#input\_calico\_helm\_config) | Calico Helm Chart config | `any` | `{}` | no |
+| <a name="input_calico"></a> [calico](#input\_calico) | Calico Helm Chart config | `any` | `{}` | no |
 | <a name="input_cidr_blocks"></a> [cidr\_blocks](#input\_cidr\_blocks) | n/a | `list(string)` | n/a | yes |
 | <a name="input_cluster_addons"></a> [cluster\_addons](#input\_cluster\_addons) | Nested of eks native add-ons and their associated parameters.<br>See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_add-on for supported values.<br>See https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/examples/complete/main.tf#L44-L60 for upstream example.<br><br>to see available eks marketplace addons available for your cluster's version run:<br>aws eks describe-addon-versions --kubernetes-version $k8s\_cluster\_version --query 'addons[].{MarketplaceProductUrl: marketplaceInformation.productUrl, Name: addonName, Owner: owner Publisher: publisher, Type: type}' --output table | `any` | `{}` | no |
-| <a name="input_cluster_autoscaler_helm_config"></a> [cluster\_autoscaler\_helm\_config](#input\_cluster\_autoscaler\_helm\_config) | Cluster Autoscaler Helm Chart config | `any` | <pre>{<br>  "set": [<br>    {<br>      "name": "extraArgs.expander",<br>      "value": "priority"<br>    },<br>    {<br>      "name": "expanderPriorities",<br>      "value": "100:\n  - .*-spot-2vcpu-8mem.*\n90:\n  - .*-spot-4vcpu-16mem.*\n10:\n  - .*\n"<br>    }<br>  ]<br>}</pre> | no |
+| <a name="input_cluster_autoscaler"></a> [cluster\_autoscaler](#input\_cluster\_autoscaler) | Cluster Autoscaler Helm Chart config | `any` | <pre>{<br>  "set": [<br>    {<br>      "name": "extraArgs.expander",<br>      "value": "priority"<br>    },<br>    {<br>      "name": "expanderPriorities",<br>      "value": "100:\n  - .*-spot-2vcpu-8mem.*\n90:\n  - .*-spot-4vcpu-16mem.*\n10:\n  - .*\n"<br>    }<br>  ]<br>}</pre> | no |
 | <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Enable private access to the cluster endpoint | `bool` | `true` | no |
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Enable public access to the cluster endpoint | `bool` | `false` | no |
-| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of cluster - used by Terratest for e2e test automation | `string` | `""` | no |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of cluster | `string` | `""` | no |
+| <a name="input_cluster_security_group_additional_rules"></a> [cluster\_security\_group\_additional\_rules](#input\_cluster\_security\_group\_additional\_rules) | List of additional security group rules to add to the cluster security group created. Set `source_node_security_group = true` inside rules to set the `node_security_group` as source | `any` | `{}` | no |
 | <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for EKS cluster | `string` | `"1.27"` | no |
 | <a name="input_control_plane_subnet_ids"></a> [control\_plane\_subnet\_ids](#input\_control\_plane\_subnet\_ids) | Subnet IDs for control plane | `list(string)` | `[]` | no |
 | <a name="input_create_aws_auth_configmap"></a> [create\_aws\_auth\_configmap](#input\_create\_aws\_auth\_configmap) | Determines whether to create the aws-auth configmap. NOTE - this is only intended for scenarios where the configmap does not exist (i.e. - when using only self-managed node groups). Most users should use `manage_aws_auth_configmap` | `bool` | `false` | no |
@@ -88,23 +90,22 @@ Use of `sshuttle` with private key:
 | <a name="input_eks_managed_node_group_defaults"></a> [eks\_managed\_node\_group\_defaults](#input\_eks\_managed\_node\_group\_defaults) | Map of EKS-managed node group default configurations | `any` | `{}` | no |
 | <a name="input_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#input\_eks\_managed\_node\_groups) | Managed node groups configuration | `any` | `{}` | no |
 | <a name="input_eks_use_mfa"></a> [eks\_use\_mfa](#input\_eks\_use\_mfa) | Use MFA for auth\_eks\_role | `bool` | `false` | no |
-| <a name="input_enable_amazon_eks_aws_ebs_csi_driver"></a> [enable\_amazon\_eks\_aws\_ebs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_ebs\_csi\_driver) | Enable EKS Managed AWS EBS CSI Driver add-on; enable\_amazon\_eks\_aws\_ebs\_csi\_driver and enable\_self\_managed\_aws\_ebs\_csi\_driver are mutually exclusive | `bool` | `false` | no |
+| <a name="input_enable_amazon_eks_aws_ebs_csi_driver"></a> [enable\_amazon\_eks\_aws\_ebs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_ebs\_csi\_driver) | Enable EKS Managed AWS EBS CSI Driver add-on | `bool` | `false` | no |
+| <a name="input_enable_amazon_eks_aws_efs_csi_driver"></a> [enable\_amazon\_eks\_aws\_efs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_efs\_csi\_driver) | Enable EFS CSI Driver add-on | `bool` | `false` | no |
 | <a name="input_enable_aws_node_termination_handler"></a> [enable\_aws\_node\_termination\_handler](#input\_enable\_aws\_node\_termination\_handler) | Enable AWS Node Termination Handler add-on | `bool` | `false` | no |
-| <a name="input_enable_calico"></a> [enable\_calico](#input\_enable\_calico) | Enable Calico add-on | `bool` | `false` | no |
+| <a name="input_enable_calico"></a> [enable\_calico](#input\_enable\_calico) | Enable Calico add-on | `bool` | `true` | no |
 | <a name="input_enable_cluster_autoscaler"></a> [enable\_cluster\_autoscaler](#input\_enable\_cluster\_autoscaler) | Enable Cluster autoscaler add-on | `bool` | `false` | no |
-| <a name="input_enable_efs"></a> [enable\_efs](#input\_enable\_efs) | Enable EFS CSI Driver add-on | `bool` | `false` | no |
 | <a name="input_enable_gp3_default_storage_class"></a> [enable\_gp3\_default\_storage\_class](#input\_enable\_gp3\_default\_storage\_class) | Enable gp3 as default storage class | `bool` | `false` | no |
 | <a name="input_enable_metrics_server"></a> [enable\_metrics\_server](#input\_enable\_metrics\_server) | Enable metrics server add-on | `bool` | `false` | no |
 | <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |
 | <a name="input_kms_key_administrators"></a> [kms\_key\_administrators](#input\_kms\_key\_administrators) | List of ARNs of additional administrator users to add to KMS key policy | `list(string)` | `[]` | no |
 | <a name="input_manage_aws_auth_configmap"></a> [manage\_aws\_auth\_configmap](#input\_manage\_aws\_auth\_configmap) | Determines whether to manage the aws-auth configmap | `bool` | `false` | no |
-| <a name="input_metrics_server_helm_config"></a> [metrics\_server\_helm\_config](#input\_metrics\_server\_helm\_config) | Metrics Server Helm Chart config | `any` | `{}` | no |
+| <a name="input_metrics_server"></a> [metrics\_server](#input\_metrics\_server) | Metrics Server config for aws-ia/eks-blueprints-addon/aws | `any` | `{}` | no |
 | <a name="input_name"></a> [name](#input\_name) | n/a | `string` | `""` | no |
 | <a name="input_private_subnet_ids"></a> [private\_subnet\_ids](#input\_private\_subnet\_ids) | Private subnet IDs | `list(string)` | `[]` | no |
 | <a name="input_reclaim_policy"></a> [reclaim\_policy](#input\_reclaim\_policy) | Reclaim policy for EFS storage class, valid options are Delete and Retain | `string` | `"Delete"` | no |
 | <a name="input_self_managed_node_group_defaults"></a> [self\_managed\_node\_group\_defaults](#input\_self\_managed\_node\_group\_defaults) | Map of self-managed node group default configurations | `any` | `{}` | no |
 | <a name="input_self_managed_node_groups"></a> [self\_managed\_node\_groups](#input\_self\_managed\_node\_groups) | Self-managed node groups configuration | `any` | `{}` | no |
-| <a name="input_source_security_group_id"></a> [source\_security\_group\_id](#input\_source\_security\_group\_id) | List of additional rules to add to cluster security group | `string` | `""` | no |
 | <a name="input_storageclass_reclaim_policy"></a> [storageclass\_reclaim\_policy](#input\_storageclass\_reclaim\_policy) | Reclaim policy for gp3 storage class, valid options are Delete and Retain | `string` | `"Delete"` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to apply to all resources | `map(string)` | `{}` | no |
 | <a name="input_vpc_cni_custom_subnet"></a> [vpc\_cni\_custom\_subnet](#input\_vpc\_cni\_custom\_subnet) | Subnet to put pod ENIs in | `list(string)` | `[]` | no |
@@ -118,8 +119,9 @@ Use of `sshuttle` with private key:
 | <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | EKS cluster endpoint |
 | <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | EKS cluster IAM role ARN |
 | <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster |
+| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | EKS cluster security group ID |
 | <a name="output_cluster_status"></a> [cluster\_status](#output\_cluster\_status) | status of the EKS cluster |
-| <a name="output_efs_storageclass_name"></a> [efs\_storageclass\_name](#output\_efs\_storageclass\_name) | The name of the EFS storageclass that was created (if var.enable\_efs was set to true) |
+| <a name="output_efs_storageclass_name"></a> [efs\_storageclass\_name](#output\_efs\_storageclass\_name) | The name of the EFS storageclass that was created (if var.enable\_amazon\_eks\_aws\_efs\_csi\_driver was set to true) |
 | <a name="output_managed_nodegroups"></a> [managed\_nodegroups](#output\_managed\_nodegroups) | EKS managed node groups |
 | <a name="output_oidc_provider"></a> [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) |
 | <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | EKS OIDC provider ARN |
diff --git a/eks-addons.tf b/eks-addons.tf
index a883a6b..470b3f7 100644
--- a/eks-addons.tf
+++ b/eks-addons.tf
@@ -1,59 +1,195 @@
-#---------------------------------------------------------------
-# EKS Add-Ons
-#---------------------------------------------------------------
+################################################################################
+# EKS Blueprints Add-Ons
+################################################################################
 
 locals {
-  self_managed_node_group_names = [for key, value in module.aws_eks.self_managed_node_groups : lookup(value, "autoscaling_group_name", "")]
+  node_group_arns = [for key, value in module.aws_eks.self_managed_node_groups : lookup(value, "autoscaling_group_arn", "")]
 }
 
 module "eks_blueprints_kubernetes_addons" {
-  source = "git::https://github.com/aws-ia/terraform-aws-eks-blueprints.git//modules/kubernetes-addons?ref=v4.32.1"
+  source = "git::https://github.com/aws-ia/terraform-aws-eks-blueprints-addons.git?ref=v1.5.1"
 
-  eks_cluster_id                = module.aws_eks.cluster_name
-  eks_cluster_endpoint          = module.aws_eks.cluster_endpoint
-  eks_oidc_provider             = module.aws_eks.oidc_provider
-  eks_cluster_version           = module.aws_eks.cluster_version
-  irsa_iam_permissions_boundary = var.iam_role_permissions_boundary
-
-  # only used for aws_node_termination_handler, if this list is empty, then enable_aws_node_termination_handler should also be false.
-  auto_scaling_group_names = local.self_managed_node_group_names
+  cluster_name      = module.aws_eks.cluster_name
+  cluster_endpoint  = module.aws_eks.cluster_endpoint
+  oidc_provider_arn = module.aws_eks.oidc_provider_arn
+  cluster_version   = module.aws_eks.cluster_version
 
-  # blueprints addons
+  # time_sleep w/ trigger for nodes to be deployed
+  create_delay_dependencies = local.node_group_arns
 
-  # EKS EBS CSI Driver
-  enable_amazon_eks_aws_ebs_csi_driver = var.enable_amazon_eks_aws_ebs_csi_driver
-  amazon_eks_aws_ebs_csi_driver_config = var.amazon_eks_aws_ebs_csi_driver_config
+  # only used for aws_node_termination_handler, if this list is empty, then enable_aws_node_termination_handler should also be false.
+  # you don't need to tag eks managed node group ASGs for NTH - https://github.com/aws/aws-node-termination-handler/blob/main/README.md?plain=1#L41
+  aws_node_termination_handler_asg_arns = local.node_group_arns
 
   # EKS EFS CSI Driver
-  enable_aws_efs_csi_driver = var.enable_efs
+  enable_aws_efs_csi_driver = var.enable_amazon_eks_aws_efs_csi_driver
+  aws_efs_csi_driver        = var.aws_efs_csi_driver
 
   # K8s Add-ons
 
   # EKS Metrics Server
-  enable_metrics_server      = var.enable_metrics_server
-  metrics_server_helm_config = var.metrics_server_helm_config
+  enable_metrics_server = var.enable_metrics_server
+  metrics_server        = var.metrics_server
 
   # EKS AWS node termination handler
-  enable_aws_node_termination_handler      = var.enable_aws_node_termination_handler
-  aws_node_termination_handler_helm_config = var.aws_node_termination_handler_helm_config
+  enable_aws_node_termination_handler = var.enable_aws_node_termination_handler
+  aws_node_termination_handler        = var.aws_node_termination_handler
 
   # EKS Cluster Autoscaler
-  enable_cluster_autoscaler      = var.enable_cluster_autoscaler
-  cluster_autoscaler_helm_config = var.cluster_autoscaler_helm_config
+  enable_cluster_autoscaler = var.enable_cluster_autoscaler
+  cluster_autoscaler        = var.cluster_autoscaler
+
+  # Arbitrary helm charts can be fed into a helm_release var in blueprints. Note that the standard "create" var doesn't work with these
+  # see https://github.com/aws-ia/terraform-aws-eks-blueprints-addons/blob/main/docs/helm-release.md
+
+  tags = var.tags
+}
 
-  # Calico
-  enable_calico      = var.enable_calico
-  calico_helm_config = var.calico_helm_config
+################################################################################
+# Custom Addons
+################################################################################
+
+# Calico
+module "calico" {
+  source = "git::https://github.com/aws-ia/terraform-aws-eks-blueprints-addon.git?ref=v1.1.0"
+
+  create = var.enable_calico
+
+  # https://github.com/aws/eks-charts/blob/master/stable/aws-load-balancer-controller/Chart.yaml
+  name             = try(var.calico.name, "calico")
+  description      = try(var.calico.description, "calico helm Chart deployment configuration")
+  namespace        = try(var.calico.namespace, "tigera-operator")
+  create_namespace = try(var.calico.create_namespace, true)
+  chart            = try(var.calico.chart, "tigera-operator")
+  chart_version    = try(var.calico.chart_version, "v3.26.1")
+  repository       = try(var.calico.repository, "https://docs.projectcalico.org/charts")
+  values = try(var.calico.values, [
+    <<-EOT
+      installation:
+        kubernetesProvider: "EKS"
+    EOT
+  ])
+
+  timeout                    = try(var.calico.timeout, null)
+  repository_key_file        = try(var.calico.repository_key_file, null)
+  repository_cert_file       = try(var.calico.repository_cert_file, null)
+  repository_ca_file         = try(var.calico.repository_ca_file, null)
+  repository_username        = try(var.calico.repository_username, null)
+  repository_password        = try(var.calico.repository_password, null)
+  devel                      = try(var.calico.devel, null)
+  verify                     = try(var.calico.verify, null)
+  keyring                    = try(var.calico.keyring, null)
+  disable_webhooks           = try(var.calico.disable_webhooks, null)
+  reuse_values               = try(var.calico.reuse_values, null)
+  reset_values               = try(var.calico.reset_values, null)
+  force_update               = try(var.calico.force_update, null)
+  recreate_pods              = try(var.calico.recreate_pods, null)
+  cleanup_on_fail            = try(var.calico.cleanup_on_fail, null)
+  max_history                = try(var.calico.max_history, null)
+  atomic                     = try(var.calico.atomic, null)
+  skip_crds                  = try(var.calico.skip_crds, null)
+  render_subchart_notes      = try(var.calico.render_subchart_notes, null)
+  disable_openapi_validation = try(var.calico.disable_openapi_validation, null)
+  wait                       = try(var.calico.wait, false)
+  wait_for_jobs              = try(var.calico.wait_for_jobs, null)
+  dependency_update          = try(var.calico.dependency_update, null)
+  replace                    = try(var.calico.replace, null)
+  lint                       = try(var.calico.lint, null)
+
+  postrender    = try(var.calico.postrender, [])
+  set           = []
+  set_sensitive = try(var.calico.set_sensitive, [])
+
+  tags = var.tags
+}
+
+################################################################################
+# EBS CSI Driver Configurations
+################################################################################
+
+module "ebs_csi_driver_irsa" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "~> 5.20"
+
+  count = var.enable_amazon_eks_aws_ebs_csi_driver ? 1 : 0
+
+  role_name_prefix = "${module.aws_eks.cluster_name}-ebs-csi-driver-"
+
+  attach_ebs_csi_policy = true
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.aws_eks.oidc_provider_arn
+      namespace_service_accounts = ["kube-system:ebs-csi-controller-sa"]
+    }
+  }
+
+  tags = var.tags
+}
+
+
+################################################################################
+# EFS CSI Driver Configurations
+################################################################################
+
+resource "random_id" "efs_name" {
+  byte_length = 2
+  prefix      = "EFS-"
+}
+
+resource "kubernetes_storage_class_v1" "efs" {
+  count = var.enable_amazon_eks_aws_efs_csi_driver ? 1 : 0
+  metadata {
+    name = lower(random_id.efs_name.hex)
+  }
+
+  storage_provisioner = "efs.csi.aws.com"
+  reclaim_policy      = var.reclaim_policy
+  parameters = {
+    provisioningMode = "efs-ap" # Dynamic provisioning
+    fileSystemId     = module.efs[0].id
+    directoryPerms   = "700"
+  }
+  mount_options = [
+    "iam"
+  ]
+
+  depends_on = [
+    module.eks_blueprints_kubernetes_addons
+  ]
+}
+
+module "efs" {
+  source  = "terraform-aws-modules/efs/aws"
+  version = "~> 1.0"
+
+  count = var.enable_amazon_eks_aws_efs_csi_driver ? 1 : 0
+
+  name = lower(random_id.efs_name.hex)
+  # Mount targets / security group
+  mount_targets = {
+    for k, v in zipmap(local.availability_zone_name, var.private_subnet_ids) : k => { subnet_id = v }
+  }
+
+  security_group_description = "${local.cluster_name} EFS security group"
+  security_group_vpc_id      = var.vpc_id
+  security_group_rules = {
+    vpc = {
+      # relying on the defaults provdied for EFS/NFS (2049/TCP + ingress)
+      description = "NFS ingress from VPC private subnets"
+      cidr_blocks = var.cidr_blocks
+    }
+  }
 
   tags = var.tags
 }
 
 ################################################################################
-# Storage Classes
+# Storage Class config
 ################################################################################
 
 resource "kubernetes_annotations" "gp2" {
-  count = var.enable_gp3_default_storage_class ? 1 : 0
+  count = var.enable_gp3_default_storage_class && var.enable_amazon_eks_aws_ebs_csi_driver ? 1 : 0
 
   api_version = "storage.k8s.io/v1"
   kind        = "StorageClass"
@@ -74,7 +210,7 @@ resource "kubernetes_annotations" "gp2" {
 }
 
 resource "kubernetes_storage_class_v1" "gp3" {
-  count = var.enable_gp3_default_storage_class ? 1 : 0
+  count = var.enable_gp3_default_storage_class && var.enable_amazon_eks_aws_ebs_csi_driver ? 1 : 0
 
   metadata {
     name = "gp3"
diff --git a/examples/complete/README.md b/examples/complete/README.md
index 86bc598..5067e1f 100644
--- a/examples/complete/README.md
+++ b/examples/complete/README.md
@@ -146,26 +146,27 @@ kubectl get nodes
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_access_log_expire_days"></a> [access\_log\_expire\_days](#input\_access\_log\_expire\_days) | Number of days to wait before deleting access logs | `number` | `30` | no |
-| <a name="input_amazon_eks_aws_ebs_csi_driver_config"></a> [amazon\_eks\_aws\_ebs\_csi\_driver\_config](#input\_amazon\_eks\_aws\_ebs\_csi\_driver\_config) | configMap for AWS EBS CSI Driver add-on | `any` | `{}` | no |
 | <a name="input_aws_admin_usernames"></a> [aws\_admin\_usernames](#input\_aws\_admin\_usernames) | A list of one or more AWS usernames with authorized access to KMS and EKS resources, will automatically add the user running the terraform as an admin | `list(string)` | `[]` | no |
-| <a name="input_aws_node_termination_handler_helm_config"></a> [aws\_node\_termination\_handler\_helm\_config](#input\_aws\_node\_termination\_handler\_helm\_config) | AWS Node Termination Handler Helm Chart config | `any` | `{}` | no |
+| <a name="input_aws_efs_csi_driver"></a> [aws\_efs\_csi\_driver](#input\_aws\_efs\_csi\_driver) | AWS EFS CSI Driver helm chart config | `any` | `{}` | no |
+| <a name="input_aws_node_termination_handler"></a> [aws\_node\_termination\_handler](#input\_aws\_node\_termination\_handler) | AWS Node Termination Handler config for aws-ia/eks-blueprints-addon/aws | `any` | `{}` | no |
 | <a name="input_bastion_instance_type"></a> [bastion\_instance\_type](#input\_bastion\_instance\_type) | value for the instance type of the EKS worker nodes | `string` | `"m5.xlarge"` | no |
 | <a name="input_bastion_ssh_password"></a> [bastion\_ssh\_password](#input\_bastion\_ssh\_password) | The SSH password to use for the bastion if SSM authentication is used | `string` | `"my-password"` | no |
 | <a name="input_bastion_ssh_user"></a> [bastion\_ssh\_user](#input\_bastion\_ssh\_user) | The SSH user to use for the bastion | `string` | `"ec2-user"` | no |
 | <a name="input_bastion_tenancy"></a> [bastion\_tenancy](#input\_bastion\_tenancy) | The tenancy of the bastion | `string` | `"default"` | no |
-| <a name="input_calico_helm_config"></a> [calico\_helm\_config](#input\_calico\_helm\_config) | Calico Helm Chart config | `any` | `{}` | no |
+| <a name="input_calico"></a> [calico](#input\_calico) | Calico Helm Chart config | `any` | `{}` | no |
 | <a name="input_cluster_addons"></a> [cluster\_addons](#input\_cluster\_addons) | Nested of eks native add-ons and their associated parameters.<br>See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_add-on for supported values.<br>See https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/examples/complete/main.tf#L44-L60 for upstream example.<br><br>to see available eks marketplace addons available for your cluster's version run:<br>aws eks describe-addon-versions --kubernetes-version $k8s\_cluster\_version --query 'addons[].{MarketplaceProductUrl: marketplaceInformation.productUrl, Name: addonName, Owner: owner Publisher: publisher, Type: type}' --output table | `any` | `{}` | no |
-| <a name="input_cluster_autoscaler_helm_config"></a> [cluster\_autoscaler\_helm\_config](#input\_cluster\_autoscaler\_helm\_config) | Cluster Autoscaler Helm Chart config | `any` | `{}` | no |
+| <a name="input_cluster_autoscaler"></a> [cluster\_autoscaler](#input\_cluster\_autoscaler) | Cluster Autoscaler Helm Chart config | `any` | `{}` | no |
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Whether to enable private access to the EKS cluster | `bool` | `false` | no |
 | <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for EKS cluster | `string` | `"1.26"` | no |
 | <a name="input_create_aws_auth_configmap"></a> [create\_aws\_auth\_configmap](#input\_create\_aws\_auth\_configmap) | Determines whether to create the aws-auth configmap. NOTE - this is only intended for scenarios where the configmap does not exist (i.e. - when using only self-managed node groups). Most users should use `manage_aws_auth_configmap` | `bool` | `false` | no |
 | <a name="input_eks_use_mfa"></a> [eks\_use\_mfa](#input\_eks\_use\_mfa) | Use MFA for auth\_eks\_role | `bool` | n/a | yes |
 | <a name="input_eks_worker_tenancy"></a> [eks\_worker\_tenancy](#input\_eks\_worker\_tenancy) | The tenancy of the EKS worker nodes | `string` | `"default"` | no |
-| <a name="input_enable_amazon_eks_aws_ebs_csi_driver"></a> [enable\_amazon\_eks\_aws\_ebs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_ebs\_csi\_driver) | Enable EKS Managed AWS EBS CSI Driver add-on; enable\_amazon\_eks\_aws\_ebs\_csi\_driver and enable\_self\_managed\_aws\_ebs\_csi\_driver are mutually exclusive | `bool` | `false` | no |
+| <a name="input_enable_amazon_eks_aws_ebs_csi_driver"></a> [enable\_amazon\_eks\_aws\_ebs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_ebs\_csi\_driver) | Enable EKS Managed AWS EBS CSI Driver add-on | `bool` | `false` | no |
+| <a name="input_enable_amazon_eks_aws_efs_csi_driver"></a> [enable\_amazon\_eks\_aws\_efs\_csi\_driver](#input\_enable\_amazon\_eks\_aws\_efs\_csi\_driver) | Enable EFS CSI add-on | `bool` | `false` | no |
 | <a name="input_enable_aws_node_termination_handler"></a> [enable\_aws\_node\_termination\_handler](#input\_enable\_aws\_node\_termination\_handler) | Enable AWS Node Termination Handler add-on | `bool` | `false` | no |
+| <a name="input_enable_bastion"></a> [enable\_bastion](#input\_enable\_bastion) | If true, a bastion will be created | `bool` | `true` | no |
 | <a name="input_enable_calico"></a> [enable\_calico](#input\_enable\_calico) | Enable Calico add-on | `bool` | `true` | no |
 | <a name="input_enable_cluster_autoscaler"></a> [enable\_cluster\_autoscaler](#input\_enable\_cluster\_autoscaler) | Enable Cluster autoscaler add-on | `bool` | `false` | no |
-| <a name="input_enable_efs"></a> [enable\_efs](#input\_enable\_efs) | Enable EFS CSI add-on | `bool` | `false` | no |
 | <a name="input_enable_eks_managed_nodegroups"></a> [enable\_eks\_managed\_nodegroups](#input\_enable\_eks\_managed\_nodegroups) | Enable managed node groups | `bool` | n/a | yes |
 | <a name="input_enable_gp3_default_storage_class"></a> [enable\_gp3\_default\_storage\_class](#input\_enable\_gp3\_default\_storage\_class) | Enable gp3 as default storage class | `bool` | `false` | no |
 | <a name="input_enable_metrics_server"></a> [enable\_metrics\_server](#input\_enable\_metrics\_server) | Enable metrics server add-on | `bool` | `false` | no |
@@ -174,11 +175,10 @@ kubectl get nodes
 | <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for IAM roles | `string` | `null` | no |
 | <a name="input_kms_key_deletion_window"></a> [kms\_key\_deletion\_window](#input\_kms\_key\_deletion\_window) | Waiting period for scheduled KMS Key deletion. Can be 7-30 days. | `number` | `7` | no |
 | <a name="input_manage_aws_auth_configmap"></a> [manage\_aws\_auth\_configmap](#input\_manage\_aws\_auth\_configmap) | Determines whether to manage the aws-auth configmap | `bool` | `false` | no |
-| <a name="input_metrics_server_helm_config"></a> [metrics\_server\_helm\_config](#input\_metrics\_server\_helm\_config) | Metrics Server Helm Chart config | `any` | `{}` | no |
+| <a name="input_metrics_server"></a> [metrics\_server](#input\_metrics\_server) | Metrics Server config for aws-ia/eks-blueprints-addon/aws | `any` | `{}` | no |
 | <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | The prefix to use when naming all resources | `string` | `"ex-complete"` | no |
 | <a name="input_reclaim_policy"></a> [reclaim\_policy](#input\_reclaim\_policy) | Reclaim policy for EFS storage class, valid options are Delete and Retain | `string` | `"Delete"` | no |
 | <a name="input_region"></a> [region](#input\_region) | The AWS region to deploy into | `string` | n/a | yes |
-| <a name="input_region2"></a> [region2](#input\_region2) | The AWS region to deploy into | `string` | n/a | yes |
 | <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | A list of secondary CIDR blocks for the VPC | `list(string)` | `[]` | no |
 | <a name="input_storageclass_reclaim_policy"></a> [storageclass\_reclaim\_policy](#input\_storageclass\_reclaim\_policy) | Reclaim policy for gp3 storage class, valid options are Delete and Retain | `string` | `"Delete"` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to apply to all resources | `map(string)` | `{}` | no |
@@ -192,7 +192,7 @@ kubectl get nodes
 | <a name="output_bastion_instance_id"></a> [bastion\_instance\_id](#output\_bastion\_instance\_id) | The ID of the bastion host |
 | <a name="output_bastion_private_dns"></a> [bastion\_private\_dns](#output\_bastion\_private\_dns) | The private DNS address of the bastion host |
 | <a name="output_bastion_region"></a> [bastion\_region](#output\_bastion\_region) | The region that the bastion host was deployed to |
-| <a name="output_efs_storageclass_name"></a> [efs\_storageclass\_name](#output\_efs\_storageclass\_name) | The name of the EFS storageclass that was created (if var.enable\_efs was set to true) |
+| <a name="output_efs_storageclass_name"></a> [efs\_storageclass\_name](#output\_efs\_storageclass\_name) | The name of the EFS storageclass that was created (if var.enable\_amazon\_eks\_aws\_efs\_csi\_driver was set to true) |
 | <a name="output_eks_cluster_name"></a> [eks\_cluster\_name](#output\_eks\_cluster\_name) | The name of the EKS cluster |
 | <a name="output_vpc_cidr"></a> [vpc\_cidr](#output\_vpc\_cidr) | The CIDR block of the VPC |
 <!-- END_TF_DOCS -->
\ No newline at end of file
diff --git a/examples/complete/efs-validation.tf b/examples/complete/efs-validation.tf
index b7867d0..394b8a2 100644
--- a/examples/complete/efs-validation.tf
+++ b/examples/complete/efs-validation.tf
@@ -1,7 +1,7 @@
 # This code is used to validate that PVCs backed by EFS are working as expected. None of it is needed in production.
 
 resource "kubernetes_persistent_volume_claim_v1" "test_claim" {
-  count = var.enable_efs ? 1 : 0
+  count = var.enable_amazon_eks_aws_efs_csi_driver ? 1 : 0
   metadata {
     name      = "test-claim"
     namespace = "default"
@@ -20,7 +20,7 @@ resource "kubernetes_persistent_volume_claim_v1" "test_claim" {
 
 resource "kubernetes_job_v1" "test_write" {
   # checkov:skip=CKV_K8S_21: "The default namespace should not be used" -- This is test code, not production
-  count = var.enable_efs ? 1 : 0
+  count = var.enable_amazon_eks_aws_efs_csi_driver ? 1 : 0
   metadata {
     name      = "test-write"
     namespace = "default"
diff --git a/examples/complete/fixtures.common.tfvars b/examples/complete/fixtures.common.tfvars
index 169b398..15c3f29 100644
--- a/examples/complete/fixtures.common.tfvars
+++ b/examples/complete/fixtures.common.tfvars
@@ -61,31 +61,33 @@ cluster_addons = {
   kube-proxy = {
     most_recent = true
   }
+  aws-ebs-csi-driver = {
+    most_recent = true
+  }
 }
 
-
 #################### Blueprints addons ###################
 #wait false for all addons, as it times out on teardown in the test pipeline
 
-enable_efs = true
+enable_amazon_eks_aws_efs_csi_driver = true
+aws_efs_csi_driver = {
+  wait          = false
+  chart_version = "2.4.8"
+}
 
 enable_amazon_eks_aws_ebs_csi_driver = true
-amazon_eks_aws_ebs_csi_driver_config = {
-  wait        = false
-  most_recent = true
-}
-enable_gp3_default_storage_class = true
+enable_gp3_default_storage_class     = true
 
 enable_aws_node_termination_handler = true
-aws_node_termination_handler_helm_config = {
-  wait    = false
-  version = "v0.21.0"
+aws_node_termination_handler = {
+  wait          = false
+  chart_version = "v0.21.0"
 }
 
 enable_cluster_autoscaler = true
-cluster_autoscaler_helm_config = {
-  wait    = false
-  version = "v9.29.1"
+cluster_autoscaler = {
+  wait          = false
+  chart_version = "v9.29.1"
   # set = [
   #   {
   #     name  = "extraArgs.expander"
@@ -99,13 +101,13 @@ cluster_autoscaler_helm_config = {
 }
 
 enable_metrics_server = true
-metrics_server_helm_config = {
-  wait    = false
-  version = "v3.10.0"
+metrics_server = {
+  wait          = false
+  chart_version = "v3.10.0"
 }
 
 enable_calico = true
-calico_helm_config = {
-  wait    = false
-  version = "v3.26.1"
+calico = {
+  wait          = false
+  chart_version = "v3.26.1"
 }
diff --git a/examples/complete/fixtures.insecure.tfvars b/examples/complete/fixtures.insecure.tfvars
index 223e569..2316388 100644
--- a/examples/complete/fixtures.insecure.tfvars
+++ b/examples/complete/fixtures.insecure.tfvars
@@ -1,5 +1,5 @@
 region                         = "us-east-2"
-region2                        = "us-east-2"
+enable_bastion                 = false
 enable_eks_managed_nodegroups  = true
 enable_self_managed_nodegroups = true
 bastion_tenancy                = "default"
diff --git a/examples/complete/fixtures.secure.tfvars b/examples/complete/fixtures.secure.tfvars
index c0a11db..245293e 100644
--- a/examples/complete/fixtures.secure.tfvars
+++ b/examples/complete/fixtures.secure.tfvars
@@ -1,5 +1,4 @@
 region                         = "us-east-2"
-region2                        = "us-east-1"
 enable_eks_managed_nodegroups  = false
 enable_self_managed_nodegroups = true
 bastion_tenancy                = "dedicated"
diff --git a/examples/complete/main.tf b/examples/complete/main.tf
index 988072b..ead99e7 100644
--- a/examples/complete/main.tf
+++ b/examples/complete/main.tf
@@ -13,7 +13,129 @@ locals {
   access_logging_name_prefix = "${var.name_prefix}-accesslog-${lower(random_id.default.hex)}"
   kms_key_alias_name_prefix  = "alias/${var.name_prefix}-${lower(random_id.default.hex)}"
   access_log_sqs_queue_name  = "${var.name_prefix}-accesslog-access-${lower(random_id.default.hex)}"
+  tags = merge(
+    var.tags,
+    {
+      RootTFModule = replace(basename(path.cwd), "_", "-") # tag names based on the directory name
+      GithubRepo   = "github.com/defenseunicorns/terraform-aws-uds-eks"
+    }
+  )
+}
+
+################################################################################
+# VPC
+################################################################################
+
+module "vpc" {
+  source = "git::https://github.com/defenseunicorns/terraform-aws-uds-vpc.git?ref=tags/v0.0.1-alpha"
+
+  name                  = local.vpc_name
+  vpc_cidr              = var.vpc_cidr
+  secondary_cidr_blocks = var.secondary_cidr_blocks
+  azs                   = ["${var.region}a", "${var.region}b", "${var.region}c"]
+  public_subnets        = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k)]
+  private_subnets       = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k + 4)]
+  database_subnets      = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k + 8)]
+  intra_subnets         = [for k, v in module.vpc.azs : cidrsubnet(element(module.vpc.vpc_secondary_cidr_blocks, 0), 5, k)]
+  single_nat_gateway    = true
+  enable_nat_gateway    = true
+
+  private_subnet_tags = {
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+    "kubernetes.io/role/internal-elb"             = 1
+  }
+  create_database_subnet_group = true
+
+  instance_tenancy                  = "default"
+  vpc_flow_log_permissions_boundary = var.iam_role_permissions_boundary
+
+  tags = local.tags
+}
+
+################################################################################
+# Bastion instance
+################################################################################
+locals {
+  bastion_role_arn  = try(module.bastion[0].bastion_role_arn, "")
+  bastion_role_name = try(module.bastion[0].bastion_role_name, "")
+
+  enable_bastion_access = length(local.bastion_role_arn) > 0 && length(local.bastion_role_name) > 0
+
+  ingress_bastion_to_cluster = {
+    description              = "Bastion SG to Cluster"
+    security_group_id        = module.eks.cluster_security_group_id
+    from_port                = 443
+    to_port                  = 443
+    protocol                 = "tcp"
+    type                     = "ingress"
+    source_security_group_id = try(module.bastion[0].security_group_ids[0], null)
+  }
+
+  # if bastion role vars are defined, add bastion role to aws_auth_roles list
+  bastion_aws_auth_entry = local.enable_bastion_access ? [
+    {
+      rolearn  = local.bastion_role_arn
+      username = local.bastion_role_name
+      groups   = ["system:masters"]
+  }] : []
+}
+
+data "aws_ami" "amazonlinux2" {
+  count = var.enable_bastion ? 1 : 0
+
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["amzn2-ami-hvm*x86_64-gp2"]
+  }
+
+  owners = ["amazon"]
+}
+
+module "bastion" {
+  source = "git::https://github.com/defenseunicorns/terraform-aws-uds-bastion.git?ref=tags/v0.0.1-alpha"
+
+  count = var.enable_bastion ? 1 : 0
+
+  enable_bastion_terraform_permissions = true
+
+  ami_id        = data.aws_ami.amazonlinux2[0].id
+  instance_type = var.bastion_instance_type
+  root_volume_config = {
+    volume_type = "gp3"
+    volume_size = "20"
+    encrypted   = true
+  }
+  name                           = local.bastion_name
+  vpc_id                         = module.vpc.vpc_id
+  subnet_id                      = module.vpc.private_subnets[0]
+  region                         = var.region
+  access_logs_bucket_name        = aws_s3_bucket.access_log_bucket.id
+  session_log_bucket_name_prefix = "${local.bastion_name}-sessionlogs"
+  kms_key_arn                    = aws_kms_key.default.arn
+  ssh_user                       = var.bastion_ssh_user
+  ssh_password                   = var.bastion_ssh_password
+  assign_public_ip               = false
+  enable_log_to_s3               = true
+  enable_log_to_cloudwatch       = true
+  tenancy                        = var.bastion_tenancy
+  zarf_version                   = var.zarf_version
+  permissions_boundary           = var.iam_role_permissions_boundary
+  tags = merge(
+    local.tags,
+  { Function = "bastion-ssm" })
+}
 
+################################################################################
+# EKS Cluster
+################################################################################
+
+locals {
+  cluster_security_group_additional_rules = merge(
+    var.enable_bastion ? { ingress_bastion_to_cluster = local.ingress_bastion_to_cluster } : {},
+    #other rules here
+  )
   eks_managed_node_group_defaults = {
     # https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/node_groups.tf
     iam_role_permissions_boundary = var.iam_role_permissions_boundary
@@ -41,31 +163,19 @@ locals {
 
   self_managed_node_group_defaults = {
     iam_role_permissions_boundary          = var.iam_role_permissions_boundary
-    instance_type                          = "m5a.large" # should be compatible with dedicated tenancy in GovCloud region https://aws.amazon.com/ec2/pricing/dedicated-instances/#Dedicated_On-Demand_instances
+    instance_type                          = null
     update_launch_template_default_version = true
 
     use_mixed_instances_policy = true
 
-    mixed_instances_policy = {
-      instances_distribution = {
-        on_demand_base_capacity                  = 2
-        on_demand_percentage_above_base_capacity = 20
-        spot_allocation_strategy                 = "capacity-optimized"
+    instance_requirements = {
+      allowed_instance_types = ["m7i.4xlarge", "m6a.4xlarge", "m5a.4xlarge"] #this should be adjusted to the appropriate instance family if reserved instances are being utilized
+      memory_mib = {
+        min = 64000
+      }
+      vcpu_count = {
+        min = 16
       }
-
-      override = [
-        {
-          instance_requirements = {
-            allowed_instance_types = ["m5a.large", "m5.large", "m6i.large"] #this should be adjusted to the appropriate instance family if reserved instances are being utilized
-            memory_mib = {
-              min = 8192
-            }
-            vcpu_count = {
-              min = 2
-            }
-          }
-        }
-      ]
     }
 
     placement = {
@@ -92,7 +202,7 @@ locals {
 
     # enable discovery of autoscaling groups by cluster-autoscaler
     autoscaling_group_tags = merge(
-      var.tags,
+      local.tags,
       {
         "k8s.io/cluster-autoscaler/enabled" : true,
         "k8s.io/cluster-autoscaler/${local.cluster_name}" : "owned"
@@ -133,102 +243,24 @@ locals {
   self_managed_node_groups = var.enable_self_managed_nodegroups ? local.mission_app_self_mg_node_group : {}
 }
 
-###########################################################
-####################### VPC ###############################
-
-module "vpc" {
-  source = "git::https://github.com/defenseunicorns/terraform-aws-uds-vpc.git?ref=tags/v0.0.1-alpha"
-
-  name                  = local.vpc_name
-  vpc_cidr              = var.vpc_cidr
-  secondary_cidr_blocks = var.secondary_cidr_blocks
-  azs                   = ["${var.region}a", "${var.region}b", "${var.region}c"]
-  public_subnets        = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k)]
-  private_subnets       = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k + 4)]
-  database_subnets      = [for k, v in module.vpc.azs : cidrsubnet(module.vpc.vpc_cidr_block, 5, k + 8)]
-  intra_subnets         = [for k, v in module.vpc.azs : cidrsubnet(element(module.vpc.vpc_secondary_cidr_blocks, 0), 5, k)]
-  single_nat_gateway    = true
-  enable_nat_gateway    = true
-
-  private_subnet_tags = {
-    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
-    "kubernetes.io/role/internal-elb"             = 1
-  }
-  create_database_subnet_group = true
-
-  instance_tenancy                  = "default"
-  vpc_flow_log_permissions_boundary = var.iam_role_permissions_boundary
-
-  tags = var.tags
-}
-
-###########################################################
-##################### Bastion #############################
-
-data "aws_ami" "amazonlinux2" {
-  most_recent = true
-
-  filter {
-    name   = "name"
-    values = ["amzn2-ami-hvm*x86_64-gp2"]
-  }
-
-  owners = ["amazon"]
-}
-
-module "bastion" {
-  source = "git::https://github.com/defenseunicorns/terraform-aws-uds-bastion.git?ref=tags/v0.0.1-alpha"
-
-  enable_bastion_terraform_permissions = true
-
-  ami_id        = data.aws_ami.amazonlinux2.id
-  instance_type = var.bastion_instance_type
-  root_volume_config = {
-    volume_type = "gp3"
-    volume_size = "20"
-    encrypted   = true
-  }
-  name                           = local.bastion_name
-  vpc_id                         = module.vpc.vpc_id
-  subnet_id                      = module.vpc.private_subnets[0]
-  region                         = var.region
-  access_logs_bucket_name        = aws_s3_bucket.access_log_bucket.id
-  session_log_bucket_name_prefix = "${local.bastion_name}-sessionlogs"
-  kms_key_arn                    = aws_kms_key.default.arn
-  ssh_user                       = var.bastion_ssh_user
-  ssh_password                   = var.bastion_ssh_password
-  assign_public_ip               = false
-  enable_log_to_s3               = true
-  enable_log_to_cloudwatch       = true
-  tenancy                        = var.bastion_tenancy
-  zarf_version                   = var.zarf_version
-  permissions_boundary           = var.iam_role_permissions_boundary
-  tags = merge(
-    var.tags,
-  { Function = "bastion-ssm" })
-}
-
-###########################################################
-################### EKS Cluster ###########################
 module "eks" {
   source = "../.."
 
-  name                            = local.cluster_name
-  aws_region                      = var.region
-  vpc_id                          = module.vpc.vpc_id
-  private_subnet_ids              = module.vpc.private_subnets
-  control_plane_subnet_ids        = module.vpc.private_subnets
-  iam_role_permissions_boundary   = var.iam_role_permissions_boundary
-  source_security_group_id        = module.bastion.security_group_ids[0]
-  cluster_endpoint_public_access  = var.cluster_endpoint_public_access
-  cluster_endpoint_private_access = true
-  vpc_cni_custom_subnet           = module.vpc.intra_subnets
-  aws_admin_usernames             = var.aws_admin_usernames
-  cluster_version                 = var.cluster_version
-  bastion_role_arn                = module.bastion.bastion_role_arn
-  bastion_role_name               = module.bastion.bastion_role_name
-  cidr_blocks                     = module.vpc.private_subnets_cidr_blocks
-  eks_use_mfa                     = var.eks_use_mfa
+  name                                    = local.cluster_name
+  aws_region                              = var.region
+  vpc_id                                  = module.vpc.vpc_id
+  private_subnet_ids                      = module.vpc.private_subnets
+  control_plane_subnet_ids                = module.vpc.private_subnets
+  iam_role_permissions_boundary           = var.iam_role_permissions_boundary
+  cluster_security_group_additional_rules = local.cluster_security_group_additional_rules
+  cluster_endpoint_public_access          = var.cluster_endpoint_public_access
+  cluster_endpoint_private_access         = true
+  vpc_cni_custom_subnet                   = module.vpc.intra_subnets
+  aws_admin_usernames                     = var.aws_admin_usernames
+  cluster_version                         = var.cluster_version
+  cidr_blocks                             = module.vpc.private_subnets_cidr_blocks
+  eks_use_mfa                             = var.eks_use_mfa
+  aws_auth_roles                          = local.bastion_aws_auth_entry
 
   # If using EKS Managed Node Groups, the aws-auth ConfigMap is created by eks itself and terraform can not create it
   create_aws_auth_configmap = var.create_aws_auth_configmap
@@ -242,7 +274,7 @@ module "eks" {
   self_managed_node_group_defaults = local.self_managed_node_group_defaults
   self_managed_node_groups         = local.self_managed_node_groups
 
-  tags = var.tags
+  tags = local.tags
 
 
 
@@ -253,32 +285,37 @@ module "eks" {
   cluster_addons = var.cluster_addons
 
   #---------------------------------------------------------------
-  # EKS Blueprints - EKS Add-Ons
+  # EKS Blueprints - blueprints curated helm charts
   #---------------------------------------------------------------
 
   # AWS EKS EBS CSI Driver
   enable_amazon_eks_aws_ebs_csi_driver = var.enable_amazon_eks_aws_ebs_csi_driver
-  amazon_eks_aws_ebs_csi_driver_config = var.amazon_eks_aws_ebs_csi_driver_config
   enable_gp3_default_storage_class     = var.enable_gp3_default_storage_class
   storageclass_reclaim_policy          = var.storageclass_reclaim_policy
 
   # AWS EKS EFS CSI Driver
-  enable_efs     = var.enable_efs
+  enable_amazon_eks_aws_efs_csi_driver = var.enable_amazon_eks_aws_efs_csi_driver
+  aws_efs_csi_driver                   = var.aws_efs_csi_driver
+
   reclaim_policy = var.reclaim_policy
 
   # AWS EKS node termination handler
-  enable_aws_node_termination_handler      = var.enable_aws_node_termination_handler
-  aws_node_termination_handler_helm_config = var.aws_node_termination_handler_helm_config
+  enable_aws_node_termination_handler = var.enable_aws_node_termination_handler
+  aws_node_termination_handler        = var.aws_node_termination_handler
 
   # k8s Metrics Server
-  enable_metrics_server      = var.enable_metrics_server
-  metrics_server_helm_config = var.metrics_server_helm_config
+  enable_metrics_server = var.enable_metrics_server
+  metrics_server        = var.metrics_server
 
   # k8s Cluster Autoscaler
-  enable_cluster_autoscaler      = var.enable_cluster_autoscaler
-  cluster_autoscaler_helm_config = var.cluster_autoscaler_helm_config
+  enable_cluster_autoscaler = var.enable_cluster_autoscaler
+  cluster_autoscaler        = var.cluster_autoscaler
+
+  #----------------------------------------------------------------
+  # custom helm charts
+  #----------------------------------------------------------------
 
   #Calico
-  enable_calico      = var.enable_calico
-  calico_helm_config = var.calico_helm_config
+  enable_calico = var.enable_calico
+  calico        = var.calico
 }
diff --git a/examples/complete/outputs.tf b/examples/complete/outputs.tf
index 6ea937a..0199c71 100644
--- a/examples/complete/outputs.tf
+++ b/examples/complete/outputs.tf
@@ -3,19 +3,19 @@
 
 output "bastion_instance_id" {
   description = "The ID of the bastion host"
-  value       = module.bastion.instance_id
+  value       = try(module.bastion[0].instance_id, null)
   sensitive   = true
 }
 
 output "bastion_region" {
   description = "The region that the bastion host was deployed to"
-  value       = module.bastion.region
+  value       = try(module.bastion[0].region, null)
   sensitive   = true
 }
 
 output "bastion_private_dns" {
   description = "The private DNS address of the bastion host"
-  value       = module.bastion.private_dns
+  value       = try(module.bastion[0].private_dns, null)
   sensitive   = true
 }
 
@@ -32,6 +32,6 @@ output "eks_cluster_name" {
 }
 
 output "efs_storageclass_name" {
-  description = "The name of the EFS storageclass that was created (if var.enable_efs was set to true)"
+  description = "The name of the EFS storageclass that was created (if var.enable_amazon_eks_aws_efs_csi_driver was set to true)"
   value       = try(module.eks.efs_storageclass_name, null)
 }
diff --git a/examples/complete/providers.tf b/examples/complete/providers.tf
index 1e1e3d8..d5c372c 100644
--- a/examples/complete/providers.tf
+++ b/examples/complete/providers.tf
@@ -55,14 +55,6 @@ provider "aws" {
   # }
 }
 
-provider "aws" {
-  alias  = "region2"
-  region = var.region2
-  # default_tags {
-  #   tags = var.tags #bug https://github.com/hashicorp/terraform-provider-aws/issues/19583#issuecomment-855773246
-  # }
-}
-
 provider "kubernetes" {
   host                   = module.eks.cluster_endpoint
   cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf
index 4fade98..c84d172 100644
--- a/examples/complete/variables.tf
+++ b/examples/complete/variables.tf
@@ -6,11 +6,6 @@ variable "region" {
   type        = string
 }
 
-variable "region2" {
-  description = "The AWS region to deploy into"
-  type        = string
-}
-
 variable "name_prefix" {
   description = "The prefix to use when naming all resources"
   type        = string
@@ -139,17 +134,11 @@ EOD
 
 #----------------AWS EBS CSI Driver-------------------------
 variable "enable_amazon_eks_aws_ebs_csi_driver" {
-  description = "Enable EKS Managed AWS EBS CSI Driver add-on; enable_amazon_eks_aws_ebs_csi_driver and enable_self_managed_aws_ebs_csi_driver are mutually exclusive"
+  description = "Enable EKS Managed AWS EBS CSI Driver add-on"
   type        = bool
   default     = false
 }
 
-variable "amazon_eks_aws_ebs_csi_driver_config" {
-  description = "configMap for AWS EBS CSI Driver add-on"
-  type        = any
-  default     = {}
-}
-
 variable "enable_gp3_default_storage_class" {
   description = "Enable gp3 as default storage class"
   type        = bool
@@ -169,8 +158,8 @@ variable "enable_metrics_server" {
   default     = false
 }
 
-variable "metrics_server_helm_config" {
-  description = "Metrics Server Helm Chart config"
+variable "metrics_server" {
+  description = "Metrics Server config for aws-ia/eks-blueprints-addon/aws"
   type        = any
   default     = {}
 }
@@ -182,8 +171,8 @@ variable "enable_aws_node_termination_handler" {
   default     = false
 }
 
-variable "aws_node_termination_handler_helm_config" {
-  description = "AWS Node Termination Handler Helm Chart config"
+variable "aws_node_termination_handler" {
+  description = "AWS Node Termination Handler config for aws-ia/eks-blueprints-addon/aws"
   type        = any
   default     = {}
 }
@@ -195,19 +184,25 @@ variable "enable_cluster_autoscaler" {
   default     = false
 }
 
-variable "cluster_autoscaler_helm_config" {
+variable "cluster_autoscaler" {
   description = "Cluster Autoscaler Helm Chart config"
   type        = any
   default     = {}
 }
 
 #----------------Enable_EFS_CSI-------------------------
-variable "enable_efs" {
+variable "enable_amazon_eks_aws_efs_csi_driver" {
   description = "Enable EFS CSI add-on"
   type        = bool
   default     = false
 }
 
+variable "aws_efs_csi_driver" {
+  description = "AWS EFS CSI Driver helm chart config"
+  type        = any
+  default     = {}
+}
+
 variable "reclaim_policy" {
   description = "Reclaim policy for EFS storage class, valid options are Delete and Retain"
   type        = string
@@ -221,7 +216,7 @@ variable "enable_calico" {
   default     = true
 }
 
-variable "calico_helm_config" {
+variable "calico" {
   description = "Calico Helm Chart config"
   type        = any
   default     = {}
@@ -259,3 +254,9 @@ variable "zarf_version" {
   type        = string
   default     = ""
 }
+
+variable "enable_bastion" {
+  description = "If true, a bastion will be created"
+  type        = bool
+  default     = true
+}
diff --git a/locals.tf b/locals.tf
index 8518353..8d80083 100644
--- a/locals.tf
+++ b/locals.tf
@@ -2,50 +2,5 @@ locals {
   availability_zone_name = slice(data.aws_availability_zones.available.names, 0, 3)
   azs                    = slice(data.aws_availability_zones.available.names, 0, 3)
 
-  # var.cluster_name is for Terratest
-
   cluster_name = coalesce(var.cluster_name, var.name)
-  admin_arns = distinct(concat(
-    [for admin_user in var.aws_admin_usernames : "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/${admin_user}"],
-    [data.aws_caller_identity.current.arn]
-  ))
-  aws_auth_users = [for admin_user in var.aws_admin_usernames : {
-    userarn  = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/${admin_user}"
-    username = admin_user
-    groups   = ["system:masters"]
-  }]
-
-  eks_admin_arns = length(local.admin_arns) == 0 ? [] : local.admin_arns
-
-  # Used to resolve non-MFA policy. See https://docs.fugue.co/FG_R00255.html
-  auth_eks_role_policy = var.eks_use_mfa ? jsonencode({
-    Version = "2012-10-17",
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Principal = {
-          AWS = local.eks_admin_arns
-        },
-        Effect = "Allow"
-        Sid    = ""
-        Condition = {
-          Bool = {
-            "aws:MultiFactorAuthPresent" = "true"
-          }
-        }
-      }
-    ]
-    }) : jsonencode({
-    Version = "2012-10-17",
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Principal = {
-          AWS = local.eks_admin_arns
-        },
-        Effect = "Allow"
-        Sid    = ""
-      }
-    ]
-  })
 }
diff --git a/main.tf b/main.tf
index 83d5e91..1959ad8 100644
--- a/main.tf
+++ b/main.tf
@@ -1,6 +1,73 @@
-#---------------------------------------------------------------
-# EKS Blueprints
-#---------------------------------------------------------------
+###############################################################
+# EKS Cluster
+###############################################################
+locals {
+  admin_arns = distinct(concat(
+    [for admin_user in var.aws_admin_usernames : "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/${admin_user}"],
+    [data.aws_caller_identity.current.arn]
+  ))
+  aws_auth_users = [for admin_user in var.aws_admin_usernames : {
+    userarn  = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/${admin_user}"
+    username = admin_user
+    groups   = ["system:masters"]
+  }]
+
+  eks_admin_arns = length(local.admin_arns) == 0 ? [] : local.admin_arns
+
+  # Used to resolve non-MFA policy. See https://docs.fugue.co/FG_R00255.html
+  auth_eks_role_policy = var.eks_use_mfa ? jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Principal = {
+          AWS = local.eks_admin_arns
+        },
+        Effect = "Allow"
+        Sid    = ""
+        Condition = {
+          Bool = {
+            "aws:MultiFactorAuthPresent" = "true"
+          }
+        }
+      }
+    ]
+    }) : jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Principal = {
+          AWS = local.eks_admin_arns
+        },
+        Effect = "Allow"
+        Sid    = ""
+      }
+    ]
+  })
+
+  aws_eks_auth_roles = concat(
+    var.aws_auth_roles,
+    [
+      {
+        rolearn  = aws_iam_role.auth_eks_role.arn
+        username = aws_iam_role.auth_eks_role.name
+        groups   = ["system:masters"]
+      }
+  ])
+
+  #merge in irsa role arn
+  ebs_csi_driver_addon_extra_config = var.enable_amazon_eks_aws_ebs_csi_driver ? {
+    aws-ebs-csi-driver = {
+      service_account_role_arn = module.ebs_csi_driver_irsa[0].iam_role_arn
+    }
+  } : {}
+
+  cluster_addons = merge(
+    var.cluster_addons,
+    local.ebs_csi_driver_addon_extra_config
+  )
+}
 
 module "aws_eks" {
   source = "git::https://github.com/terraform-aws-modules/terraform-aws-eks.git?ref=v19.15.3"
@@ -22,7 +89,7 @@ module "aws_eks" {
 
   dataplane_wait_duration = var.dataplane_wait_duration
 
-  cluster_addons = var.cluster_addons
+  cluster_addons = local.cluster_addons
 
   #----------------------------------------------------------------------------------------------------------#
   # Security groups used in this module created by the upstream modules terraform-aws-eks (https://github.com/terraform-aws-modules/terraform-aws-eks).
@@ -30,42 +97,19 @@ module "aws_eks" {
   #   So, by default the security groups are restrictive. Users needs to enable rules for specific ports required for App requirement or Add-ons
   #   See the notes below for each rule used in these examples
   #----------------------------------------------------------------------------------------------------------#
-  cluster_security_group_additional_rules = {
-    ingress_bastion_to_cluster = {
-      # name        = "allow bastion ingress to cluster"
-      description              = "Bastion SG to Cluster"
-      security_group_id        = module.aws_eks.cluster_security_group_id
-      from_port                = 443
-      to_port                  = 443
-      protocol                 = "tcp"
-      type                     = "ingress"
-      source_security_group_id = var.source_security_group_id
-    }
-  }
+  cluster_security_group_additional_rules = var.cluster_security_group_additional_rules
+
 
   create_aws_auth_configmap = var.create_aws_auth_configmap
   manage_aws_auth_configmap = var.manage_aws_auth_configmap
 
   kms_key_administrators = distinct(concat(local.admin_arns, var.kms_key_administrators))
   aws_auth_users         = distinct(concat(local.aws_auth_users, var.aws_auth_users))
-  aws_auth_roles = [
-    {
-      rolearn  = aws_iam_role.auth_eks_role.arn
-      username = aws_iam_role.auth_eks_role.name
-      groups   = ["system:masters"]
-    },
-    {
-      rolearn  = var.bastion_role_arn
-      username = var.bastion_role_name
-      groups   = ["system:masters"]
-    }
-  ]
+  aws_auth_roles         = local.aws_eks_auth_roles
 
   tags = var.tags
 }
 
-
-
 resource "aws_iam_role" "auth_eks_role" {
   name                 = "${var.name}-auth-eks-role"
   description          = "EKS AuthConfig Role"
@@ -73,59 +117,3 @@ resource "aws_iam_role" "auth_eks_role" {
   assume_role_policy   = local.auth_eks_role_policy
   # max_session_duration = var.eks_iam_role_max_session
 }
-
-#---------------------------------------------------------------
-# EFS Configurations
-#---------------------------------------------------------------
-
-resource "random_id" "efs_name" {
-  byte_length = 2
-  prefix      = "EFS-"
-}
-
-resource "kubernetes_storage_class_v1" "efs" {
-  count = var.enable_efs ? 1 : 0
-  metadata {
-    name = lower(random_id.efs_name.hex)
-  }
-
-  storage_provisioner = "efs.csi.aws.com"
-  reclaim_policy      = var.reclaim_policy
-  parameters = {
-    provisioningMode = "efs-ap" # Dynamic provisioning
-    fileSystemId     = module.efs[0].id
-    directoryPerms   = "700"
-  }
-  mount_options = [
-    "iam"
-  ]
-
-  depends_on = [
-    module.eks_blueprints_kubernetes_addons
-  ]
-}
-
-module "efs" {
-  source  = "terraform-aws-modules/efs/aws"
-  version = "~> 1.0"
-
-  count = var.enable_efs ? 1 : 0
-
-  name = lower(random_id.efs_name.hex)
-  # Mount targets / security group
-  mount_targets = {
-    for k, v in zipmap(local.availability_zone_name, var.private_subnet_ids) : k => { subnet_id = v }
-  }
-
-  security_group_description = "${local.cluster_name} EFS security group"
-  security_group_vpc_id      = var.vpc_id
-  security_group_rules = {
-    vpc = {
-      # relying on the defaults provdied for EFS/NFS (2049/TCP + ingress)
-      description = "NFS ingress from VPC private subnets"
-      cidr_blocks = var.cidr_blocks
-    }
-  }
-
-  tags = var.tags
-}
diff --git a/outputs.tf b/outputs.tf
index f8f8f74..ef40db3 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -42,7 +42,7 @@ output "cluster_certificate_authority_data" {
 }
 
 output "efs_storageclass_name" {
-  description = "The name of the EFS storageclass that was created (if var.enable_efs was set to true)"
+  description = "The name of the EFS storageclass that was created (if var.enable_amazon_eks_aws_efs_csi_driver was set to true)"
   value       = try(kubernetes_storage_class_v1.efs[0].id, null)
 }
 
@@ -50,3 +50,8 @@ output "cluster_iam_role_arn" {
   description = "EKS cluster IAM role ARN"
   value       = module.aws_eks.cluster_iam_role_arn
 }
+
+output "cluster_security_group_id" {
+  description = "EKS cluster security group ID"
+  value       = module.aws_eks.cluster_security_group_id
+}
diff --git a/variables.tf b/variables.tf
index 5d8343a..27e31f0 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1,6 +1,6 @@
 # tflint-ignore: terraform_unused_declarations
 variable "cluster_name" {
-  description = "Name of cluster - used by Terratest for e2e test automation"
+  description = "Name of cluster"
   type        = string
   default     = ""
 }
@@ -85,6 +85,12 @@ variable "aws_admin_usernames" {
   default     = []
 }
 
+variable "aws_auth_roles" {
+  description = "List of role maps to add to the aws-auth configmap"
+  type        = list(any)
+  default     = []
+}
+
 variable "create_aws_auth_configmap" {
   description = "Determines whether to create the aws-auth configmap. NOTE - this is only intended for scenarios where the configmap does not exist (i.e. - when using only self-managed node groups). Most users should use `manage_aws_auth_configmap`"
   type        = bool
@@ -121,22 +127,10 @@ variable "vpc_cni_custom_subnet" {
   default     = []
 }
 
-variable "source_security_group_id" {
-  description = "List of additional rules to add to cluster security group"
-  type        = string
-  default     = ""
-}
-
-variable "bastion_role_arn" {
-  description = "ARN of role authorized kubectl access"
-  type        = string
-  default     = ""
-}
-
-variable "bastion_role_name" {
-  description = "Name of role authorized kubectl access"
-  type        = string
-  default     = ""
+variable "cluster_security_group_additional_rules" {
+  description = "List of additional security group rules to add to the cluster security group created. Set `source_node_security_group = true` inside rules to set the `node_security_group` as source"
+  type        = any
+  default     = {}
 }
 
 variable "dataplane_wait_duration" {
@@ -191,17 +185,11 @@ EOD
 
 #----------------AWS EBS CSI Driver-------------------------
 variable "enable_amazon_eks_aws_ebs_csi_driver" {
-  description = "Enable EKS Managed AWS EBS CSI Driver add-on; enable_amazon_eks_aws_ebs_csi_driver and enable_self_managed_aws_ebs_csi_driver are mutually exclusive"
+  description = "Enable EKS Managed AWS EBS CSI Driver add-on"
   type        = bool
   default     = false
 }
 
-variable "amazon_eks_aws_ebs_csi_driver_config" {
-  description = "configMap for AWS EBS CSI Driver add-on"
-  type        = any
-  default     = {}
-}
-
 variable "enable_gp3_default_storage_class" {
   description = "Enable gp3 as default storage class"
   type        = bool
@@ -215,11 +203,16 @@ variable "storageclass_reclaim_policy" {
 }
 
 #----------------AWS EFS CSI Driver-------------------------
-variable "enable_efs" {
+variable "enable_amazon_eks_aws_efs_csi_driver" {
   description = "Enable EFS CSI Driver add-on"
   type        = bool
   default     = false
+}
 
+variable "aws_efs_csi_driver" {
+  description = "AWS EFS CSI Driver helm chart config"
+  type        = any
+  default     = {}
 }
 
 variable "reclaim_policy" {
@@ -239,8 +232,8 @@ variable "enable_metrics_server" {
   default     = false
 }
 
-variable "metrics_server_helm_config" {
-  description = "Metrics Server Helm Chart config"
+variable "metrics_server" {
+  description = "Metrics Server config for aws-ia/eks-blueprints-addon/aws"
   type        = any
   default     = {}
 }
@@ -252,12 +245,11 @@ variable "enable_aws_node_termination_handler" {
   default     = false
 }
 
-variable "aws_node_termination_handler_helm_config" {
-  description = "AWS Node Termination Handler Helm Chart config"
+variable "aws_node_termination_handler" {
+  description = "AWS Node Termination Handler config for aws-ia/eks-blueprints-addon/aws"
   type        = any
   default     = {}
 }
-
 #----------------Cluster Autoscaler-------------------------
 variable "enable_cluster_autoscaler" {
   description = "Enable Cluster autoscaler add-on"
@@ -265,7 +257,7 @@ variable "enable_cluster_autoscaler" {
   default     = false
 }
 
-variable "cluster_autoscaler_helm_config" {
+variable "cluster_autoscaler" {
   description = "Cluster Autoscaler Helm Chart config"
   type        = any
   default = {
@@ -294,10 +286,10 @@ variable "cluster_autoscaler_helm_config" {
 variable "enable_calico" {
   description = "Enable Calico add-on"
   type        = bool
-  default     = false
+  default     = true
 }
 
-variable "calico_helm_config" {
+variable "calico" {
   description = "Calico Helm Chart config"
   type        = any
   default     = {}