diff --git a/.github/workflows/devel_pipeline_validation.yml b/.github/workflows/devel_pipeline_validation.yml
index 134973f..e02fe1f 100644
--- a/.github/workflows/devel_pipeline_validation.yml
+++ b/.github/workflows/devel_pipeline_validation.yml
@@ -1,139 +1,159 @@
 ---
 
-    name: Devel pipeline
-
-    on: # yamllint disable-line rule:truthy
-      pull_request_target:
-          types: [opened, reopened, synchronize]
-          branches:
-              - devel
-          paths:
-              - '**.yml'
-              - '**.sh'
-              - '**.j2'
-              - '**.ps1'
-              - '**.cfg'
-
-    # A workflow run is made up of one or more jobs
-    # that can run sequentially or in parallel
-    jobs:
-      # This will create messages for first time contributers and direct them to the Discord server
-        welcome:
-          runs-on: ubuntu-latest
-
-          steps:
-              - uses: actions/first-interaction@main
-                with:
-                  repo-token: ${{ secrets.GITHUB_TOKEN }}
-                  pr-message: |-
-                      Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
-                      Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
-
-        # This workflow contains a single job that tests the playbook
-        playbook-test:
-          # The type of runner that the job will run on
-          runs-on: ubuntu-latest
-          env:
-            ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
-            # Imported as a variable by terraform
-            TF_VAR_repository: ${{ github.event.repository.name }}
-          defaults:
-            run:
-              shell: bash
-              working-directory: .github/workflows/github_linux_IaC
-
-          steps:
-            - name: Clone ${{ github.event.repository.name }}
-              uses: actions/checkout@v4
+  name: Devel pipeline
+
+  on: # yamllint disable-line rule:truthy
+    pull_request_target:
+        types: [opened, reopened, synchronize]
+        branches:
+            - devel
+        paths:
+            - '**.yml'
+            - '**.sh'
+            - '**.j2'
+            - '**.ps1'
+            - '**.cfg'
+    # Allow manual running of workflow
+    workflow_dispatch:
+
+  # Allow permissions for AWS auth
+  permissions:
+    id-token: write
+    contents: read
+    pull-requests: read
+
+  # A workflow run is made up of one or more jobs
+  # that can run sequentially or in parallel
+  jobs:
+    # This will create messages for first time contributers and direct them to the Discord server
+      welcome:
+        runs-on: self-hosted
+
+        steps:
+            - uses: actions/first-interaction@main
               with:
-                ref: ${{ github.event.pull_request.head.sha }}
-
-            # Pull in terraform code for linux servers
-            - name: Clone GitHub IaC plan
-              uses: actions/checkout@v4
-              with:
-                repository: ansible-lockdown/github_linux_IaC
-                path: .github/workflows/github_linux_IaC
-
-            - name: Add_ssh_key
-              working-directory: .github/workflows
-              env:
-                  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-                  PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
-              run: |
-                mkdir .ssh
-                chmod 700 .ssh
-                echo $PRIVATE_KEY > .ssh/github_actions.pem
-                chmod 600 .ssh/github_actions.pem
-
-            - name: DEBUG - Show IaC files
-              if: env.ENABLE_DEBUG == 'true'
-              run: |
-                echo "OSVAR = $OSVAR"
-                echo "benchmark_type = $benchmark_type"
-                pwd
-                ls
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Init
-              id: init
-              run: terraform init
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Validate
-              id: validate
-              run: terraform validate
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Apply
-              id: apply
-              env:
-                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-              run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
-
-  ## Debug Section
-            - name: DEBUG - Show Ansible hostfile
-              if: env.ENABLE_DEBUG == 'true'
-              run: cat hosts.yml
-
-      # Aws deployments taking a while to come up insert sleep or playbook fails
-
-            - name: Sleep for 60 seconds
-              run: sleep ${{ vars.BUILD_SLEEPTIME }}
-
-          # Run the Ansible playbook
-            - name: Run_Ansible_Playbook
-              uses: arillso/action.playbook@master
-              with:
-                playbook: site.yml
-                inventory: .github/workflows/github_linux_IaC/hosts.yml
-                galaxy_file: collections/requirements.yml
-                private_key: ${{ secrets.SSH_PRV_KEY }}
-        #          verbose: 3
-              env:
-                ANSIBLE_HOST_KEY_CHECKING: "false"
-                ANSIBLE_DEPRECATION_WARNINGS: "false"
-                ANSIBLE_INJECT_FACT_VARS: "false"
-
-          # Remove test system - User secrets to keep if necessary
-
-            - name: Terraform_Destroy
-              if: always() && env.ENABLE_DEBUG == 'false'
-              env:
-                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-              run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+                repo-token: ${{ secrets.GITHUB_TOKEN }}
+                pr-message: |-
+                    Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+                    Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
+
+      # This workflow contains a single job that tests the playbook
+      playbook-test:
+        # The type of runner that the job will run on
+        runs-on: self-hosted
+        env:
+          ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
+          # Imported as a variable by terraform
+          TF_VAR_repository: ${{ github.event.repository.name }}
+          AWS_REGION: "us-east-1"
+          ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
+        defaults:
+          run:
+            shell: bash
+            working-directory: .github/workflows/github_linux_IaC
+            # working-directory: .github/workflows
+
+        steps:
+
+          - name: Git clone the lockdown repository to test
+            uses: actions/checkout@v4
+            with:
+              ref: ${{ github.event.pull_request.head.sha }}
+
+          - name: If a variable for IAC_BRANCH is set use that branch
+            working-directory: .github/workflows
+            run: |
+              if [ ${{ vars.IAC_BRANCH }} != '' ]; then
+                 echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
+                 echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
+              else
+                 echo IAC_BRANCH=main >> $GITHUB_ENV
+              fi
+
+
+          # Pull in terraform code for linux servers
+          - name: Clone GitHub IaC plan
+            uses: actions/checkout@v4
+            with:
+              repository: ansible-lockdown/github_linux_IaC
+              path: .github/workflows/github_linux_IaC
+              ref: ${{ env.IAC_BRANCH }}
+
+          # Uses dedicated restricted role and policy to enable this only for this task
+          # No credentials are part of github for AWS auth
+          - name: configure aws credentials
+            uses: aws-actions/configure-aws-credentials@main
+            with:
+              role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+              role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
+              aws-region: ${{ env.AWS_REGION }}
+
+          - name: DEBUG - Show IaC files
+            if: env.ENABLE_DEBUG == 'true'
+            run: |
+              echo "OSVAR = $OSVAR"
+              echo "benchmark_type = $benchmark_type"
+              echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
+              echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
+              pwd
+              ls
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
+
+          - name: Tofu init
+            id: init
+            run: tofu init
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          - name: Tofu validate
+            id: validate
+            run: tofu validate
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          - name: Tofu apply
+            id: apply
+            env:
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
+            run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+
+## Debug Section
+          - name: DEBUG - Show Ansible hostfile
+            if: env.ENABLE_DEBUG == 'true'
+            run: cat hosts.yml
+
+    # Aws deployments taking a while to come up insert sleep or playbook fails
+
+          - name: Sleep to allow system to come up
+            run: sleep ${{ vars.BUILD_SLEEPTIME }}
+
+        # Run the Ansible playbook
+          - name: Run_Ansible_Playbook
+            env:
+              ANSIBLE_HOST_KEY_CHECKING: "false"
+              ANSIBLE_DEPRECATION_WARNINGS: "false"
+            run: |
+              /opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
+
+        # Remove test system - User secrets to keep if necessary
+
+          - name: Tofu Destroy
+            if: always() && env.ENABLE_DEBUG == 'false'
+            env:
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
+            run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
diff --git a/.github/workflows/main_pipeline_validation.yml b/.github/workflows/main_pipeline_validation.yml
index 8ded701..4a5adc9 100644
--- a/.github/workflows/main_pipeline_validation.yml
+++ b/.github/workflows/main_pipeline_validation.yml
@@ -1,127 +1,156 @@
 ---
 
-    name: Main pipeline
-
-    on: # yamllint disable-line rule:truthy
-      pull_request_target:
-          types: [opened, reopened, synchronize]
-          branches:
-              - main
-          paths:
-              - '**.yml'
-              - '**.sh'
-              - '**.j2'
-              - '**.ps1'
-              - '**.cfg'
-
-    # A workflow run is made up of one or more jobs
-    # that can run sequentially or in parallel
-    jobs:
-
-        # This workflow contains a single job that tests the playbook
-        playbook-test:
-          # The type of runner that the job will run on
-          runs-on: ubuntu-latest
-          env:
-            ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
-            # Imported as a variable by terraform
-            TF_VAR_repository: ${{ github.event.repository.name }}
-          defaults:
-            run:
-              shell: bash
-              working-directory: .github/workflows/github_linux_IaC
-
-          steps:
-            - name: Clone ${{ github.event.repository.name }}
-              uses: actions/checkout@v4
+  name: Main pipeline
+
+  on: # yamllint disable-line rule:truthy
+    pull_request_target:
+        types: [opened, reopened, synchronize]
+        branches:
+            - main
+        paths:
+            - '**.yml'
+            - '**.sh'
+            - '**.j2'
+            - '**.ps1'
+            - '**.cfg'
+
+  # Allow permissions for AWS auth
+  permissions:
+    id-token: write
+    contents: read
+    pull-requests: read
+
+  # A workflow run is made up of one or more jobs
+  # that can run sequentially or in parallel
+  jobs:
+    # This will create messages for first time contributers and direct them to the Discord server
+      welcome:
+        runs-on: self-hosted
+
+        steps:
+            - uses: actions/first-interaction@main
               with:
-                ref: ${{ github.event.pull_request.head.sha }}
-
-            # Pull in terraform code for linux servers
-            - name: Clone GitHub IaC plan
-              uses: actions/checkout@v4
-              with:
-                repository: ansible-lockdown/github_linux_IaC
-                path: .github/workflows/github_linux_IaC
-
-            - name: Add_ssh_key
-              working-directory: .github/workflows
-              env:
-                  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-                  PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
-              run: |
-                mkdir .ssh
-                chmod 700 .ssh
-                echo $PRIVATE_KEY > .ssh/github_actions.pem
-                chmod 600 .ssh/github_actions.pem
-
-            - name: DEBUG - Show IaC files
-              if: env.ENABLE_DEBUG == 'true'
-              run: |
-                echo "OSVAR = $OSVAR"
-                echo "benchmark_type = $benchmark_type"
-                pwd
-                ls
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Init
-              id: init
-              run: terraform init
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Validate
-              id: validate
-              run: terraform validate
-              env:
-                # Imported from GitHub variables this is used to load the relevant OS.tfvars file
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-
-            - name: Terraform_Apply
-              id: apply
-              env:
-                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-              run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
-
-  ## Debug Section
-            - name: DEBUG - Show Ansible hostfile
-              if: env.ENABLE_DEBUG == 'true'
-              run: cat hosts.yml
-
-      # Aws deployments taking a while to come up insert sleep or playbook fails
-
-            - name: Sleep for 60 seconds
-              run: sleep ${{ vars.BUILD_SLEEPTIME }}
-
-          # Run the Ansible playbook
-            - name: Run_Ansible_Playbook
-              uses: arillso/action.playbook@master
-              with:
-                playbook: site.yml
-                inventory: .github/workflows/github_linux_IaC/hosts.yml
-                galaxy_file: collections/requirements.yml
-                private_key: ${{ secrets.SSH_PRV_KEY }}
-        #          verbose: 3
-              env:
-                ANSIBLE_HOST_KEY_CHECKING: "false"
-                ANSIBLE_DEPRECATION_WARNINGS: "false"
-
-          # Remove test system - User secrets to keep if necessary
-
-            - name: Terraform_Destroy
-              if: always() && env.ENABLE_DEBUG == 'false'
-              env:
-                AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-                AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-                OSVAR: ${{ vars.OSVAR }}
-                TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
-              run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+                repo-token: ${{ secrets.GITHUB_TOKEN }}
+                pr-message: |-
+                    Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+                    Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
+
+      # This workflow contains a single job that tests the playbook
+      playbook-test:
+        # The type of runner that the job will run on
+        runs-on: self-hosted
+        env:
+          ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
+          # Imported as a variable by terraform
+          TF_VAR_repository: ${{ github.event.repository.name }}
+          AWS_REGION : "us-east-1"
+          ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
+        defaults:
+          run:
+            shell: bash
+            working-directory: .github/workflows/github_linux_IaC
+            # working-directory: .github/workflows
+
+        steps:
+
+          - name: Git clone the lockdown repository to test
+            uses: actions/checkout@v4
+            with:
+              ref: ${{ github.event.pull_request.head.sha }}
+
+          - name: If a variable for IAC_BRANCH is set use that branch
+            working-directory: .github/workflows
+            run: |
+              if [ ${{ vars.IAC_BRANCH }} != '' ]; then
+                 echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
+                 echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
+              else
+                 echo IAC_BRANCH=main >> $GITHUB_ENV
+              fi
+
+          # Pull in terraform code for linux servers
+          - name: Clone GitHub IaC plan
+            uses: actions/checkout@v4
+            with:
+              repository: ansible-lockdown/github_linux_IaC
+              path: .github/workflows/github_linux_IaC
+              ref: ${{ env.IAC_BRANCH }}
+
+          # Uses dedicated restricted role and policy to enable this only for this task
+          # No credentials are part of github for AWS auth
+          - name: configure aws credentials
+            uses: aws-actions/configure-aws-credentials@main
+            with:
+              role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+              role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
+              aws-region: ${{ env.AWS_REGION }}
+
+          - name: DEBUG - Show IaC files
+            if: env.ENABLE_DEBUG == 'true'
+            run: |
+              echo "OSVAR = $OSVAR"
+              echo "benchmark_type = $benchmark_type"
+              echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
+              echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
+              pwd
+              ls
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
+
+          - name: Tofu init
+            id: init
+            run: tofu init
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          - name: Tofu validate
+            id: validate
+            run: tofu validate
+            env:
+              # Imported from GitHub variables this is used to load the relevant OS.tfvars file
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          - name: Tofu apply
+            id: apply
+            env:
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
+            run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
+
+## Debug Section
+          - name: DEBUG - Show Ansible hostfile
+            if: env.ENABLE_DEBUG == 'true'
+            run: cat hosts.yml
+
+    # Aws deployments taking a while to come up insert sleep or playbook fails
+
+          - name: Sleep to allow system to come up
+            run: sleep ${{ vars.BUILD_SLEEPTIME }}
+
+        # Run the Ansible playbook
+          - name: Run_Ansible_Playbook
+            env:
+              ANSIBLE_HOST_KEY_CHECKING: "false"
+              ANSIBLE_DEPRECATION_WARNINGS: "false"
+            run: |
+              /opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
+
+        # Remove test system - User secrets to keep if necessary
+
+          - name: Tofu Destroy
+            if: always() && env.ENABLE_DEBUG == 'false'
+            env:
+              OSVAR: ${{ vars.OSVAR }}
+              TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
+              TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
+            run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
diff --git a/.github/workflows/update_galaxy.yml b/.github/workflows/update_galaxy.yml
index f935280..b6ee6a1 100644
--- a/.github/workflows/update_galaxy.yml
+++ b/.github/workflows/update_galaxy.yml
@@ -1,19 +1,19 @@
 ---
 
-name: update galaxy
+    name: update galaxy
 
-on:
-    push:
-        branches:
-            - main
-jobs:
-    update_role:
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repo
-              uses: actions/checkout@v4
+    on:
+        push:
+            branches:
+                - main
+    jobs:
+        update_role:
+            runs-on: ubuntu-latest
+            steps:
+                - name: Checkout repo
+                  uses: actions/checkout@v4
 
-            - name: Action Ansible Galaxy Release ${{ github.ref_name }}
-              uses: ansible-actions/ansible-galaxy-action@main
-              with:
-                galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
+                - name: Action Ansible Galaxy Release ${{ github.ref_name }}
+                  uses: ansible-actions/ansible-galaxy-action@main
+                  with:
+                    galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
diff --git a/tasks/post_remediation_audit.yml b/tasks/post_remediation_audit.yml
index b3111c8..d58e921 100644
--- a/tasks/post_remediation_audit.yml
+++ b/tasks/post_remediation_audit.yml
@@ -21,26 +21,24 @@
   when:
       - audit_format == "json"
   block:
-      - name: capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: "cat {{ post_audit_outfile }}"
-        register: post_audit
+      - name: Post Audit | Capture audit data if json format
+        ansible.builtin.shell: grep -E '"summary-line.*Count:.*Failed' "{{ post_audit_outfile }}" | cut -d'"' -f4
+        register: post_audit_summary
         changed_when: false
 
-      - name: Capture post-audit result
+      - name: Post Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}"
-        vars:
-            summary: summary."summary-line"
+            post_audit_results: "{{ post_audit_summary.stdout }}"
 
 - name: Post Audit | Capture audit data if documentation format
   when:
       - audit_format == "documentation"
   block:
-      - name: Post Audit | capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}"
-        register: post_audit
+      - name: Post Audit | Capture audit data if documentation format
+        ansible.builtin.shell: "tail -2 /opt/audit_ubuntu2204-CIS-UBUNTU22_1720624848.documentation"
+        register: post_audit_summary
         changed_when: false
 
-      - name: Post Audit | Capture post-audit result
+      - name: Post Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ post_audit.stdout_lines }}"
+            post_audit_results: "{{ post_audit_summary.stdout }}"
diff --git a/tasks/pre_remediation_audit.yml b/tasks/pre_remediation_audit.yml
index d0137e8..a745826 100644
--- a/tasks/pre_remediation_audit.yml
+++ b/tasks/pre_remediation_audit.yml
@@ -91,31 +91,30 @@
   when:
       - audit_format == "json"
   block:
-      - name: Pre Audit | Capture data {{ pre_audit_outfile }}
-        ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
-        register: pre_audit
+      - name: Pre Audit | Capture audit data if json format
+        ansible.builtin.shell: grep -E '\"summary-line.*Count:.*Failed' "{{ pre_audit_outfile }}" | cut -d'"' -f4
+        register: pre_audit_summary
         changed_when: false
 
-      - name: Pre Audit | Capture pre-audit result
+      - name: Pre Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
-        vars:
-            summary: summary."summary-line"
+            pre_audit_results: "{{ pre_audit_summary.stdout }}"
 
 - name: Pre Audit | Capture audit data if documentation format
   when:
       - audit_format == "documentation"
   block:
-      - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
-        ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
-        register: pre_audit
+      - name: Pre Audit | Capture audit data if documentation format
+        ansible.builtin.shell: tail -2 "{{ pre_audit_outfile }}"  | tac | tr '\n' ' '
+        register: pre_audit_summary
         changed_when: false
 
-      - name: Pre Audit | Capture pre-audit result | documentation format
+      - name: Pre Audit | Set Fact for audit summary
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ pre_audit.stdout_lines }}"
+            pre_audit_results: "{{ pre_audit_summary.stdout }}"
 
 - name: Audit_Only | Run Audit Only
   when:
       - audit_only
-  ansible.builtin.import_tasks: audit_only.yml
+  ansible.builtin.import_tasks:
+      file: audit_only.yml
diff --git a/vars/audit.yml b/vars/audit.yml
index e425229..371cb60 100644
--- a/vars/audit.yml
+++ b/vars/audit.yml
@@ -34,7 +34,7 @@ audit_format: json
 
 audit_vars_path: "{{ audit_conf_dir }}/vars/{{ ansible_facts.hostname }}.yml"
 audit_results: |
-      The audit results are: {{ pre_audit_summary }}
-      {% if not audit_only %}The post remediation audit results are: {{ post_audit_summary }}{% endif %}
+      The{% if not audit_only %} pre remediation{% endif %} audit results are: {{ pre_audit_results}}
+      {% if not audit_only %}The post remediation audit results are: {{ post_audit_results }}{% endif %}
 
       Full breakdown can be found in {{ audit_log_dir }}