diff --git a/requirements.txt b/requirements.txt
index 8ed4d07..6d733cc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -38,7 +38,7 @@ protobuf==3.6.1
 pycparser==2.19
 pyfakefs==3.5.7
 Pygments==2.3.1
-pyhcl==0.3.10
+pyhcl==0.4.0
 pylint==2.2.2
 pyOpenSSL==19.0.0
 pyparsing==2.3.1
diff --git a/terraform/cloudwatch_dashboard.tf b/terraform/cloudwatch_dashboard.tf
index ea96f1e..7d547b7 100644
--- a/terraform/cloudwatch_dashboard.tf
+++ b/terraform/cloudwatch_dashboard.tf
@@ -27,6 +27,7 @@ locals {
 }
 EOF
 
+
   yara_rules = <<EOF
 {
   "type": "metric",
@@ -45,6 +46,7 @@ EOF
 }
 EOF
 
+
   analyzed_binaries = <<EOF
 {
   "type": "metric",
@@ -61,6 +63,7 @@ EOF
 }
 EOF
 
+
   sqs_analyzer = <<EOF
 {
   "type": "metric",
@@ -78,6 +81,7 @@ EOF
 }
 EOF
 
+
   sqs_analyzer_age = <<EOF
 {
   "type": "metric",
@@ -108,11 +112,12 @@ EOF
 }
 EOF
 
+
   // Due to https://github.com/hashicorp/terraform/issues/11574, both ternary branches are always
   // computed, so we have to use this special idiom (same as modules/lambda/outputs.tf).
-  downloader_function_name = "${module.binaryalert_downloader.function_name}"
+  downloader_function_name = module.binaryalert_downloader.function_name
 
-  downloader_queue_name = "${element(concat(aws_sqs_queue.downloader_queue.*.name, list("")), 0)}"
+  downloader_queue_name = element(concat(aws_sqs_queue.downloader_queue.*.name, [""]), 0)
 
   sqs_downloader = <<EOF
 {
@@ -131,6 +136,7 @@ EOF
 }
 EOF
 
+
   sqs_downloader_age = <<EOF
 {
   "type": "metric",
@@ -149,11 +155,23 @@ EOF
       "horizontal": [
         {
           "label": "Max",
-          "value": "${element(concat(aws_sqs_queue.downloader_queue.*.message_retention_seconds, list("")), 0)}"
+          "value": "${element(
+  concat(
+    aws_sqs_queue.downloader_queue.*.message_retention_seconds,
+    [""],
+  ),
+  0,
+  )}"
         },
         {
           "label": "Alarm",
-          "value": "${element(concat(aws_cloudwatch_metric_alarm.downloader_sqs_age.*.threshold, list("")), 0)}"
+          "value": "${element(
+  concat(
+    aws_cloudwatch_metric_alarm.downloader_sqs_age.*.threshold,
+    [""],
+  ),
+  0,
+)}"
         }
       ]
     }
@@ -161,11 +179,13 @@ EOF
 }
 EOF
 
-  downloader = <<EOF
+
+downloader = <<EOF
     ,[".", ".", ".", "${local.downloader_function_name}", {"label": "Downloader"}]
 EOF
 
-  lambda_invocations = <<EOF
+
+lambda_invocations = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -185,7 +205,8 @@ EOF
 }
 EOF
 
-  max_lambda_duration = <<EOF
+
+max_lambda_duration = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -213,7 +234,8 @@ EOF
 }
 EOF
 
-  lambda_errors = <<EOF
+
+lambda_errors = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -233,7 +255,8 @@ EOF
 }
 EOF
 
-  lambda_throttles = <<EOF
+
+lambda_throttles = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -253,7 +276,8 @@ EOF
 }
 EOF
 
-  s3_download_latency = <<EOF
+
+s3_download_latency = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -269,7 +293,8 @@ EOF
 }
 EOF
 
-  sns_publications = <<EOF
+
+sns_publications = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -289,11 +314,13 @@ EOF
 }
 EOF
 
-  downloader_logs = <<EOF
+
+downloader_logs = <<EOF
     ,[".", ".", ".", "/aws/lambda/${local.downloader_function_name}", {"label": "Downloader"}]
 EOF
 
-  log_bytes = <<EOF
+
+log_bytes = <<EOF
 {
   "type": "metric",
   "width": 12,
@@ -314,7 +341,8 @@ EOF
 }
 EOF
 
-  dashboard_body_without_downloader = <<EOF
+
+dashboard_body_without_downloader = <<EOF
 {
   "widgets": [
     ${local.s3_bucket_stats}, ${local.yara_rules},
@@ -327,7 +355,8 @@ EOF
 }
 EOF
 
-  dashboard_body_with_downloader = <<EOF
+
+dashboard_body_with_downloader = <<EOF
 {
   "widgets": [
     ${local.s3_bucket_stats}, ${local.yara_rules},
@@ -341,7 +370,8 @@ EOF
 }
 EOF
 
-  dashboard_body = "${var.enable_carbon_black_downloader ? local.dashboard_body_with_downloader : local.dashboard_body_without_downloader}"
+
+dashboard_body = var.enable_carbon_black_downloader ? local.dashboard_body_with_downloader : local.dashboard_body_without_downloader
 }
 
 resource "aws_cloudwatch_dashboard" "binaryalert" {
@@ -349,5 +379,6 @@ resource "aws_cloudwatch_dashboard" "binaryalert" {
 
   // Terraform automatically converts numbers to strings when putting them in a list.
   // We have to strip quotes around numbers, so that {"value": "123"} turns into {"value": 123}
-  dashboard_body = "${replace(local.dashboard_body, "/\"([0-9]+)\"/", "$1")}"
+  dashboard_body = replace(local.dashboard_body, "/\"([0-9]+)\"/", "$1")
 }
+
diff --git a/terraform/cloudwatch_metric_alarm.tf b/terraform/cloudwatch_metric_alarm.tf
index bd277b9..2a04a32 100644
--- a/terraform/cloudwatch_metric_alarm.tf
+++ b/terraform/cloudwatch_metric_alarm.tf
@@ -2,7 +2,13 @@
 
 locals {
   // Use the existing SNS alarm topic if specified, otherwise use the created one
-  alarm_target = "${element(concat(aws_sns_topic.metric_alarms.*.arn, list(var.metric_alarm_sns_topic_arn)), 0)}"
+  alarm_target = element(
+    concat(
+      aws_sns_topic.metric_alarms.*.arn,
+      [var.metric_alarm_sns_topic_arn],
+    ),
+    0,
+  )
 }
 
 // The production BinaryAlert analyzer is not analyzing binaries.
@@ -15,17 +21,19 @@ ${module.binaryalert_analyzer.function_name} is not analyzing any binaries!
   - Binaries may not be arriving in the S3 bucket.
 EOF
 
+
   namespace   = "BinaryAlert"
   metric_name = "AnalyzedBinaries"
   statistic   = "Sum"
 
   // No binaries analyzed for a while.
-  comparison_operator       = "LessThanOrEqualToThreshold"
-  threshold                 = 0
-  period                    = "${format("%d", var.expected_analysis_frequency_minutes * 60)}"
-  evaluation_periods        = 1
-  alarm_actions             = ["${local.alarm_target}"]
-  insufficient_data_actions = ["${local.alarm_target}"]
+  comparison_operator = "LessThanOrEqualToThreshold"
+  threshold           = 0
+  period              = format("%d", var.expected_analysis_frequency_minutes * 60)
+  evaluation_periods  = 1
+
+  alarm_actions             = [local.alarm_target]
+  insufficient_data_actions = [local.alarm_target]
 }
 
 // The analyzer SQS queue is falling behind.
@@ -39,48 +47,52 @@ messages are reaching 75% of the queue retention and may be expired soon.
   - Consider raising the retention period for this queue
 EOF
 
+
   namespace   = "AWS/SQS"
   metric_name = "ApproximateAgeOfOldestMessage"
   statistic   = "Minimum"
 
   dimensions = {
-    QueueName = "${aws_sqs_queue.analyzer_queue.name}"
+    QueueName = aws_sqs_queue.analyzer_queue.name
   }
 
-  comparison_operator       = "GreaterThanThreshold"
-  threshold                 = "${format("%d", ceil(var.analyze_queue_retention_secs * 0.75))}"
-  period                    = 60
-  evaluation_periods        = 10
-  alarm_actions             = ["${local.alarm_target}"]
-  insufficient_data_actions = ["${local.alarm_target}"]
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = format("%d", ceil(var.analyze_queue_retention_secs * 0.75))
+  period              = 60
+  evaluation_periods  = 10
+
+  alarm_actions             = [local.alarm_target]
+  insufficient_data_actions = [local.alarm_target]
 }
 
 // The downloader SQS queue is falling behind.
 resource "aws_cloudwatch_metric_alarm" "downloader_sqs_age" {
-  count      = "${var.enable_carbon_black_downloader ? 1 : 0}"
-  alarm_name = "${aws_sqs_queue.downloader_queue.name}_old_age"
+  count      = var.enable_carbon_black_downloader ? 1 : 0
+  alarm_name = "${aws_sqs_queue.downloader_queue[0].name}_old_age"
 
   alarm_description = <<EOF
-The queue ${aws_sqs_queue.downloader_queue.name} is not being processed quickly enough:
+The queue ${aws_sqs_queue.downloader_queue[0].name} is not being processed quickly enough:
 messages are reaching 75% of the queue retention and may be expired soon.
   - Consider increasing the lambda_download_concurrency_limit to process more events
   - Consider raising the retention period for this queue
 EOF
 
+
   namespace   = "AWS/SQS"
   metric_name = "ApproximateAgeOfOldestMessage"
   statistic   = "Minimum"
 
   dimensions = {
-    QueueName = "${aws_sqs_queue.downloader_queue.name}"
+    QueueName = aws_sqs_queue.downloader_queue[0].name
   }
 
-  comparison_operator       = "GreaterThanThreshold"
-  threshold                 = "${format("%d", ceil(var.download_queue_retention_secs * 0.75))}"
-  period                    = 60
-  evaluation_periods        = 10
-  alarm_actions             = ["${local.alarm_target}"]
-  insufficient_data_actions = ["${local.alarm_target}"]
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = format("%d", ceil(var.download_queue_retention_secs * 0.75))
+  period              = 60
+  evaluation_periods  = 10
+
+  alarm_actions             = [local.alarm_target]
+  insufficient_data_actions = [local.alarm_target]
 }
 
 // There are very few YARA rules.
@@ -92,6 +104,7 @@ The number of YARA rules in BinaryAlert is surprisingly low.
 Check if a recent deploy accidentally removed most YARA rules.
 EOF
 
+
   namespace   = "BinaryAlert"
   metric_name = "YaraRules"
   statistic   = "Maximum"
@@ -101,7 +114,8 @@ EOF
   threshold           = 5
   period              = 300
   evaluation_periods  = 1
-  alarm_actions       = ["${local.alarm_target}"]
+
+  alarm_actions = [local.alarm_target]
 }
 
 // Dynamo requests are being throttled.
@@ -117,17 +131,20 @@ Read or write requests to the BinaryAlert DynamoDB table are being throttled.
   - If this is normal/expected behavior, increase the dynamo_read_capacity in the BinaryAlet config.
 EOF
 
+
   namespace   = "AWS/DynamoDB"
   metric_name = "ThrottledRequests"
   statistic   = "Sum"
 
   dimensions = {
-    TableName = "${aws_dynamodb_table.binaryalert_yara_matches.name}"
+    TableName = aws_dynamodb_table.binaryalert_yara_matches.name
   }
 
   comparison_operator = "GreaterThanThreshold"
   threshold           = 0
   period              = 60
   evaluation_periods  = 1
-  alarm_actions       = ["${local.alarm_target}"]
+
+  alarm_actions = [local.alarm_target]
 }
+
diff --git a/terraform/dynamo.tf b/terraform/dynamo.tf
index 1a630ed..0b569bf 100644
--- a/terraform/dynamo.tf
+++ b/terraform/dynamo.tf
@@ -3,8 +3,8 @@ resource "aws_dynamodb_table" "binaryalert_yara_matches" {
   name           = "${var.name_prefix}_binaryalert_matches"
   hash_key       = "SHA256"
   range_key      = "AnalyzerVersion"
-  read_capacity  = "${var.dynamo_read_capacity}"
-  write_capacity = "${var.dynamo_write_capacity}"
+  read_capacity  = var.dynamo_read_capacity
+  write_capacity = var.dynamo_write_capacity
 
   // Only attributes used as hash/range keys are defined here.
   attribute {
@@ -22,7 +22,8 @@ resource "aws_dynamodb_table" "binaryalert_yara_matches" {
     enabled = true
   }
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
+
diff --git a/terraform/kms.tf b/terraform/kms.tf
index 7dda95e..cf45f74 100644
--- a/terraform/kms.tf
+++ b/terraform/kms.tf
@@ -34,16 +34,16 @@ resource "aws_kms_key" "sse_s3" {
   description         = "BinaryAlert Server-Side Encryption - S3"
   enable_key_rotation = true
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 
-  policy = "${data.aws_iam_policy_document.kms_allow_s3.json}"
+  policy = data.aws_iam_policy_document.kms_allow_s3.json
 }
 
 resource "aws_kms_alias" "sse_s3_alias" {
   name          = "alias/${var.name_prefix}_binaryalert_sse_s3"
-  target_key_id = "${aws_kms_key.sse_s3.key_id}"
+  target_key_id = aws_kms_key.sse_s3.key_id
 }
 
 // KMS key for server-side encryption (SSE) of SQS
@@ -51,31 +51,32 @@ resource "aws_kms_key" "sse_sqs" {
   description         = "BinaryAlert Server-Side Encryption - SQS"
   enable_key_rotation = true
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 
-  policy = "${data.aws_iam_policy_document.kms_allow_s3.json}"
+  policy = data.aws_iam_policy_document.kms_allow_s3.json
 }
 
 resource "aws_kms_alias" "sse_sqs_alias" {
   name          = "alias/${var.name_prefix}_binaryalert_sse_sqs"
-  target_key_id = "${aws_kms_key.sse_sqs.key_id}"
+  target_key_id = aws_kms_key.sse_sqs.key_id
 }
 
 // KMS key to encrypt CarbonBlack credentials
 resource "aws_kms_key" "carbon_black_credentials" {
-  count               = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count               = var.enable_carbon_black_downloader ? 1 : 0
   description         = "Encrypts CarbonBlack credentials for the BinaryAlert downloader."
   enable_key_rotation = true
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
 
 resource "aws_kms_alias" "encrypt_credentials_alias" {
-  count         = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count         = var.enable_carbon_black_downloader ? 1 : 0
   name          = "alias/${var.name_prefix}_binaryalert_carbonblack_credentials"
-  target_key_id = "${aws_kms_key.carbon_black_credentials.key_id}"
+  target_key_id = aws_kms_key.carbon_black_credentials[0].key_id
 }
+
diff --git a/terraform/lambda.tf b/terraform/lambda.tf
index ec8dbe3..b22c010 100644
--- a/terraform/lambda.tf
+++ b/terraform/lambda.tf
@@ -3,67 +3,71 @@ module "binaryalert_analyzer" {
   source          = "./modules/lambda"
   function_name   = "${var.name_prefix}_binaryalert_analyzer"
   description     = "Analyze a binary with a set of YARA rules"
-  base_policy_arn = "${aws_iam_policy.base_policy.arn}"
+  base_policy_arn = aws_iam_policy.base_policy.arn
   handler         = "lambda_functions.analyzer.main.analyze_lambda_handler"
-  memory_size_mb  = "${var.lambda_analyze_memory_mb}"
-  timeout_sec     = "${var.lambda_analyze_timeout_sec}"
+  memory_size_mb  = var.lambda_analyze_memory_mb
+  timeout_sec     = var.lambda_analyze_timeout_sec
   filename        = "lambda_analyzer.zip"
 
-  reserved_concurrent_executions = "${var.lambda_analyze_concurrency_limit}"
+  reserved_concurrent_executions = var.lambda_analyze_concurrency_limit
 
   environment_variables = {
-    NO_MATCHES_SNS_TOPIC_ARN       = "${element(concat(aws_sns_topic.no_yara_match.*.arn, list("")), 0)}"
-    YARA_MATCHES_DYNAMO_TABLE_NAME = "${aws_dynamodb_table.binaryalert_yara_matches.name}"
-    YARA_ALERTS_SNS_TOPIC_ARN      = "${aws_sns_topic.yara_match_alerts.arn}"
+    NO_MATCHES_SNS_TOPIC_ARN       = element(concat(aws_sns_topic.no_yara_match.*.arn, [""]), 0)
+    YARA_MATCHES_DYNAMO_TABLE_NAME = aws_dynamodb_table.binaryalert_yara_matches.name
+    YARA_ALERTS_SNS_TOPIC_ARN      = aws_sns_topic.yara_match_alerts.arn
   }
 
-  log_retention_days = "${var.lambda_log_retention_days}"
-  tagged_name        = "${var.tagged_name}"
+  log_retention_days = var.lambda_log_retention_days
+  tagged_name        = var.tagged_name
 
   // There may be a few errors during a batch analysis when waiting on S3
   alarm_errors_threshold     = 10
   alarm_errors_interval_secs = 300
-  alarm_sns_arns             = ["${local.alarm_target}"]
+  alarm_sns_arns             = [local.alarm_target]
 }
 
 // Invoke analyzer Lambda from analyzer SQS queue.
 resource "aws_lambda_event_source_mapping" "analyzer_via_sqs" {
-  batch_size       = "${var.analyze_queue_batch_size}"
-  event_source_arn = "${aws_sqs_queue.analyzer_queue.arn}"
-  function_name    = "${module.binaryalert_analyzer.alias_arn}"
+  batch_size       = var.analyze_queue_batch_size
+  event_source_arn = aws_sqs_queue.analyzer_queue.arn
+  function_name    = module.binaryalert_analyzer.alias_arn
 }
 
 // Create the CarbonBlack downloading Lambda function.
 module "binaryalert_downloader" {
-  enabled = "${var.enable_carbon_black_downloader ? 1 : 0}"
-
+ 
+  enabled         = var.enable_carbon_black_downloader ? 1 : 0
+ 
   source          = "./modules/lambda"
   function_name   = "${var.name_prefix}_binaryalert_downloader"
   description     = "Copies binaries from CarbonBlack into the BinaryAlert S3 bucket"
-  base_policy_arn = "${aws_iam_policy.base_policy.arn}"
+  base_policy_arn = aws_iam_policy.base_policy.arn
   handler         = "lambda_functions.downloader.main.download_lambda_handler"
-  memory_size_mb  = "${var.lambda_download_memory_mb}"
-  timeout_sec     = "${var.lambda_download_timeout_sec}"
+  memory_size_mb  = var.lambda_download_memory_mb
+  timeout_sec     = var.lambda_download_timeout_sec
   filename        = "lambda_downloader.zip"
 
-  reserved_concurrent_executions = "${var.lambda_download_concurrency_limit}"
+  reserved_concurrent_executions = var.lambda_download_concurrency_limit
 
   environment_variables = {
-    CARBON_BLACK_URL                 = "${var.carbon_black_url}"
-    CARBON_BLACK_TIMEOUT             = "${var.carbon_black_timeout}"
-    ENCRYPTED_CARBON_BLACK_API_TOKEN = "${var.encrypted_carbon_black_api_token}"
-    TARGET_S3_BUCKET                 = "${aws_s3_bucket.binaryalert_binaries.id}"
+    CARBON_BLACK_URL                 = var.carbon_black_url
+    CARBON_BLACK_TIMEOUT             = var.carbon_black_timeout
+    ENCRYPTED_CARBON_BLACK_API_TOKEN = var.encrypted_carbon_black_api_token
+    TARGET_S3_BUCKET                 = aws_s3_bucket.binaryalert_binaries.id
   }
 
-  log_retention_days = "${var.lambda_log_retention_days}"
-  tagged_name        = "${var.tagged_name}"
-  alarm_sns_arns     = ["${local.alarm_target}"]
+  log_retention_days = var.lambda_log_retention_days
+  tagged_name        = var.tagged_name
+
+  alarm_errors_threshold = 500
+  alarm_sns_arns         = [local.alarm_target]
 }
 
 // Invoke downloader Lambda from downloader SQS queue.
 resource "aws_lambda_event_source_mapping" "downloader_via_sqs" {
-  count            = "${var.enable_carbon_black_downloader ? 1 : 0}"
-  batch_size       = "${var.download_queue_batch_size}"
-  event_source_arn = "${aws_sqs_queue.downloader_queue.arn}"
-  function_name    = "${module.binaryalert_downloader.alias_arn}"
+  count            = var.enable_carbon_black_downloader ? 1 : 0
+  batch_size       = var.download_queue_batch_size
+  event_source_arn = aws_sqs_queue.downloader_queue[0].arn
+  function_name    = module.binaryalert_downloader.alias_arn
 }
+
diff --git a/terraform/lambda_iam.tf b/terraform/lambda_iam.tf
index e9282e7..ec080ab 100644
--- a/terraform/lambda_iam.tf
+++ b/terraform/lambda_iam.tf
@@ -17,7 +17,7 @@ data "aws_iam_policy_document" "base_policy" {
 
 resource "aws_iam_policy" "base_policy" {
   name   = "${var.name_prefix}_binaryalert_base_policy"
-  policy = "${data.aws_iam_policy_document.base_policy.json}"
+  policy = data.aws_iam_policy_document.base_policy.json
 }
 
 // ********** Analyzer **********
@@ -32,7 +32,7 @@ data "aws_iam_policy_document" "binaryalert_analyzer_policy" {
       "dynamodb:UpdateItem",
     ]
 
-    resources = ["${aws_dynamodb_table.binaryalert_yara_matches.arn}"]
+    resources = [aws_dynamodb_table.binaryalert_yara_matches.arn]
   }
 
   statement {
@@ -43,7 +43,10 @@ data "aws_iam_policy_document" "binaryalert_analyzer_policy" {
       "kms:Describe*",
     ]
 
-    resources = ["${concat(list(aws_kms_key.sse_s3.arn, aws_kms_key.sse_sqs.arn), var.external_kms_key_resources)}"]
+    resources = concat(
+      [aws_kms_key.sse_s3.arn, aws_kms_key.sse_sqs.arn],
+      var.external_kms_key_resources,
+    )
   }
 
   statement {
@@ -54,13 +57,20 @@ data "aws_iam_policy_document" "binaryalert_analyzer_policy" {
       "s3:HeadObject",
     ]
 
-    resources = ["${concat(list(format("%s/*", aws_s3_bucket.binaryalert_binaries.arn)), var.external_s3_bucket_resources)}"]
+    resources = concat(
+      [format("%s/*", aws_s3_bucket.binaryalert_binaries.arn)],
+      var.external_s3_bucket_resources,
+    )
   }
 
   statement {
-    sid       = "PublishAlertsToSNS"
-    actions   = ["sns:Publish"]
-    resources = ["${concat(list(aws_sns_topic.yara_match_alerts.arn), aws_sns_topic.no_yara_match.*.arn)}"]
+    sid     = "PublishAlertsToSNS"
+    actions = ["sns:Publish"]
+
+    resources = concat(
+      [aws_sns_topic.yara_match_alerts.arn],
+      aws_sns_topic.no_yara_match.*.arn,
+    )
   }
 
   statement {
@@ -73,20 +83,20 @@ data "aws_iam_policy_document" "binaryalert_analyzer_policy" {
       "sqs:ReceiveMessage",
     ]
 
-    resources = ["${aws_sqs_queue.analyzer_queue.arn}"]
+    resources = [aws_sqs_queue.analyzer_queue.arn]
   }
 }
 
 resource "aws_iam_role_policy" "binaryalert_analyzer_policy" {
   name   = "${var.name_prefix}_binaryalert_analyzer_policy"
-  role   = "${module.binaryalert_analyzer.role_id}"
-  policy = "${data.aws_iam_policy_document.binaryalert_analyzer_policy.json}"
+  role   = module.binaryalert_analyzer.role_id
+  policy = data.aws_iam_policy_document.binaryalert_analyzer_policy.json
 }
 
 // ********** Downloader **********
 
 data "aws_iam_policy_document" "binaryalert_downloader_policy" {
-  count = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count = var.enable_carbon_black_downloader ? 1 : 0
 
   statement {
     sid = "AllowSSE"
@@ -97,15 +107,15 @@ data "aws_iam_policy_document" "binaryalert_downloader_policy" {
     ]
 
     resources = [
-      "${aws_kms_key.sse_s3.arn}",
-      "${aws_kms_key.sse_sqs.arn}",
+      aws_kms_key.sse_s3.arn,
+      aws_kms_key.sse_sqs.arn,
     ]
   }
 
   statement {
     sid       = "DecryptCarbonBlackCredentials"
     actions   = ["kms:Decrypt"]
-    resources = ["${aws_kms_key.carbon_black_credentials.arn}"]
+    resources = [aws_kms_key.carbon_black_credentials[0].arn]
   }
 
   statement {
@@ -124,13 +134,14 @@ data "aws_iam_policy_document" "binaryalert_downloader_policy" {
       "sqs:ReceiveMessage",
     ]
 
-    resources = ["${aws_sqs_queue.downloader_queue.arn}"]
+    resources = [aws_sqs_queue.downloader_queue[0].arn]
   }
 }
 
 resource "aws_iam_role_policy" "binaryalert_downloader_policy" {
-  count  = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count  = var.enable_carbon_black_downloader ? 1 : 0
   name   = "${var.name_prefix}_binaryalert_downloader_policy"
-  role   = "${module.binaryalert_downloader.role_id}"
-  policy = "${data.aws_iam_policy_document.binaryalert_downloader_policy.json}"
+  role   = module.binaryalert_downloader.role_id
+  policy = data.aws_iam_policy_document.binaryalert_downloader_policy[0].json
 }
+
diff --git a/terraform/main.tf b/terraform/main.tf
index 120a310..2c8db0f 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -1,8 +1,4 @@
-terraform {
-  required_version = "~> 0.11.7"
-}
-
 provider "aws" {
-  version = "~> 1.30.0"
-  region  = "${var.aws_region}"
+  version = "~> 2.45.0"
+  region  = var.aws_region
 }
diff --git a/terraform/modules/lambda/main.tf b/terraform/modules/lambda/main.tf
index 9cc5a7f..138b06e 100644
--- a/terraform/modules/lambda/main.tf
+++ b/terraform/modules/lambda/main.tf
@@ -1,7 +1,7 @@
 /* Module to create the base components for each Lambda function. */
 
 data "aws_iam_policy_document" "lambda_execution_policy" {
-  count = "${var.enabled}"
+  count = var.enabled
 
   statement {
     sid     = "AllowLambdaToAssumeRole"
@@ -16,67 +16,67 @@ data "aws_iam_policy_document" "lambda_execution_policy" {
 
 // Create a custom execution role for each Lambda function.
 resource "aws_iam_role" "role" {
-  count              = "${var.enabled}"
+  count              = var.enabled
   name               = "${var.function_name}_role"
-  assume_role_policy = "${data.aws_iam_policy_document.lambda_execution_policy.json}"
+  assume_role_policy = data.aws_iam_policy_document.lambda_execution_policy[0].json
 }
 
 // Attach the base IAM policy.
 resource "aws_iam_role_policy_attachment" "attach_base_policy" {
-  count      = "${var.enabled}"
-  role       = "${aws_iam_role.role.name}"
-  policy_arn = "${var.base_policy_arn}"
+  count      = var.enabled
+  role       = aws_iam_role.role[0].name
+  policy_arn = var.base_policy_arn
 }
 
 // Create the Lambda log group.
 resource "aws_cloudwatch_log_group" "lambda_log_group" {
-  count             = "${var.enabled}"
+  count             = var.enabled
   name              = "/aws/lambda/${var.function_name}"
-  retention_in_days = "${var.log_retention_days}"
+  retention_in_days = var.log_retention_days
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
 
 // Create the Lambda function.
 resource "aws_lambda_function" "function" {
-  count = "${var.enabled}"
+  count = var.enabled
 
-  function_name = "${var.function_name}"
-  description   = "${var.description}"
-  handler       = "${var.handler}"
-  role          = "${aws_iam_role.role.arn}"
+  function_name = var.function_name
+  description   = var.description
+  handler       = var.handler
+  role          = aws_iam_role.role[0].arn
   runtime       = "python3.6"
 
-  memory_size                    = "${var.memory_size_mb}"
-  timeout                        = "${var.timeout_sec}"
-  reserved_concurrent_executions = "${var.reserved_concurrent_executions}"
+  memory_size                    = var.memory_size_mb
+  timeout                        = var.timeout_sec
+  reserved_concurrent_executions = var.reserved_concurrent_executions
 
-  filename         = "${var.filename}"
-  source_code_hash = "${base64sha256(file(var.filename))}"
+  filename         = var.filename
+  source_code_hash = filebase64sha256(var.filename)
   publish          = true
 
   environment {
-    variables = "${var.environment_variables}"
+    variables = var.environment_variables
   }
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
 
 // Create a Production alias for each Lambda function.
 resource "aws_lambda_alias" "production_alias" {
-  count            = "${var.enabled}"
+  count            = var.enabled
   name             = "Production"
-  function_name    = "${aws_lambda_function.function.arn}"
-  function_version = "${aws_lambda_function.function.version}"
+  function_name    = aws_lambda_function.function[0].arn
+  function_version = aws_lambda_function.function[0].version
 }
 
 // Alarm if the Lambda function has more than the configured number of errors.
 resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
-  count      = "${var.enabled}"
+  count      = var.enabled
   alarm_name = "${var.function_name}_errors"
 
   alarm_description = <<EOF
@@ -84,19 +84,21 @@ ${var.function_name} has a high error rate. Check the CloudWatch logs.
 ${var.alarm_errors_help}
 EOF
 
+
   namespace   = "AWS/Lambda"
   metric_name = "Errors"
   statistic   = "Sum"
 
   dimensions = {
-    FunctionName = "${aws_lambda_function.function.function_name}"
-    Resource     = "${aws_lambda_function.function.function_name}:${aws_lambda_alias.production_alias.name}"
+    FunctionName = aws_lambda_function.function[0].function_name
+    Resource     = "${aws_lambda_function.function[0].function_name}:${aws_lambda_alias.production_alias[0].name}"
   }
 
   comparison_operator = "GreaterThanOrEqualToThreshold"
-  threshold           = "${var.alarm_errors_threshold}"
-  period              = "${var.alarm_errors_interval_secs}"
+  threshold           = var.alarm_errors_threshold
+  period              = var.alarm_errors_interval_secs
   evaluation_periods  = 1
 
-  alarm_actions = ["${var.alarm_sns_arns}"]
+  alarm_actions = var.alarm_sns_arns
 }
+
diff --git a/terraform/modules/lambda/outputs.tf b/terraform/modules/lambda/outputs.tf
index 1a5cb24..6b85b4c 100644
--- a/terraform/modules/lambda/outputs.tf
+++ b/terraform/modules/lambda/outputs.tf
@@ -2,25 +2,32 @@
 # https://www.terraform.io/upgrade-guides/0-11.html#referencing-attributes-from-resources-with-count-0
 
 output "alias_arn" {
-  value = "${element(concat(aws_lambda_alias.production_alias.*.arn, list("")), 0)}"
+  value = element(concat(aws_lambda_alias.production_alias.*.arn, [""]), 0)
 }
 
 output "alias_name" {
-  value = "${element(concat(aws_lambda_alias.production_alias.*.name, list("")), 0)}"
+  value = element(concat(aws_lambda_alias.production_alias.*.name, [""]), 0)
 }
 
 output "function_arn" {
-  value = "${element(concat(aws_lambda_function.function.*.arn, list("")), 0)}"
+  value = element(concat(aws_lambda_function.function.*.arn, [""]), 0)
 }
 
 output "function_name" {
-  value = "${element(concat(aws_lambda_function.function.*.function_name, list("")), 0)}"
+  value = element(
+    concat(aws_lambda_function.function.*.function_name, [""]),
+    0,
+  )
 }
 
 output "log_group_name" {
-  value = "${element(concat(aws_cloudwatch_log_group.lambda_log_group.*.name, list("")), 0)}"
+  value = element(
+    concat(aws_cloudwatch_log_group.lambda_log_group.*.name, [""]),
+    0,
+  )
 }
 
 output "role_id" {
-  value = "${element(concat(aws_iam_role.role.*.id, list("")), 0)}"
+  value = element(concat(aws_iam_role.role.*.id, [""]), 0)
 }
+
diff --git a/terraform/modules/lambda/variables.tf b/terraform/modules/lambda/variables.tf
index 5ce9dbd..b2a5778 100644
--- a/terraform/modules/lambda/variables.tf
+++ b/terraform/modules/lambda/variables.tf
@@ -26,6 +26,7 @@ variable "memory_size_mb" {
 Memory allocated to the Lambda function (128 - 1536 MB).
 Lambda also allocates CPU and network resources in proportion to the configured memory.
 EOF
+
 }
 
 variable "timeout_sec" {
@@ -41,7 +42,7 @@ variable "reserved_concurrent_executions" {
 }
 
 variable "environment_variables" {
-  type        = "map"
+  type        = map(string)
   description = "Map of environment variables available to the running Lambda function"
 }
 
@@ -60,10 +61,11 @@ variable "alarm_errors_help" {
 
 variable "alarm_errors_threshold" {
   description = "If at least this many errors occur within alarm_errors_interval_secs, a metric alarm will trigger"
+
   # The error threshold has been increased significantly; this is due to a recent change that
   # retries HTTP 404s by raising errors on Lambda, designed to accommodate for race conditions
   # on the availability of the binary resource.
-  default     = 250
+  default = 250
 }
 
 variable "alarm_errors_interval_secs" {
@@ -72,6 +74,7 @@ variable "alarm_errors_interval_secs" {
 }
 
 variable "alarm_sns_arns" {
-  type        = "list"
+  type        = list(string)
   description = "A list of SNS topic ARNs which will be notified when a metric alarm triggers"
 }
+
diff --git a/terraform/modules/lambda/versions.tf b/terraform/modules/lambda/versions.tf
new file mode 100644
index 0000000..c8f2804
--- /dev/null
+++ b/terraform/modules/lambda/versions.tf
@@ -0,0 +1,4 @@
+
+terraform {
+  required_version = "~> 0.12.9"
+}
diff --git a/terraform/s3.tf b/terraform/s3.tf
index c6a2b0a..4c3ef45 100644
--- a/terraform/s3.tf
+++ b/terraform/s3.tf
@@ -1,9 +1,13 @@
 // S3 bucket for storing access logs.
 resource "aws_s3_bucket" "binaryalert_log_bucket" {
-  count = "${var.s3_log_bucket == "" ? 1 : 0}" // Create only if no pre-existing log bucket.
+  count = var.s3_log_bucket == "" ? 1 : 0 // Create only if no pre-existing log bucket.
 
-  bucket = "${format("%s.binaryalert-binaries.%s.access-logs", replace(var.name_prefix, "_", "."), var.aws_region)}"
-  acl    = "log-delivery-write"
+  bucket = format(
+    "%s.binaryalert-binaries.%s.access-logs",
+    replace(var.name_prefix, "_", "."),
+    var.aws_region,
+  )
+  acl = "log-delivery-write"
 
   // Everything in the log bucket rotates to infrequent access and expires.
   lifecycle_rule {
@@ -17,7 +21,7 @@ resource "aws_s3_bucket" "binaryalert_log_bucket" {
     }
 
     expiration {
-      days = "${var.s3_log_expiration_days}"
+      days = var.s3_log_expiration_days
     }
 
     // Old/deleted object versions are permanently removed after 1 day.
@@ -29,7 +33,11 @@ resource "aws_s3_bucket" "binaryalert_log_bucket" {
   // Enable logging on the logging bucket itself.
   logging {
     // The target bucket is the same as the name of this bucket.
-    target_bucket = "${format("%s.binaryalert-binaries.%s.access-logs", replace(var.name_prefix, "_", "."), var.aws_region)}"
+    target_bucket = format(
+      "%s.binaryalert-binaries.%s.access-logs",
+      replace(var.name_prefix, "_", "."),
+      var.aws_region,
+    )
     target_prefix = "self/"
   }
 
@@ -41,8 +49,8 @@ resource "aws_s3_bucket" "binaryalert_log_bucket" {
     }
   }
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 
   // Enabling versioning protects against accidental deletes.
@@ -50,12 +58,12 @@ resource "aws_s3_bucket" "binaryalert_log_bucket" {
     enabled = true
   }
 
-  force_destroy = "${var.force_destroy}"
+  force_destroy = var.force_destroy
 }
 
 // Policy for log bucket that forces ssl only access
 data "aws_iam_policy_document" "force_ssl_only_access" {
-  count = "${var.s3_log_bucket == "" ? 1 : 0}" // Create only if no pre-existing log bucket.
+  count = var.s3_log_bucket == "" ? 1 : 0 // Create only if no pre-existing log bucket.
 
   # Force SSL access only
   statement {
@@ -71,8 +79,8 @@ data "aws_iam_policy_document" "force_ssl_only_access" {
     actions = ["s3:*"]
 
     resources = [
-      "${aws_s3_bucket.binaryalert_log_bucket.arn}",
-      "${aws_s3_bucket.binaryalert_log_bucket.arn}/*",
+      aws_s3_bucket.binaryalert_log_bucket[0].arn,
+      "${aws_s3_bucket.binaryalert_log_bucket[0].arn}/*",
     ]
 
     condition {
@@ -84,10 +92,10 @@ data "aws_iam_policy_document" "force_ssl_only_access" {
 }
 
 resource "aws_s3_bucket_policy" "force_ssl_only_access" {
-  count = "${var.s3_log_bucket == "" ? 1 : 0}" // Create only if no pre-existing log bucket.
+  count = var.s3_log_bucket == "" ? 1 : 0 // Create only if no pre-existing log bucket.
 
-  bucket = "${aws_s3_bucket.binaryalert_log_bucket.id}"
-  policy = "${data.aws_iam_policy_document.force_ssl_only_access.json}"
+  bucket = aws_s3_bucket.binaryalert_log_bucket[0].id
+  policy = data.aws_iam_policy_document.force_ssl_only_access[0].json
 }
 
 // Source S3 bucket: binaries uploaded here will be automatically analyzed.
@@ -98,11 +106,13 @@ resource "aws_s3_bucket" "binaryalert_binaries" {
   logging {
     // Send S3 access logs to either the user-defined logging bucket or the one we created.
     // Note: We can't reference log bucket ID here becuase the bucket may not exist.
-    target_bucket = "${var.s3_log_bucket == "" ?
-      format("%s.binaryalert-binaries.%s.access-logs", replace(var.name_prefix, "_", "."), var.aws_region)
-      : var.s3_log_bucket}"
+    target_bucket = var.s3_log_bucket == "" ? format(
+      "%s.binaryalert-binaries.%s.access-logs",
+      replace(var.name_prefix, "_", "."),
+      var.aws_region,
+    ) : var.s3_log_bucket
 
-    target_prefix = "${var.s3_log_prefix}"
+    target_prefix = var.s3_log_prefix
   }
 
   // Note: STANDARD_IA is not worth it because of the need to periodically re-analyze all binaries
@@ -135,21 +145,21 @@ resource "aws_s3_bucket" "binaryalert_binaries" {
   server_side_encryption_configuration {
     rule {
       apply_server_side_encryption_by_default {
-        kms_master_key_id = "${aws_kms_key.sse_s3.arn}"
+        kms_master_key_id = aws_kms_key.sse_s3.arn
         sse_algorithm     = "aws:kms"
       }
     }
   }
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 
   versioning {
     enabled = true
   }
 
-  force_destroy = "${var.force_destroy}"
+  force_destroy = var.force_destroy
 }
 
 // Policy for source bucket that allows inventory delivery
@@ -168,7 +178,7 @@ data "aws_iam_policy_document" "allow_inventory" {
     condition {
       test     = "StringEquals"
       variable = "aws:SourceAccount"
-      values   = ["${var.aws_account_id}"]
+      values   = [var.aws_account_id]
     }
 
     condition {
@@ -180,7 +190,7 @@ data "aws_iam_policy_document" "allow_inventory" {
     condition {
       test     = "ArnLike"
       variable = "aws:SourceArn"
-      values   = ["${aws_s3_bucket.binaryalert_binaries.arn}"]
+      values   = [aws_s3_bucket.binaryalert_binaries.arn]
     }
   }
 
@@ -198,7 +208,7 @@ data "aws_iam_policy_document" "allow_inventory" {
     actions = ["s3:*"]
 
     resources = [
-      "${aws_s3_bucket.binaryalert_binaries.arn}",
+      aws_s3_bucket.binaryalert_binaries.arn,
       "${aws_s3_bucket.binaryalert_binaries.arn}/*",
     ]
 
@@ -211,13 +221,13 @@ data "aws_iam_policy_document" "allow_inventory" {
 }
 
 resource "aws_s3_bucket_policy" "allow_inventory" {
-  bucket = "${aws_s3_bucket.binaryalert_binaries.id}"
-  policy = "${data.aws_iam_policy_document.allow_inventory.json}"
+  bucket = aws_s3_bucket.binaryalert_binaries.id
+  policy = data.aws_iam_policy_document.allow_inventory.json
 }
 
 // Enable bucket inventory
 resource "aws_s3_bucket_inventory" "binary_inventory" {
-  bucket = "${aws_s3_bucket.binaryalert_binaries.id}"
+  bucket = aws_s3_bucket.binaryalert_binaries.id
   name   = "EntireBucketDaily"
 
   included_object_versions = "Current"
@@ -229,12 +239,12 @@ resource "aws_s3_bucket_inventory" "binary_inventory" {
   destination {
     bucket {
       format     = "CSV"
-      bucket_arn = "${aws_s3_bucket.binaryalert_binaries.arn}"
+      bucket_arn = aws_s3_bucket.binaryalert_binaries.arn
       prefix     = "inventory"
 
       encryption {
         sse_kms {
-          key_id = "${aws_kms_key.sse_s3.arn}"
+          key_id = aws_kms_key.sse_s3.arn
         }
       }
     }
@@ -243,13 +253,14 @@ resource "aws_s3_bucket_inventory" "binary_inventory" {
 
 // New objects uploaded for analysis notify the analyzer queue
 resource "aws_s3_bucket_notification" "bucket_notification" {
-  bucket = "${aws_s3_bucket.binaryalert_binaries.id}"
+  bucket = aws_s3_bucket.binaryalert_binaries.id
 
   queue {
-    queue_arn = "${aws_sqs_queue.analyzer_queue.arn}"
+    queue_arn = aws_sqs_queue.analyzer_queue.arn
     events    = ["s3:ObjectCreated:*"]
   }
 
   // The queue policy must be created before we can configure the S3 notification.
-  depends_on = ["aws_sqs_queue_policy.analyzer_queue_policy"]
+  depends_on = [aws_sqs_queue_policy.analyzer_queue_policy]
 }
+
diff --git a/terraform/sns.tf b/terraform/sns.tf
index 2ee9d4c..ce8213d 100644
--- a/terraform/sns.tf
+++ b/terraform/sns.tf
@@ -5,12 +5,13 @@ resource "aws_sns_topic" "yara_match_alerts" {
 
 // If a file does NOT match any YARA rules, notify this SNS topic.
 resource "aws_sns_topic" "no_yara_match" {
-  count = "${var.enable_negative_match_alerts ? 1 : 0}"
+  count = var.enable_negative_match_alerts ? 1 : 0
   name  = "${var.name_prefix}_binaryalert_no_yara_match"
 }
 
 // CloudWatch metric alarms notify this SNS topic (created only if an existing one is not specified)
 resource "aws_sns_topic" "metric_alarms" {
-  count = "${var.metric_alarm_sns_topic_arn == "" ? 1 : 0}"
+  count = var.metric_alarm_sns_topic_arn == "" ? 1 : 0
   name  = "${var.name_prefix}_binaryalert_metric_alarms"
 }
+
diff --git a/terraform/sqs.tf b/terraform/sqs.tf
index 7d73e94..f2c2c34 100644
--- a/terraform/sqs.tf
+++ b/terraform/sqs.tf
@@ -1,15 +1,15 @@
 // Analysis queue - S3 objects which need to be analyzed
 resource "aws_sqs_queue" "analyzer_queue" {
   name                      = "${var.name_prefix}_binaryalert_analyzer_queue"
-  kms_master_key_id         = "${aws_kms_key.sse_sqs.arn}"
-  message_retention_seconds = "${var.analyze_queue_retention_secs}"
+  kms_master_key_id         = aws_kms_key.sse_sqs.arn
+  message_retention_seconds = var.analyze_queue_retention_secs
 
   // When a message is received, it will be invisible to other consumers for this long.
   // Set to just a few seconds after the lambda analyzer would timeout.
-  visibility_timeout_seconds = "${format("%d", var.lambda_analyze_timeout_sec + 2)}"
+  visibility_timeout_seconds = format("%d", var.lambda_analyze_timeout_sec + 2)
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
 
@@ -23,39 +23,39 @@ data "aws_iam_policy_document" "analyzer_queue_policy" {
     }
 
     actions   = ["sqs:SendMessage"]
-    resources = ["${aws_sqs_queue.analyzer_queue.arn}"]
+    resources = [aws_sqs_queue.analyzer_queue.arn]
 
     // Allow only the BinaryAlert S3 bucket to notify the SQS queue.
     condition {
       test     = "ArnEquals"
       variable = "aws:SourceArn"
-      values   = ["${aws_s3_bucket.binaryalert_binaries.arn}"]
+      values   = [aws_s3_bucket.binaryalert_binaries.arn]
     }
   }
 }
 
 // Allow analyzer queue to be sent messages from the BinaryAlert S3 bucket.
 resource "aws_sqs_queue_policy" "analyzer_queue_policy" {
-  queue_url = "${aws_sqs_queue.analyzer_queue.id}"
-  policy    = "${data.aws_iam_policy_document.analyzer_queue_policy.json}"
+  queue_url = aws_sqs_queue.analyzer_queue.id
+  policy    = data.aws_iam_policy_document.analyzer_queue_policy.json
 }
 
 // Downloader queue - MD5s to download from CarbonBlack
 resource "aws_sqs_queue" "downloader_queue" {
-  count                     = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count                     = var.enable_carbon_black_downloader ? 1 : 0
   name                      = "${var.name_prefix}_binaryalert_downloader_queue"
-  kms_master_key_id         = "${aws_kms_key.sse_sqs.arn}"
-  message_retention_seconds = "${var.download_queue_retention_secs}"
+  kms_master_key_id         = aws_kms_key.sse_sqs.arn
+  message_retention_seconds = var.download_queue_retention_secs
 
   // When a message is received, it will be invisible to other consumers for this long.
   // Set to just a few seconds after the downloader would timeout.
-  visibility_timeout_seconds = "${format("%d", var.lambda_download_timeout_sec + 2)}"
+  visibility_timeout_seconds = format("%d", var.lambda_download_timeout_sec + 2)
 
   // If a message fails to be processed after the set number of retries, it is delivered to the DLQ.
-  redrive_policy = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.dead_letter_queue.arn}\",\"maxReceiveCount\":${var.download_queue_max_receives}}"
+  redrive_policy = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.dead_letter_queue[0].arn}\",\"maxReceiveCount\":${var.download_queue_max_receives}}"
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
 
@@ -63,13 +63,14 @@ resource "aws_sqs_queue" "downloader_queue" {
 // Messages sent here are meant for human consumption (debugging) and are retained for 14 days.
 // This is only used for the downloader queue (for now).
 resource "aws_sqs_queue" "dead_letter_queue" {
-  count                     = "${var.enable_carbon_black_downloader ? 1 : 0}"
+  count                     = var.enable_carbon_black_downloader ? 1 : 0
   name                      = "${var.name_prefix}_binaryalert_sqs_dead_letter_queue"
   message_retention_seconds = 1209600
 
-  kms_master_key_id = "${aws_kms_key.sse_sqs.arn}"
+  kms_master_key_id = aws_kms_key.sse_sqs.arn
 
-  tags {
-    Name = "${var.tagged_name}"
+  tags = {
+    Name = var.tagged_name
   }
 }
+
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 5a88a88..3957e29 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -1,49 +1,103 @@
 /* See terraform.tfvars for descriptions of each of the variables. */
 
-variable "aws_account_id" {}
-variable "aws_region" {}
-variable "name_prefix" {}
+variable "aws_account_id" {
+}
+
+variable "aws_region" {
+}
+
+variable "name_prefix" {
+}
+
+variable "enable_carbon_black_downloader" {
+}
+
+variable "carbon_black_url" {
+}
+
+variable "carbon_black_timeout" {
+}
+
+variable "encrypted_carbon_black_api_token" {
+}
 
 variable "enable_carbon_black_downloader" {}
 variable "carbon_black_url" {}
 variable "carbon_black_timeout" {}
 variable "encrypted_carbon_black_api_token" {}
 
-variable "s3_log_bucket" {}
-variable "s3_log_prefix" {}
-variable "s3_log_expiration_days" {}
-variable "lambda_log_retention_days" {}
 
-variable "tagged_name" {}
+variable "s3_log_prefix" {
+}
 
-variable "metric_alarm_sns_topic_arn" {}
-variable "expected_analysis_frequency_minutes" {}
+variable "s3_log_expiration_days" {
+}
 
-variable "dynamo_read_capacity" {}
-variable "dynamo_write_capacity" {}
+variable "lambda_log_retention_days" {
+}
 
-variable "lambda_analyze_memory_mb" {}
-variable "lambda_analyze_timeout_sec" {}
-variable "lambda_analyze_concurrency_limit" {}
-variable "lambda_download_memory_mb" {}
-variable "lambda_download_timeout_sec" {}
-variable "lambda_download_concurrency_limit" {}
+variable "tagged_name" {
+}
 
-variable "force_destroy" {}
+variable "metric_alarm_sns_topic_arn" {
+}
+
+variable "expected_analysis_frequency_minutes" {
+}
+
+variable "dynamo_read_capacity" {
+}
+
+variable "dynamo_write_capacity" {
+}
+
+variable "lambda_analyze_memory_mb" {
+}
+
+variable "lambda_analyze_timeout_sec" {
+}
+
+variable "lambda_analyze_concurrency_limit" {
+}
+
+variable "lambda_download_memory_mb" {
+}
+
+variable "lambda_download_timeout_sec" {
+}
+
+variable "lambda_download_concurrency_limit" {
+}
+
+variable "force_destroy" {
+}
 
 variable "external_s3_bucket_resources" {
-  type = "list"
+  type = list(string)
 }
 
 variable "external_kms_key_resources" {
-  type = "list"
+  type = list(string)
 }
 
-variable "enable_negative_match_alerts" {}
+variable "enable_negative_match_alerts" {
+}
+
+variable "analyze_queue_batch_size" {
+}
+
+variable "download_queue_batch_size" {
+}
+
+variable "analyze_queue_retention_secs" {
+}
+
+variable "download_queue_retention_secs" {
+}
+
+variable "objects_per_retro_message" {
+}
+
+variable "download_queue_max_receives" {
+}
 
-variable "analyze_queue_batch_size" {}
-variable "download_queue_batch_size" {}
-variable "analyze_queue_retention_secs" {}
-variable "download_queue_retention_secs" {}
-variable "objects_per_retro_message" {}
-variable "download_queue_max_receives" {}
diff --git a/terraform/versions.tf b/terraform/versions.tf
new file mode 100644
index 0000000..cab229b
--- /dev/null
+++ b/terraform/versions.tf
@@ -0,0 +1,3 @@
+terraform {
+  required_version = "~> 0.12.9"
+}
\ No newline at end of file