Repository: chef/automate
Pull request #8148 (2023-08-22 18:03:39)

OpenJDK Version update to 11.0.20
### :nut_and_bolt: Description: What code changed, and why?

<!-- /!\ Please ensure that you are NOT disclosing any customer information without their consent /!\ -->

### :chains: Related Resources

### :+1: Definition of Done

### :athletic_shoe: How to Build and Test the Change

### :white_check_mark: Checklist

**All PRs** must tick these:

- [ ] I have read the [CONTRIBUTING document](https://github.com/chef/automate/blob/master/CONTRIBUTING.md).
- [ ] All commits signed-off for the [Developer Certification of Origin](https://github.com/chef/chef/blob/master/CONTRIBUTING.md#developer-certification-of-origin-dco).

With occasional exceptions, all PRs **from Progress employees** must tick these:

- [ ] Is the code clear? *(complicated code or lots of comments--subdivide and use well-named methods, meaningful variable names, etc.)*
- [ ] Consistency checked? *(user notifications, user prompts, visual patterns, code patterns, variable names)*
- [ ] Repeated code blocks eliminated? *(adapt and reuse existing components, blocks, functions, etc.)*
- [ ] Spelling, grammar, typos checked? *(at a minimum use `make spell` in any component directory)*
- [ ] Code well-formatted? *(indents, line breaks, etc. improve rather than hinder readability)*

All PRs **from Progress employees** should tick these if appropriate:

- [ ] Tests added/updated? (all new code needs new tests)
- [ ] Docs added/updated? (all customer-facing changes)

*Please add a note next to any checkbox above if you are NOT ticking it.*

### :camera: Screenshots, if applicable


netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *chef-automate* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | d829a74d04730a5eadbd7d5a0f1f4426e9e885ef |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/chef-automate/deploys/64e4f87dc20631000805c48d |
sonarqube-for-infrastructure-prod[bot]: **SonarQube Quality Gate**

[![Quality Gate passed](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonar.progress.com/dashboard?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148)

[![Bug](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/bug-16px.png 'Bug')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=BUG) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=BUG) [0 Bugs](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=BUG)  
[![Vulnerability](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/vulnerability-16px.png 'Vulnerability')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=VULNERABILITY) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/security_hotspot-16px.png 'Security Hotspot')](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148) [0 Security Hotspots](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148)  
[![Code Smell](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/code_smell-16px.png 'Code Smell')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=CODE_SMELL) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonar.progress.com/component_measures?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&metric=coverage&view=list) No Coverage information  
[![No Duplication information](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonar.progress.com/component_measures?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8148&metric=duplicated_lines_density&view=list) No Duplication information



Patch:
diff --git a/VERSION b/VERSION
index 951649423..1466ef541 100644
--- a/VERSION
+++ b/VERSION
@@ -1,1 +1,1 @@
-4.9.54
\ No newline at end of file
+4.9.60
\ No newline at end of file
diff --git a/components/automate-cli/cmd/chef-automate/ha_node_operations_utils.go b/components/automate-cli/cmd/chef-automate/ha_node_operations_utils.go
index f7bcb71c4..e0b2347f7 100644
--- a/components/automate-cli/cmd/chef-automate/ha_node_operations_utils.go
+++ b/components/automate-cli/cmd/chef-automate/ha_node_operations_utils.go
@@ -750,22 +750,14 @@ func getNodeObjectsToFetchConfigFromAllNodeTypes() []*NodeObject {
 func getNodeObjectsToPatchWorkspaceConfigToAllNodes() []*NodeObject {
 	timestamp := time.Now().Format("20060102150405")
 	fmt.Println("====================================================================")
-	fmt.Println("sync Config to all nodes")
+	fmt.Println("Syncing configs to frontend nodes")
 	frontendPrefix := "frontend" + "_" + timestamp + "_"
 	frontend := fmt.Sprintf(FRONTEND_COMMAND, PATCH, frontendPrefix+AUTOMATE_TOML, DATE_FORMAT)
 	chefserver := fmt.Sprintf(FRONTEND_COMMAND, PATCH, frontendPrefix+CHEF_SERVER_TOML, DATE_FORMAT)
-	backendPrefix := "opensearch" + "_" + timestamp + "_"
-	os := fmt.Sprintf(BACKEND_COMMAND, DATE_FORMAT, OPENSEARCH, "%s", backendPrefix+OPENSEARCH_TOML)
 	nodeObjects := []*NodeObject{
 		NewNodeObjectWithOutputFile(frontend, nil, []string{AUTOMATE_HA_AUTOMATE_NODE_CONFIG_DIR + AUTOMATE_TOML}, frontendPrefix, AUTOMATE),
 		NewNodeObjectWithOutputFile(chefserver, nil, []string{AUTOMATE_HA_AUTOMATE_NODE_CONFIG_DIR + CHEF_SERVER_TOML}, frontendPrefix, CHEF_SERVER),
 	}
-	if !isManagedServicesOn() {
-		backendNodeObjects := []*NodeObject{
-			NewNodeObjectWithOutputFile(os, nil, []string{AUTOMATE_HA_AUTOMATE_NODE_CONFIG_DIR + OPENSEARCH_TOML}, backendPrefix, OPENSEARCH),
-		}
-		nodeObjects = append(nodeObjects, backendNodeObjects...)
-	}
 	return nodeObjects
 }
 
@@ -777,11 +769,6 @@ func createNodeMap(outputFiles []string, inputFiles []string, inputFilesPrefix s
 		cmd.CmdInputs.Args = inputFiles
 	} else if service == OPENSEARCH {
 		cmd.CmdInputs.Args = inputFiles
-		if len(inputFiles) > 0 {
-			cmd.PreExec = prePatchForOsNodes
-			cmd.CmdInputs.InputFilesPrefix = inputFilesPrefix
-			cmd.CmdInputs.WaitTimeout = 300
-		}
 	} else {
 		cmd.CmdInputs.Args = inputFiles
 		// Patch only incase of frontends node
@@ -833,6 +820,8 @@ func prePatchForFrontendNodes(inputs *CmdInputs, sshUtil SSHUtil, infra *Automat
 	return nil
 }
 
+// prePatchForOsNodes 
+// Note: this func is not being in used currently as it was meant for os-config sync
 func prePatchForOsNodes(inputs *CmdInputs, sshUtil SSHUtil, infra *AutomateHAInfraDetails, remoteService string, writer *cli.Writer) error {
 	srcPath, err := removeRestrictedKeysFromSrcFileOs(inputs.Args[0])
 	if err != nil {
diff --git a/components/automate-cli/pkg/verifyserver/constants/sshusercheck.go b/components/automate-cli/pkg/verifyserver/constants/sshusercheck.go
index 362929afe..4b0109569 100644
--- a/components/automate-cli/pkg/verifyserver/constants/sshusercheck.go
+++ b/components/automate-cli/pkg/verifyserver/constants/sshusercheck.go
@@ -9,7 +9,7 @@ const (
 	SUDO_PASSWORD_SUCCESS_MESSAGE               = "SSH user sudo password is valid for the node: "
 	SSH_USER_FAILURE_TITLE                      = "SSH user unaccessible"
 	SSH_USER_ERROR_MESSAGE                      = "SSH user is unaccessible for the node with IP: "
-	SSH_USER_RESOLUTION_MESSAGE                 = "Give SSH access to the user with the give key on the node: "
+	SSH_USER_RESOLUTION_MESSAGE                 = "Give SSH access to the user with the given key on the node: "
 	SUDO_PASSWORD_FAILURE_TITLE                 = "Sudo password invalid"
 	SUDO_PASSWORD_ERROR_MESSAGE                 = "SSH user sudo password is invalid for the node with IP: "
 	SUDO_PASSWORD_FAILURE_RESOLUTION_MESSAGE    = "Ensure you have provided the correct sudo password and the user has sudo access on the node: "
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger.go
index 2db984fba..ebc433a2e 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger.go
@@ -80,24 +80,28 @@ func getRequestsForAutomateAsSource(config *models.Config) []models.FirewallRequ
 	for _, sourceNodeIP := range config.Hardware.AutomateNodeIps {
 		// Dest postgres
 		for _, destNodeIP := range config.Hardware.PostgresqlNodeIps {
-			reqBody := models.FirewallRequest{
-				SourceNodeIP:               sourceNodeIP,
-				DestinationNodeIP:          destNodeIP,
-				DestinationServicePort:     "7432",
-				DestinationServiceProtocol: "tcp",
+			for _, port := range frontendToPostgresqlPorts {
+				reqBody := models.FirewallRequest{
+					SourceNodeIP:               sourceNodeIP,
+					DestinationNodeIP:          destNodeIP,
+					DestinationServicePort:     port,
+					DestinationServiceProtocol: "tcp",
+				}
+				reqBodies = append(reqBodies, reqBody)
 			}
-			reqBodies = append(reqBodies, reqBody)
 		}
 
+		//Dest Opensearch
 		for _, destNodeIP := range config.Hardware.OpenSearchNodeIps {
-			//Dest Opensearch
-			reqBody := models.FirewallRequest{
-				SourceNodeIP:               sourceNodeIP,
-				DestinationNodeIP:          destNodeIP,
-				DestinationServicePort:     "9200",
-				DestinationServiceProtocol: "tcp",
+			for _, port := range frontendToOpensearchPorts {
+				reqBody := models.FirewallRequest{
+					SourceNodeIP:               sourceNodeIP,
+					DestinationNodeIP:          destNodeIP,
+					DestinationServicePort:     port,
+					DestinationServiceProtocol: "tcp",
+				}
+				reqBodies = append(reqBodies, reqBody)
 			}
-			reqBodies = append(reqBodies, reqBody)
 		}
 	}
 	return reqBodies
@@ -111,24 +115,29 @@ func getRequestsForChefServerAsSource(config *models.Config) []models.FirewallRe
 	for _, sourceNodeIP := range config.Hardware.ChefInfraServerNodeIps {
 		// Dest postgres
 		for _, destNodeIP := range config.Hardware.PostgresqlNodeIps {
-			reqBody := models.FirewallRequest{
-				SourceNodeIP:               sourceNodeIP,
-				DestinationNodeIP:          destNodeIP,
-				DestinationServicePort:     "7432",
-				DestinationServiceProtocol: "tcp",
+			for _, port := range frontendToPostgresqlPorts {
+				reqBody := models.FirewallRequest{
+					SourceNodeIP:               sourceNodeIP,
+					DestinationNodeIP:          destNodeIP,
+					DestinationServicePort:     port,
+					DestinationServiceProtocol: "tcp",
+				}
+				reqBodies = append(reqBodies, reqBody)
 			}
-			reqBodies = append(reqBodies, reqBody)
+
 		}
 
 		// Dest opensearch
 		for _, destNodeIP := range config.Hardware.OpenSearchNodeIps {
-			reqBody := models.FirewallRequest{
-				SourceNodeIP:               sourceNodeIP,
-				DestinationNodeIP:          destNodeIP,
-				DestinationServicePort:     "9200",
-				DestinationServiceProtocol: "tcp",
+			for _, port := range frontendToOpensearchPorts {
+				reqBody := models.FirewallRequest{
+					SourceNodeIP:               sourceNodeIP,
+					DestinationNodeIP:          destNodeIP,
+					DestinationServicePort:     port,
+					DestinationServiceProtocol: "tcp",
+				}
+				reqBodies = append(reqBodies, reqBody)
 			}
-			reqBodies = append(reqBodies, reqBody)
 		}
 
 	}
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/vars.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/vars.go
index ac1a04c6a..efb1a50b6 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/vars.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/vars.go
@@ -1,6 +1,8 @@
 package firewallchecktrigger
 
 var (
-	postgresqlTCPPorts = [4]string{"9631", "7432", "5432", "6432"}
-	opensearchTCPPorts = [3]string{"9631", "9200", "9300"}
-)
+	postgresqlTCPPorts        = [4]string{"9631", "7432", "5432", "6432"}
+	opensearchTCPPorts        = [3]string{"9631", "9200", "9300"}
+	frontendToPostgresqlPorts = [2]string{"7432", "9631"}
+	frontendToOpensearchPorts = [2]string{"9631", "9200"}
+)
\ No newline at end of file
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger.go
index 1bcaf1b5a..a20a3559a 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger.go
@@ -84,8 +84,8 @@ func (ss *SshUserAccessCheck) getSShUserAPIRequest(ip string, sshUser *models.SS
 	if err != nil {
 		return models.SShUserRequest{}, err
 	}
-	if permisssion > 400 {
-		return models.SShUserRequest{}, errors.New("Provide permission on the SSH key file as 400 (Read Only by Owner).")
+	if permisssion > 600 {
+		return models.SShUserRequest{}, errors.New("Provide permission on the SSH key file as 400 (Read Only by Owner) or 600 (Read and Write by Owner).")
 	}
 	ct, err := ss.fileUtils.ReadFile(sshUser.PrivateKey)
 	if err != nil {
diff --git a/components/automate-openjdk/habitat/plan.sh b/components/automate-openjdk/habitat/plan.sh
index bec8d401c..8d847715a 100644
--- a/components/automate-openjdk/habitat/plan.sh
+++ b/components/automate-openjdk/habitat/plan.sh
@@ -9,10 +9,10 @@ pkg_origin=chef
 pkg_maintainer="Chef Software Inc. <support@chef.io>"
 pkg_name=automate-openjdk
 # Release archive https://jdk.java.net/archive/
-pkg_version=11.0.18+10
-pkg_source=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.18_10.tar.gz
-pkg_shasum=4a29efda1d702b8ff38e554cf932051f40ec70006caed5c4857a8cbc7a0b7db7
-pkg_filename=OpenJDK11U-jdk_x64_linux_hotspot_11.0.18_10.tar.gz
+pkg_version=11.0.20+8
+pkg_source=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20%2B8/OpenJDK11U-jdk_x64_linux_hotspot_11.0.20_8.tar.gz
+pkg_shasum=7a99258af2e3ee9047e90f1c0c1775fd6285085759501295358d934d662e01f9
+pkg_filename=OpenJDK11U-jdk_x64_linux_hotspot_11.0.20_8.tar.gz
 pkg_dirname="jdk-${pkg_version}"
 pkg_license=("GPL-2.0-with-classpath-exception")
 pkg_description=('Eclipse Temurin is the open source Java SE build based upon OpenJDK.')
diff --git a/components/docs-chef-io/content/automate/ha_aws_deployment_prerequisites.md b/components/docs-chef-io/content/automate/ha_aws_deployment_prerequisites.md
index ca317237f..680f0def8 100644
--- a/components/docs-chef-io/content/automate/ha_aws_deployment_prerequisites.md
+++ b/components/docs-chef-io/content/automate/ha_aws_deployment_prerequisites.md
@@ -122,8 +122,8 @@ The first column in the table below represents the source of the connection. The
 
 |                 | Chef Automate        | Chef Infra Server    | PostgreSQL                                | OpenSearch                           | Bastion | Automate Load Balancer |
 | --------------- | -------------------- | -------------------- | ----------------------------------------- | ------------------------------------ | ------- | ------------- |
-| Chef Automate   |                      |                      | 7432                                      | 9200                                 |         |               |
-| Infra Server    |                      |                      | 7432                                      | 9200                                 |         | 443              |
+| Chef Automate   |                      |                      | 7432, 9631                                       | 9200, 9631                                  |         |               |
+| Infra Server    |                      |                      | 7432, 9631                                       | 9200, 9631                                  |         | 443              |
 | PostgreSQL      |                      |                      | 9631, 7432, 5432, 6432, 9638<br/>UDP 9638 |                                      |         |               |
 | OpenSearch      |                      |                      |                                           | 9631, 9200, 9300, 9638 <br/>UDP 9638 |         |               |
 | Bastion         | 22, 9631, 9638, 7799 | 22, 9631, 9638, 7799 | 22, 9631, 9638, 7432, 7799                | 22, 9631, 9638, 9200, 7799           |         | 22            |
@@ -146,6 +146,7 @@ The first column in the table below represents the source of the connection. The
 | TCP      | 7432        | HAProxy, which redirects to PostgreSQL Leader             |
 | TCP      | 6432        | Re-elect PostgreSQL Leader if PostgreSQL leader is down   |
 | TCP      | 5432        | Allows PostgreSQL nodes to connect with each other        |
+| TCP/UDP  | 7799        | Allows bastion to connect with automate-verify service    |
 
 ## Certificates
 
@@ -188,8 +189,8 @@ The AWS deployment specific pre-requisites are as follows:
 
 ### Storage Space for Bastion
 
--   Operating System Root Volume (`/`) must be at least 40GB. Temporary space (`/var/tmp`) must be at least 5GB.
--   Separate Hab volume should be provisioned and mounted at `/hab` with at least 100GB free space.
+-   Operating System Root Volume (`/`) must be at least 40GB. Temporary space (`/var/tmp`) must be at least 10GB.
+-   Separate Hab volume should be provisioned and mounted at `/hab` with at least 200GB space.
 
 ### SSH User
 
diff --git a/components/docs-chef-io/content/automate/ha_on_premises_deployment_prerequisites.md b/components/docs-chef-io/content/automate/ha_on_premises_deployment_prerequisites.md
index c8c94c0dd..0de87870c 100644
--- a/components/docs-chef-io/content/automate/ha_on_premises_deployment_prerequisites.md
+++ b/components/docs-chef-io/content/automate/ha_on_premises_deployment_prerequisites.md
@@ -114,8 +114,8 @@ The first column in the table below represents the source of the connection. The
 
 |               | Chef Automate  | Chef Infra Server | PostgreSQL                          | OpenSearch                           | Bastion | Automate Load Balancer |
 |---------------|----------------|-------------------|-------------------------------------|--------------------------------------|---------| ------------- |
-| Chef Automate |                |                   | 7432                                | 9200                                 |         |               |
-| Infra Server  |                |                   | 7432                                | 9200                                 |         | 443              |
+| Chef Automate |                |                   | 7432, 9631                                | 9200, 9631                                  |         |               |
+| Infra Server  |                |                   | 7432, 9631                                 | 9200, 9631                                  |         | 443              |
 | PostgreSQL    |                |                   | 9631, 7432, 5432, 6432, 9638<br/>UDP 9638 |                                      |         |               |
 | OpenSearch    |                |                   |                                     | 9631, 9200, 9300, 9638 <br/>UDP 9638 |         |               |
 | Bastion       | 22, 9631, 9638, 7799 | 22, 9631, 9638, 7799    | 22, 9631, 9638, 7432, 7799                | 22, 9631, 9638, 9200, 7799                 |         | 22            |
@@ -137,6 +137,7 @@ The first column in the table below represents the source of the connection. The
 | TCP      | 7432        | HAProxy, which redirects to PostgreSQL Leader            |
 | TCP      | 6432        | Re-elect PostgreSQL Leader if PostgreSQL leader is down  |
 | TCP      | 5432        | Allows PostgreSQL nodes to connect with each other       |
+| TCP/UDP  | 7799        | Allows bastion to connect with automate-verify service   |
 
 ## Certificates
 
@@ -167,8 +168,8 @@ The on-premises deployment specific pre-requisites are as follows:
 
 ### Storage Space
 
-- Operating System Root Volume (`/`) must be at least 40GB. Temporary space (`/var/tmp`) must be at least 5GB.
-- Separate Hab volume should be provisioned and mounted at `/hab` with at least 100GB free space for all nodes except OpenSearch.
+- Operating System Root Volume (`/`) must be at least 40GB. Temporary space (`/var/tmp`) must be at least 10GB.
+- Separate Hab volume should be provisioned and mounted at `/hab` with at least 200GB for all nodes except OpenSearch.
 - For OpenSearch nodes, /hab volume should be calculated based on the data retention policy, and use the [Performance Benchmarks](/automate/ha_performance_benchmarks) for estimation.
 
 ### SSH User
diff --git a/lib/config/genconfig/awshaprovisionconfig.go b/lib/config/genconfig/awshaprovisionconfig.go
index 4728f1f1d..6049a7101 100644
--- a/lib/config/genconfig/awshaprovisionconfig.go
+++ b/lib/config/genconfig/awshaprovisionconfig.go
@@ -1,54 +1,75 @@
 package genconfig
 
 import (
+	"encoding/json"
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/chef/automate/lib/config"
+	"github.com/chef/automate/lib/httputils"
 	"github.com/chef/automate/lib/io/fileutils"
+	"github.com/chef/automate/lib/logger"
 	"github.com/chef/automate/lib/pmt"
 	"github.com/chef/automate/lib/toml"
 )
 
 const (
-	AWS_MACHINE_TYPE_REGEX        = "^((a1|c1|c3|c4|c5|c5a|c5ad|c5d|c5n|c6a|c6g|c6gd|c6gn|c6i|c6id|c7g|cc2|d2|d3|d3en|dl1|f1|g2|g3|g3s|g4ad|g4dn|g5|g5g|h1|i2|i3|i3en|i4i|im4gn|inf1|is4gen|m1|m2|m3|m4|m5|m5a|m5ad|m5d|m5dn|m5n|m5zn|m6a|m6g|m6gd|m6i|m6id|mac1|mac2|p2|p3|p3dn|p4d|r3|r4|r5|r5a|r5ad|r5b|r5d|r5dn|r5n|r6a|r6g|r6gd|r6i|r6id|t1|t2|t3|t3a|t4g|trn1|u-12tb1|u-3tb1|u-6tb1|u-9tb1|vt1|x1|x1e|x2gd|x2idn|x2iedn|x2iezn|z1d)\\.(10xlarge|112xlarge|12xlarge|16xlarge|18xlarge|24xlarge|2xlarge|32xlarge|3xlarge|48xlarge|4xlarge|56xlarge|6xlarge|8xlarge|9xlarge|large|medium|metal|micro|nano|small|xlarge))$"
-	AWS_VOL_TYPE_REGEX            = "^(gp2|gp3|io2|io1|st1|sc1)$"
-	IP_REGEX                      = "^((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$"
-	URL_OPTIONAL_PORT_REGEX       = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9](:{1}[0-9]{1,5})?$"
-	FQDN_REGEX                    = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]$"
-	URL_REQUIRED_PORT_REGEX       = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]:{1}[0-9]{1,5}$"
-	LINUX_USER_REGEX              = "^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30})$"
-	DIR_PATH_REGEX                = "^\\/$|(\\/[a-zA-Z_0-9-]+)+$"
-	BUCKET_NAME_REGEX             = "^[a-zA-Z0-9_-]+$"
-	AWS_ACCESS_KEY_ID_REGEX       = "^[A-Z0-9]{20}$"
-	AWS_ACCESS_KEY_SECRET_REGEX   = "^[A-Za-z0-9/+=]{40}$"
-	ACCESS_KEY_ID_REGEX           = "^[A-Za-z0-9/+=]+$"
-	ACCESS_KEY_SECRET_REGEX       = "^[A-Za-z0-9/+=]+$"
-	ENDPOINT_URL                  = "^((http|https)://)[-a-zA-Z0-9@:%._\\+~#?&//=]{2,256}\\.[a-z]{2,6}\\b([-a-zA-Z0-9@:%._\\+~#?&//=]*)$"
-	AUTOMATE_ADMIN_PASSWORD_REGEX = "^.{8,35}$"
-	OPENSEARCH_NODETYPE           = "OpenSearch"
-	POSTGRESQL_NODETYPE           = "Postgresql"
-	AUTOMATE_NODETYPE             = "Automate"
-	CHEF_INFRA_SERVER_NODETYPE    = "Chef Infra Server"
-	PUB_CERT                      = "Public Cert"
-	PRI_KEY                       = "Private Key"
-	ADMIN_CERT                    = "Admin Cert"
-	ADMIN_KEY                     = "Admin Key"
-	ROOTCA                        = "Root CA"
+	AWS_MACHINE_TYPE_REGEX             = "^((a1|c1|c3|c4|c5|c5a|c5ad|c5d|c5n|c6a|c6g|c6gd|c6gn|c6i|c6id|c7g|cc2|d2|d3|d3en|dl1|f1|g2|g3|g3s|g4ad|g4dn|g5|g5g|h1|i2|i3|i3en|i4i|im4gn|inf1|is4gen|m1|m2|m3|m4|m5|m5a|m5ad|m5d|m5dn|m5n|m5zn|m6a|m6g|m6gd|m6i|m6id|mac1|mac2|p2|p3|p3dn|p4d|r3|r4|r5|r5a|r5ad|r5b|r5d|r5dn|r5n|r6a|r6g|r6gd|r6i|r6id|t1|t2|t3|t3a|t4g|trn1|u-12tb1|u-3tb1|u-6tb1|u-9tb1|vt1|x1|x1e|x2gd|x2idn|x2iedn|x2iezn|z1d)\\.(10xlarge|112xlarge|12xlarge|16xlarge|18xlarge|24xlarge|2xlarge|32xlarge|3xlarge|48xlarge|4xlarge|56xlarge|6xlarge|8xlarge|9xlarge|large|medium|metal|micro|nano|small|xlarge))$"
+	AWS_MACHINE_TYPE_REGEX_DEFAULT     = "m5.large"
+	AWS_VOL_TYPE_REGEX                 = "^(gp2|gp3|io2|io1|st1|sc1)$"
+	IP_REGEX                           = "^((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$"
+	URL_OPTIONAL_PORT_REGEX            = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9](:{1}[0-9]{1,5})?$"
+	FQDN_REGEX                         = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]$"
+	URL_REQUIRED_PORT_REGEX            = "^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]:{1}[0-9]{1,5}$"
+	LINUX_USER_REGEX                   = "^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30})$"
+	DIR_PATH_REGEX                     = "^\\/$|(\\/[a-zA-Z_0-9-]+)+$"
+	BUCKET_NAME_REGEX                  = "^[a-zA-Z0-9_-]+$"
+	AWS_ACCESS_KEY_ID_REGEX            = "^[A-Z0-9]{20}$"
+	AWS_ACCESS_KEY_SECRET_REGEX        = "^[A-Za-z0-9/+=]{40}$"
+	ACCESS_KEY_ID_REGEX                = "^[A-Za-z0-9/+=]+$"
+	ACCESS_KEY_SECRET_REGEX            = "^[A-Za-z0-9/+=]+$"
+	ENDPOINT_URL                       = "^((http|https)://)[-a-zA-Z0-9@:%._\\+~#?&//=]{2,256}\\.[a-z]{2,6}\\b([-a-zA-Z0-9@:%._\\+~#?&//=]*)$"
+	ENDPOINT_URL_SAMPLE                = "http://bucket-endpoint.com or https://bucket-endpoint.com"
+	AUTOMATE_ADMIN_PASSWORD_REGEX      = "^.{8,35}$"
+	AWS_MACHINE_TYPE_REGEX_SAMPLE      = "m5.large, m5.xlarge"
+	IP_REGEX_SAMPLE                    = "172.31.0.0"
+	URL_OPTIONAL_PORT_REGEX_SAMPLE     = "myopensearch.com or 10.0.82.0:9200"
+	FQDN_REGEX_SAMPLE                  = "mydomain.chef.io"
+	URL_REQUIRED_PORT_REGEX_SAMPLE     = "myrds.chef.io:5432"
+	LINUX_USER_REGEX_SAMPLE            = "ubuntu or ec2-user"
+	BUCKET_NAME_REGEX_SAMPLE           = "automate-backup"
+	AWS_ACCESS_KEY_ID_REGEX_SAMPLE     = "A2PBA*************SQ"
+	AWS_ACCESS_KEY_SECRET_REGEX_SAMPLE = "aPBA*********************************EE"
+	OPENSEARCH_NODETYPE                = "OpenSearch"
+	POSTGRESQL_NODETYPE                = "Postgresql"
+	AUTOMATE_NODETYPE                  = "Automate"
+	CHEF_INFRA_SERVER_NODETYPE         = "Chef Infra Server"
+	PUB_CERT                           = "Public Cert"
+	PRI_KEY                            = "Private Key"
+	ADMIN_CERT                         = "Admin Cert"
+	ADMIN_KEY                          = "Admin Key"
+	ROOTCA                             = "Root CA"
+	TOKEN_URLS                         = "http://169.254.169.254/latest/api/token"
+	METADATA_URLS                      = "http://169.254.169.254/latest/meta-data/iam/info"
 )
 
 type AwsHaProvisionConfig struct {
-	Prompt         pmt.Prompt `toml:"-"`
-	Config         *config.HaDeployConfig
-	HasCustomCerts bool                `toml:"-"`
-	FileUtils      fileutils.FileUtils `toml:"-"`
+	Prompt               pmt.Prompt `toml:"-"`
+	Config               *config.HaDeployConfig
+	HasCustomCerts       bool                `toml:"-"`
+	FileUtils            fileutils.FileUtils `toml:"-"`
+	CreateOSSnapShotCred bool
+	httpRequestClient    httputils.HTTPClient
 }
 
 func AwsHaProvisionConfigFactory(p pmt.Prompt) *AwsHaProvisionConfig {
+	log := logger.NewLogrusStandardLogger()
 	return &AwsHaProvisionConfig{
-		Prompt:    p,
-		Config:    &config.HaDeployConfig{},
-		FileUtils: fileutils.NewFileSystemUtils(),
+		Prompt:            p,
+		Config:            &config.HaDeployConfig{},
+		FileUtils:         fileutils.NewFileSystemUtils(),
+		httpRequestClient: httputils.NewClient(log),
 	}
 }
 
@@ -160,11 +181,18 @@ func (c *AwsHaProvisionConfig) PromptCidr() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptProfile() (err error) {
-	profile, err := c.Prompt.InputStringDefault("AWS Profile", "default")
+	useIAMRole, err := c.useIAMRole()
 	if err != nil {
 		return
 	}
-	c.Config.InitAws().InitConfigAwsSettings().Profile = profile
+
+	if !useIAMRole {
+		profile, err := c.Prompt.InputStringDefault("AWS Profile", "default")
+		if err != nil {
+			return err
+		}
+		c.Config.InitAws().InitConfigAwsSettings().Profile = profile
+	}
 	return
 }
 
@@ -188,7 +216,7 @@ func (c *AwsHaProvisionConfig) PromptVpcId() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) HasCidrBlockAddr() (isCiderBlock bool, err error) {
-	isCiderBlock, err = c.Prompt.Confirm("Do you want to use AWS CIDR Block", "yes", "no")
+	isCiderBlock, err = c.Prompt.Confirm("Create new subnets during provision (Requires CIDR block)", "yes", "no")
 	if err != nil {
 		return
 	}
@@ -201,8 +229,50 @@ func (c *AwsHaProvisionConfig) HasCidrBlockAddr() (isCiderBlock bool, err error)
 	return
 }
 
+func (c *AwsHaProvisionConfig) useIAMRole() (isIAMUserAvailable bool, err error) {
+
+	_, tokenResponseBody, err := c.httpRequestClient.MakeRequestWithHeaders(http.MethodPut, TOKEN_URLS, nil, "X-aws-ec2-metadata-token-ttl-seconds", "21600")
+	if err != nil {
+		return
+	}
+
+	token := string(tokenResponseBody)
+
+	resp, dataByte, err := c.httpRequestClient.MakeRequestWithHeaders(http.MethodGet, METADATA_URLS, nil, "X-aws-ec2-metadata-token", token)
+	if err != nil {
+		return
+	}
+
+	if resp.StatusCode != 200 {
+		isIAMUserAvailable = false
+		return
+	}
+
+	iamRole := getIAMRoleName(dataByte)
+	isIAMUserAvailable, err = c.Prompt.Confirm("Found an IAM role ("+iamRole+") attached to this machine. Do you want to continue with IAM role", "yes", "no")
+	return
+}
+
+func getIAMRoleName(respByte []byte) (IAMRoleName string) {
+
+	var result map[string]interface{}
+	err := json.Unmarshal(respByte, &result)
+	if err != nil {
+		fmt.Println("Error:", err)
+		return
+	}
+
+	instanceProfileArn, ok := result["InstanceProfileArn"].(string)
+	if !ok {
+		fmt.Println("InstanceProfileArn not found or not a string")
+		return
+	}
+	IAMRoleName = strings.Split(instanceProfileArn, "/")[1]
+	return
+}
+
 func (c *AwsHaProvisionConfig) PromptCidrBlockAddr() (err error) {
-	ciderBlockAddr, err := c.Prompt.InputStringRegex("AWS CIDR Block Address", IP_REGEX)
+	ciderBlockAddr, err := c.Prompt.InputStringRegex("AWS CIDR Block Address [Eg: 10.0.16.0]", IP_REGEX)
 	if err != nil {
 		return
 	}
@@ -211,19 +281,19 @@ func (c *AwsHaProvisionConfig) PromptCidrBlockAddr() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptPrivateSubnet() (err error) {
-	privateSubnet1, err := c.Prompt.InputStringRequired("AWS Private Subnet 1")
+	privateSubnet1, err := c.Prompt.InputStringRequired("AWS Private Subnet 1 [Eg: subnet-e556d512]")
 	if err != nil {
 		return
 	}
 	c.Config.InitAws().InitConfigAwsSettings().PrivateCustomSubnets = []string{privateSubnet1}
 
-	privateSubnet2, err := c.Prompt.InputStringRequired("AWS Private Subnet 2")
+	privateSubnet2, err := c.Prompt.InputStringRequired("AWS Private Subnet 2 [Eg: subnet-e556d514]")
 	if err != nil {
 		return
 	}
 	c.Config.InitAws().InitConfigAwsSettings().PrivateCustomSubnets = append(c.Config.InitAws().InitConfigAwsSettings().PrivateCustomSubnets, privateSubnet2)
 
-	privateSubnet3, err := c.Prompt.InputStringRequired("AWS Private Subnet 3")
+	privateSubnet3, err := c.Prompt.InputStringRequired("AWS Private Subnet 3 [Eg: subnet-e556d513]")
 	if err != nil {
 		return
 	}
@@ -233,24 +303,24 @@ func (c *AwsHaProvisionConfig) PromptPrivateSubnet() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptPublicSubnet() (err error) {
-	hasPublicSubnets, err := c.Prompt.Confirm("Do you have Public Subnets", "yes", "no")
+	hasPublicSubnets, err := c.Prompt.Confirm("Create Public Subnets", "yes", "no")
 	if err != nil {
 		return
 	}
 	if hasPublicSubnets {
-		publicSubnet1, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 1:")
+		publicSubnet1, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 1 [Eg: subnet-e556d514]")
 		if err1 != nil {
 			return err1
 		}
 		c.Config.InitAws().InitConfigAwsSettings().PublicCustomSubnets = []string{publicSubnet1}
 
-		publicSubnet2, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 2:")
+		publicSubnet2, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 2 [Eg: subnet-e556d515]")
 		if err1 != nil {
 			return err1
 		}
 		c.Config.InitAws().InitConfigAwsSettings().PublicCustomSubnets = append(c.Config.InitAws().InitConfigAwsSettings().PublicCustomSubnets, publicSubnet2)
 
-		publicSubnet3, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 3:")
+		publicSubnet3, err1 := c.Prompt.InputStringRequired("AWS Public Subnet 3 [Eg: subnet-e556d515]")
 		if err1 != nil {
 			return err1
 		}
@@ -260,7 +330,7 @@ func (c *AwsHaProvisionConfig) PromptPublicSubnet() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptSshKeyPairName() (err error) {
-	sshKeyPairName, err := c.Prompt.InputStringRequired("AWS SSH Key Pair Name")
+	sshKeyPairName, err := c.Prompt.InputStringRequired("AWS SSH Key Pair Name [Eg: chef-ssh-key]")
 	if err != nil {
 		return
 	}
@@ -278,7 +348,7 @@ func (c *AwsHaProvisionConfig) PromptAmi() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptDeleteOnTermination() (err error) {
-	noDelOnTerm, err := c.Prompt.Confirm("Delete on termination should be", "off", "on")
+	noDelOnTerm, err := c.Prompt.Confirm("Delete root volume on termination", "off", "on")
 	if err != nil {
 		return
 	}
@@ -309,7 +379,7 @@ func (c *AwsHaProvisionConfig) PromptDatabases() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptIsAwsManaged() (isAwsManagedDb bool, err error) {
-	isAwsManagedDb, err = c.Prompt.Confirm("Do you want to use AWS Managed Databases", "yes", "no")
+	isAwsManagedDb, err = c.Prompt.Confirm("Use AWS Managed Databases", "yes", "no")
 	if err != nil {
 		return
 	}
@@ -365,7 +435,7 @@ func (c *AwsHaProvisionConfig) PromptAwsManagedPostgresql() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptPgUrl() (err error) {
-	pgUrl, err := c.Prompt.InputStringRegex("AWS Managed RDS PostgreSQL URL:<port>", URL_REQUIRED_PORT_REGEX)
+	pgUrl, err := c.Prompt.InputStringRegex("AWS Managed RDS PostgreSQL [Eg: pgdomain.com:5432]", URL_REQUIRED_PORT_REGEX)
 	if err != nil {
 		return
 	}
@@ -410,7 +480,7 @@ func (c *AwsHaProvisionConfig) PromptPgDbUserPassword() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptPgCert() (err error) {
-	awsDefaultCert, err := c.Prompt.Confirm("Do you want to use Default AWS Cert to connect with AWS Managed RDS PosgreSQL URL", "yes", "no")
+	awsDefaultCert, err := c.Prompt.Confirm("Use Default AWS Cert to connect with AWS Managed RDS PosgreSQL URL", "yes", "no")
 	if err != nil {
 		return
 	}
@@ -457,6 +527,11 @@ func (c *AwsHaProvisionConfig) PromptAwsManagedOpenSearch() (err error) {
 		return
 	}
 
+	err = c.CreateOSSnapShotCredentials()
+	if err != nil {
+		return
+	}
+
 	err = c.PromptOsSnapshotRoleArn()
 	if err != nil {
 		return
@@ -476,7 +551,7 @@ func (c *AwsHaProvisionConfig) PromptAwsManagedOpenSearch() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptOsDomainName() (err error) {
-	osDomainName, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Domain Name")
+	osDomainName, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Domain Name [Eg: chef-opensearch]")
 	if err != nil {
 		return
 	}
@@ -485,7 +560,7 @@ func (c *AwsHaProvisionConfig) PromptOsDomainName() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptOsDomainUrl() (err error) {
-	osDomainUrl, err := c.Prompt.InputStringRegex("AWS Managed OpenSearch Domain URL", URL_OPTIONAL_PORT_REGEX)
+	osDomainUrl, err := c.Prompt.InputStringRegex("AWS Managed OpenSearch Domain URL [Eg: chef-opensearch.myosdomain.com]", URL_OPTIONAL_PORT_REGEX)
 	if err != nil {
 		return
 	}
@@ -494,7 +569,7 @@ func (c *AwsHaProvisionConfig) PromptOsDomainUrl() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptOsUserName() (err error) {
-	user, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch User Name")
+	user, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch User Name [Eg: admin]")
 	if err != nil {
 		return
 	}
@@ -512,7 +587,7 @@ func (c *AwsHaProvisionConfig) PromptOsUserPassword() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptOsCert() (err error) {
-	awsDefaultCert, err := c.Prompt.Confirm("Do you want to use Default AWS Cert to connect with AWS Managed OpenSearch Domain URL", "yes", "no")
+	awsDefaultCert, err := c.Prompt.Confirm("Use Default AWS Cert to connect with AWS Managed OpenSearch Domain URL", "yes", "no")
 	if err != nil {
 		return
 	}
@@ -533,30 +608,51 @@ func (c *AwsHaProvisionConfig) PromptOsCert() (err error) {
 	return
 }
 
-func (c *AwsHaProvisionConfig) PromptOsSnapshotRoleArn() (err error) {
-	arn, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot Role ARN")
+func (c *AwsHaProvisionConfig) CreateOSSnapShotCredentials() (err error) {
+	CreateOSSnapShotCred, err := c.Prompt.Confirm("Create new snapshot role ARN and user credential", "yes", "no")
 	if err != nil {
 		return
 	}
-	c.Config.InitAws().InitConfigAwsSettings().AwsOsSnapshotRoleArn = arn
+	c.CreateOSSnapShotCred = CreateOSSnapShotCred
+	return
+}
+
+func (c *AwsHaProvisionConfig) PromptOsSnapshotRoleArn() (err error) {
+	if c.CreateOSSnapShotCred {
+		c.Config.InitAws().InitConfigAwsSettings().AwsOsSnapshotRoleArn = ""
+	} else {
+		arn, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot Role ARN")
+		if err != nil {
+			return err
+		}
+		c.Config.InitAws().InitConfigAwsSettings().AwsOsSnapshotRoleArn = arn
+	}
 	return
 }
 
 func (c *AwsHaProvisionConfig) PromptOsSnapshotUserAccessKeyId() (err error) {
-	keyId, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot User Access Key ID")
-	if err != nil {
-		return
+	if c.CreateOSSnapShotCred {
+		c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeyID = ""
+	} else {
+		keyId, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot User Access Key ID")
+		if err != nil {
+			return err
+		}
+		c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeyID = keyId
 	}
-	c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeyID = keyId
 	return
 }
 
 func (c *AwsHaProvisionConfig) PromptOsSnapshotUserAccessKeySecret() (err error) {
-	secret, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot User Access Key Secret")
-	if err != nil {
-		return
+	if c.CreateOSSnapShotCred {
+		c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeySecret = ""
+	} else {
+		secret, err := c.Prompt.InputStringRequired("AWS Managed OpenSearch Snapshot User Access Key Secret")
+		if err != nil {
+			return err
+		}
+		c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeySecret = secret
 	}
-	c.Config.InitAws().InitConfigAwsSettings().OsSnapshotUserAccessKeySecret = secret
 	return
 }
 
@@ -729,7 +825,7 @@ func (c *AwsHaProvisionConfig) DefaultAutomateConfigValues() {
 }
 
 func (c *AwsHaProvisionConfig) PromptAutomateFqdn() (err error) {
-	automateFqdn, err := c.Prompt.InputStringRegex("Automate FQDN", FQDN_REGEX)
+	automateFqdn, err := c.Prompt.InputStringRegex("Automate FQDN [Eg: my-automate-domain.com]", FQDN_REGEX)
 	if err != nil {
 		return
 	}
@@ -739,7 +835,7 @@ func (c *AwsHaProvisionConfig) PromptAutomateFqdn() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptAutomateFqdnRootCa() (err error) {
-	automateFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Automate FQDN Root CA File Path")
+	automateFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Automate FQDN Root CA File Path [Eg: /home/ubuntu/fqdn1-root-ca.pem]")
 	if err != nil {
 		return
 	}
@@ -759,7 +855,7 @@ func (c *AwsHaProvisionConfig) PromptAutomateFqdnRootCa() (err error) {
 
 func (c *AwsHaProvisionConfig) PromptHaveCustomCerts(nodeType string) (customCerts bool, err error) {
 	if c.HasCustomCerts {
-		customCerts, err = c.Prompt.Confirm("Do you have custom certs for "+nodeType+" Nodes", "yes", "no")
+		customCerts, err = c.Prompt.Confirm("Use custom certs for "+nodeType+" Nodes", "yes", "no")
 		if err != nil {
 			return
 		}
@@ -828,7 +924,7 @@ func (c *AwsHaProvisionConfig) PromptAutomateAdminPassword() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptAutomateInstanceType() (err error) {
-	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for Automate", AWS_MACHINE_TYPE_REGEX, "m5.large")
+	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for Automate [min. reg.: m5.large]", AWS_MACHINE_TYPE_REGEX, "m5.large")
 	if err != nil {
 		return
 	}
@@ -837,7 +933,7 @@ func (c *AwsHaProvisionConfig) PromptAutomateInstanceType() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptChefInfraServerFqdn() (err error) {
-	chefInfraServerFqdn, err := c.Prompt.InputStringRegex("Chef Infra Server FQDN", FQDN_REGEX)
+	chefInfraServerFqdn, err := c.Prompt.InputStringRegex("Chef Infra Server FQDN [Eg: my-infraserver-domain.com]", FQDN_REGEX)
 	if err != nil {
 		return
 	}
@@ -847,7 +943,7 @@ func (c *AwsHaProvisionConfig) PromptChefInfraServerFqdn() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptChefInfraServerFqdnRootCa() (err error) {
-	chefInfraServerFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Chef Infra Server FQDN Root CA File Path")
+	chefInfraServerFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Chef Infra Server FQDN Root CA File Path [Eg: /home/ubuntu/fqdn2-root-ca.pem]")
 	if err != nil {
 		return
 	}
@@ -899,7 +995,7 @@ func (c *AwsHaProvisionConfig) PromptChefInfraServerNodes() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptChefInfraServerInstanceType() (err error) {
-	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for Chef Infra Server", AWS_MACHINE_TYPE_REGEX, "m5.large")
+	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for Chef Infra Server [min. reg.: m5.large]", AWS_MACHINE_TYPE_REGEX, AWS_MACHINE_TYPE_REGEX_DEFAULT)
 	if err != nil {
 		return
 	}
@@ -908,7 +1004,7 @@ func (c *AwsHaProvisionConfig) PromptChefInfraServerInstanceType() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptPostgresqlInstanceType() (err error) {
-	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for PostgreSQL", AWS_MACHINE_TYPE_REGEX, "m5.large")
+	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for PostgreSQL [min. reg.: m5.large]", AWS_MACHINE_TYPE_REGEX, AWS_MACHINE_TYPE_REGEX_DEFAULT)
 	if err != nil {
 		return
 	}
@@ -917,7 +1013,7 @@ func (c *AwsHaProvisionConfig) PromptPostgresqlInstanceType() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptOpenSearchInstanceType() (err error) {
-	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for OpenSearch", AWS_MACHINE_TYPE_REGEX, "m5.large")
+	instanceType, err := c.Prompt.InputStringRegexDefault("AWS Instance type for OpenSearch [min. reg.: m5.large]", AWS_MACHINE_TYPE_REGEX, AWS_MACHINE_TYPE_REGEX_DEFAULT)
 	if err != nil {
 		return
 	}
@@ -1118,7 +1214,7 @@ func (c *AwsHaProvisionConfig) PromptOpenSearchVolType() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptAutomateLoadBalancerCertArn() (err error) {
-	certArn, err := c.Prompt.InputStringRequired("AWS Load Balancer Cert ARN for Automate")
+	certArn, err := c.Prompt.InputStringRequired("AWS Load Balancer Cert ARN for Automate [Eg: arn:aws:acm:eu-west-1:*******:certificate/6b***]")
 	if err != nil {
 		return
 	}
@@ -1127,7 +1223,7 @@ func (c *AwsHaProvisionConfig) PromptAutomateLoadBalancerCertArn() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptChefInfrServerLoadBalancerCertArn() (err error) {
-	certArn, err := c.Prompt.InputStringRequired("AWS Load Balancer Cert ARN for Chef Infra Server")
+	certArn, err := c.Prompt.InputStringRequired("AWS Load Balancer Cert ARN for Chef Infra Server [Eg: arn:aws:acm:eu-west-1:*******:certificate/6b***]")
 	if err != nil {
 		return
 	}
@@ -1232,7 +1328,7 @@ func (c *AwsHaProvisionConfig) PromptSshKey() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptCustomCerts() (err error) {
-	noCustomCerts, err := c.Prompt.Confirm("Will you use custom certs for any service like Automate, Chef Infra Server, PostgreSQL, OpenSearch", "no", "yes")
+	noCustomCerts, err := c.Prompt.Confirm("Use custom certs for one or all service like Automate, Chef Infra Server, PostgreSQL, OpenSearch", "no", "yes")
 	if err != nil {
 		return
 	}
@@ -1245,13 +1341,13 @@ func (c *AwsHaProvisionConfig) PromptCustomCerts() (err error) {
 }
 
 func (c *AwsHaProvisionConfig) PromptBackup() (err error) {
-	isBackupNeeded, err := c.Prompt.Confirm("Backup need to be configured during deployment", "yes", "no")
+	isBackupNeeded, err := c.Prompt.Confirm("Configure backup during deployment", "yes", "no")
 	if isBackupNeeded {
 		c.Config.InitArchitecture().InitAws().BackupMount = "/mnt/automate_backups"
 		backupConfig := "s3"
 
 		if !c.Config.InitAws().InitConfigAwsSettings().SetupManagedServices {
-			_, backupOption, err1 := c.Prompt.Select("Which backup option will you use", "AWS S3", "EFS")
+			_, backupOption, err1 := c.Prompt.Select("Backup type", "AWS S3", "EFS")
 			if err1 != nil {
 				return err1
 			}
@@ -1286,4 +1382,4 @@ func (c *AwsHaProvisionConfig) SetDefaultValuesForDBNodes() {
 	c.Config.InitPostgresql().InitConfig()
 	c.Config.Postgresql.Config.InstanceCount = "0"
 	c.Config.Postgresql.Config.EnableCustomCerts = false
-}
\ No newline at end of file
+}
diff --git a/lib/config/genconfig/hadeployconfig.go b/lib/config/genconfig/hadeployconfig.go
index 5bdcb7fab..7742b4587 100644
--- a/lib/config/genconfig/hadeployconfig.go
+++ b/lib/config/genconfig/hadeployconfig.go
@@ -94,7 +94,7 @@ func (c *HaDeployConfigGen) Prompts() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptCustomCerts() (err error) {
-	noCustomCerts, err := c.Prompt.Confirm("Will you use custom certs for any service like Automate, Chef Infra Server, PostgreSQL, OpenSearch", "no", "yes")
+	noCustomCerts, err := c.Prompt.Confirm("Use custom certs for one or all service like Automate, Chef Infra Server, PostgreSQL, OpenSearch", "no", "yes")
 	if err != nil {
 		return
 	}
@@ -117,7 +117,7 @@ func (c *HaDeployConfigGen) SetDefaultValuesForDBNodes() {
 }
 
 func (c *HaDeployConfigGen) PromptExternalDb() (hasExternalDb bool, err error) {
-	hasExternalDb, err = c.Prompt.Confirm("Are you going to use External Databases, like AWS RDS and AWS OpenSearch", "yes", "no")
+	hasExternalDb, err = c.Prompt.Confirm("Use External Databases for PostgresQL and OpenSearch", "yes", "no")
 	if err != nil {
 		return
 	}
@@ -143,7 +143,7 @@ func (c *HaDeployConfigGen) PromptExternalDb() (hasExternalDb bool, err error) {
 }
 
 func (c *HaDeployConfigGen) PromptExternalDbType() (err error) {
-	isAWSManaged, err := c.Prompt.Confirm("Type of External DB you will use", "AWS Managed", "Self Managed")
+	isAWSManaged, err := c.Prompt.Confirm("Type of External DB", "AWS Managed", "Self Managed")
 	if err != nil {
 		return
 	}
@@ -256,7 +256,7 @@ func (c *HaDeployConfigGen) GetExternalOsType() (dbType string) {
 }
 
 func (c *HaDeployConfigGen) PromptExternalPostgresqlInstanceUrl() (err error) {
-	pgUrl, err := c.Prompt.InputStringRegex(c.GetExternalPgType()+" URL:<port>", URL_REQUIRED_PORT_REGEX)
+	pgUrl, err := c.Prompt.InputStringRegex(c.GetExternalPgType()+" [Eg: pgdomain.com:5432]", URL_REQUIRED_PORT_REGEX)
 	if err != nil {
 		return
 	}
@@ -308,7 +308,7 @@ func (c *HaDeployConfigGen) PromptExternalPostgresqlDbUserPassword() (err error)
 func (c *HaDeployConfigGen) PromptExternalPostgresqlRootCert() (err error) {
 	if c.Config.External.Database.Type == "aws" {
 		awsDefaultCert := false
-		awsDefaultCert, err = c.Prompt.Confirm("Do you want to use Default AWS Cert to connect with AWS Managed RDS PostgreSQL URL", "yes", "no")
+		awsDefaultCert, err = c.Prompt.Confirm("Use Default AWS Cert to connect with AWS Managed RDS PostgreSQL URL", "yes", "no")
 		if err != nil {
 			return
 		}
@@ -336,7 +336,7 @@ func (c *HaDeployConfigGen) PromptExternalPostgresqlRootCert() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptExternalOpenSearchDomainName() (err error) {
-	domainName, err := c.Prompt.InputStringRequired(c.GetExternalOsType() + " Domain Name")
+	domainName, err := c.Prompt.InputStringRequired(c.GetExternalOsType() + " Domain Name [Eg: chef-opensearch]")
 	if err != nil {
 		return
 	}
@@ -346,7 +346,7 @@ func (c *HaDeployConfigGen) PromptExternalOpenSearchDomainName() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptExternalOpenSearchDomainUrl() (err error) {
-	domainUrl, err := c.Prompt.InputStringRegex(c.GetExternalOsType()+" Domain URL", URL_OPTIONAL_PORT_REGEX)
+	domainUrl, err := c.Prompt.InputStringRegex(c.GetExternalOsType()+" Domain URL [Eg: chef-opensearch.myosdomain.com]", URL_OPTIONAL_PORT_REGEX)
 	if err != nil {
 		return
 	}
@@ -356,7 +356,7 @@ func (c *HaDeployConfigGen) PromptExternalOpenSearchDomainUrl() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptExternalOpenSearchUser() (err error) {
-	user, err := c.Prompt.InputStringRequired(c.GetExternalOsType() + " Username")
+	user, err := c.Prompt.InputStringRequired(c.GetExternalOsType() + " Username [Eg: admin]")
 	if err != nil {
 		return
 	}
@@ -378,7 +378,7 @@ func (c *HaDeployConfigGen) PromptExternalOpenSearchPassword() (err error) {
 func (c *HaDeployConfigGen) PromptExternalOpenSearchRootCert() (err error) {
 	if c.Config.External.Database.Type == "aws" {
 		awsDefaultCert := false
-		awsDefaultCert, err = c.Prompt.Confirm("Do you want to use Default AWS Cert to connect with AWS Managed OpenSearch Domain URL", "yes", "no")
+		awsDefaultCert, err = c.Prompt.Confirm("Use Default AWS Cert to connect with AWS Managed OpenSearch Domain URL", "yes", "no")
 		if err != nil {
 			return
 		}
@@ -778,13 +778,13 @@ func (c *HaDeployConfigGen) PromptNodeIp(msg string) (ip string, err error) {
 
 func (c *HaDeployConfigGen) PromptHaveCustomCerts(nodeType string) (customCerts, customCertsPerNode bool, err error) {
 	if c.HasCustomCerts {
-		customCerts, err = c.Prompt.Confirm("Do you have custom certs for "+nodeType+" Nodes", "yes", "no")
+		customCerts, err = c.Prompt.Confirm("Use custom certs for "+nodeType+" Nodes", "yes", "no")
 		if err != nil {
 			return
 		}
 
 		if customCerts {
-			commonCerts, err1 := c.Prompt.Confirm("Do each "+nodeType+" Node have same Certs", "yes", "no")
+			commonCerts, err1 := c.Prompt.Confirm("Use same Certs for all "+nodeType+" Node", "yes", "no")
 			if err1 != nil {
 				return commonCerts, customCertsPerNode, err1
 			}
@@ -892,7 +892,7 @@ func (c *HaDeployConfigGen) PromptAutomateCerts(hasCustomCerts, hasCustomCertsPe
 }
 
 func (c *HaDeployConfigGen) PromptChefInfraServerFqdn() (err error) {
-	chefInfraServerFqdn, err := c.Prompt.InputStringRegex("Chef Infra Server FQDN", FQDN_REGEX)
+	chefInfraServerFqdn, err := c.Prompt.InputStringRegex("Chef Infra Server FQDN [Eg: my-infraserver-domain.com]", FQDN_REGEX)
 	if err != nil {
 		return
 	}
@@ -902,7 +902,7 @@ func (c *HaDeployConfigGen) PromptChefInfraServerFqdn() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptChefInfraServerFqdnRootCa() (err error) {
-	chefInfraServerFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Chef Infra Server FQDN Root CA File Path")
+	chefInfraServerFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Chef Infra Server FQDN Root CA File Path [Eg: /home/ubuntu/fqdn2-root-ca.pem]")
 	if err != nil {
 		return
 	}
@@ -921,7 +921,7 @@ func (c *HaDeployConfigGen) PromptChefInfraServerFqdnRootCa() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptAutomateFqdn() (err error) {
-	automateFqdn, err := c.Prompt.InputStringRegex("Automate FQDN", FQDN_REGEX)
+	automateFqdn, err := c.Prompt.InputStringRegex("Automate FQDN [Eg: my-automate-domain.com]", FQDN_REGEX)
 	if err != nil {
 		return
 	}
@@ -931,7 +931,7 @@ func (c *HaDeployConfigGen) PromptAutomateFqdn() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptAutomateFqdnRootCa() (err error) {
-	automateFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Automate FQDN Root CA File Path")
+	automateFqdnRootCaFilePath, err := c.Prompt.InputExistingFilePath("Automate FQDN Root CA File Path [Eg: /home/ubuntu/fqdn2-root-ca.pem]")
 	if err != nil {
 		return
 	}
@@ -980,7 +980,7 @@ func (c *HaDeployConfigGen) PromptSshPort() (err error) {
 }
 
 func (c *HaDeployConfigGen) PromptSshKey() (err error) {
-	sshKeyFile, err := c.Prompt.InputExistingFilePathDefault("SSH Key File", "~/.ssh/id_rsa")
+	sshKeyFile, err := c.Prompt.InputExistingFilePath("SSH Key File Path [*.pem downloaded for SSH Key Pair from AWS]")
 	if err != nil {
 		return
 	}
@@ -1021,11 +1021,11 @@ func (c *HaDeployConfigGen) DefaultExistingInfraValues() {
 }
 
 func (c *HaDeployConfigGen) PromptBackup() (err error) {
-	isBackupNeeded, err := c.Prompt.Confirm("Backup need to be configured during deployment", "yes", "no")
+	isBackupNeeded, err := c.Prompt.Confirm("Configured backup during deployment", "yes", "no")
 	if isBackupNeeded {
 		c.Config.InitArchitecture().InitExistingInfra().BackupMount = "/mnt/automate_backups"
 
-		_, backupOption, err1 := c.Prompt.Select("Which backup option will you use", AWS_S3, MINIO, OBJECT_STORE, FILE_SYSTEM, NFS, EFS)
+		_, backupOption, err1 := c.Prompt.Select("Choose backup option", AWS_S3, MINIO, OBJECT_STORE, FILE_SYSTEM, NFS, EFS)
 		if err1 != nil {
 			return err1
 		}
@@ -1056,7 +1056,7 @@ func (c *HaDeployConfigGen) PromptBackup() (err error) {
 
 func (c *HaDeployConfigGen) PromptObjectStorageSettings(backupOption string) (err error) {
 
-	bucketName, err := c.Prompt.InputStringRegex("Backup bucket name", BUCKET_NAME_REGEX)
+	bucketName, err := c.Prompt.InputStringRegex("Bucket name", BUCKET_NAME_REGEX)
 	if err != nil {
 		return
 	}
diff --git a/lib/config/hadeployconfig.go b/lib/config/hadeployconfig.go
index b9b4f83df..21afc8d3d 100644
--- a/lib/config/hadeployconfig.go
+++ b/lib/config/hadeployconfig.go
@@ -149,9 +149,9 @@ type ConfigAwsSettings struct {
 	ManagedOpensearchUsername     string   `toml:"managed_opensearch_username,omitempty"`
 	ManagedOpensearchUserPassword string   `toml:"managed_opensearch_user_password,omitempty"`
 	ManagedOpensearchCertificate  string   `toml:"managed_opensearch_certificate,omitempty"`
-	AwsOsSnapshotRoleArn          string   `toml:"aws_os_snapshot_role_arn,omitempty"`
-	OsSnapshotUserAccessKeyID     string   `toml:"os_snapshot_user_access_key_id,omitempty"`
-	OsSnapshotUserAccessKeySecret string   `toml:"os_snapshot_user_access_key_secret,omitempty"`
+	AwsOsSnapshotRoleArn          string   `toml:"aws_os_snapshot_role_arn"`
+	OsSnapshotUserAccessKeyID     string   `toml:"os_snapshot_user_access_key_id"`
+	OsSnapshotUserAccessKeySecret string   `toml:"os_snapshot_user_access_key_secret"`
 	ManagedRdsInstanceURL         string   `toml:"managed_rds_instance_url,omitempty"`
 	ManagedRdsSuperuserUsername   string   `toml:"managed_rds_superuser_username,omitempty"`
 	ManagedRdsSuperuserPassword   string   `toml:"managed_rds_superuser_password,omitempty"`
diff --git a/lib/pmt/prompt.go b/lib/pmt/prompt.go
index f3a6c374a..1c5183832 100644
--- a/lib/pmt/prompt.go
+++ b/lib/pmt/prompt.go
@@ -15,10 +15,11 @@ import (
 )
 
 const (
-	FAIL_MSG         = "prompt failed %v"
-	INVALID_INT      = "invalid int"
-	PARSE_INT_FAIL   = "parse int failed %v"
-	REGEX_CHECK_FAIL = "regex check failed (%v) "
+	FAIL_MSG                            = "prompt failed %v"
+	INVALID_INT                         = "invalid int"
+	PARSE_INT_FAIL                      = "parse int failed %v"
+	REGEX_CHECK_FAIL                    = "input value failed to matched with expected pattern (%v)"
+	REGEX_CHECK_FAIL_WITH_SAMPLE_STRING = "regex check failed. Sample Value: %v"
 )
 const esc = "\033["
 const moveDown = esc + "1B"


Test patch:
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger_test.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger_test.go
index b58dc3e0e..efbcc4ff9 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger_test.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/firewallchecktrigger/firewallchecktrigger_test.go
@@ -47,7 +47,7 @@ const (
 			{
 			  "title": "Check for reachability of service at destination port from the source node",
 			  "passed": true,
-			  "success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable fro <source_node_ip>",
+			  "success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
 			  "error_msg": "",
 			  "resolution_msg": ""
 			}
@@ -86,7 +86,7 @@ const (
 				{
 					"title": "Check for reachability of service at destination port from the source node",
 					"passed": true,
-					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable fro <source_node_ip>",
+					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
 					"error_msg": "",
 					"resolution_msg": "",
 				  	"skipped": false
@@ -94,7 +94,23 @@ const (
 				{
 					"title": "Check for reachability of service at destination port from the source node",
 					"passed": true,
-					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable fro <source_node_ip>",
+					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
+					"error_msg": "",
+					"resolution_msg": "",
+				  	"skipped": false
+				},
+				{
+					"title": "Check for reachability of service at destination port from the source node",
+					"passed": true,
+					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
+					"error_msg": "",
+					"resolution_msg": "",
+				  	"skipped": false
+				},
+				{
+					"title": "Check for reachability of service at destination port from the source node",
+					"passed": true,
+					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
 					"error_msg": "",
 					"resolution_msg": "",
 				  	"skipped": false
@@ -117,6 +133,22 @@ const (
 				"msg": "",
 				"check": "",
 				"checks": [
+					{
+						"title": "Check for reachability of service at destination port",
+						"passed": false,
+						"success_msg": "",
+						"error_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is not reachable from <source_ip>",
+						"resolution_msg": "Check your firewall settings and provide access to port <destination_node_port> on <destination_node_ip> from <source_node_ip>",
+						"skipped": false
+					},
+					{
+						"title": "Check for reachability of service at destination port",
+						"passed": false,
+						"success_msg": "",
+						"error_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is not reachable from <source_ip>",
+						"resolution_msg": "Check your firewall settings and provide access to port <destination_node_port> on <destination_node_ip> from <source_node_ip>",
+						"skipped": false
+					},
 					{
 						"title": "Check for reachability of service at destination port",
 						"passed": false,
@@ -149,7 +181,7 @@ const (
 				{
 					"title": "Check for reachability of service at destination port from the source node",
 					"passed": true,
-					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable fro <source_node_ip>",
+					"success_msg": "The <protocol> service running at <destination_node_ip>:<destination_node_port> is reachable from <source_node_ip>",
 					"error_msg": "",
 		
 	 
@@ -197,11 +229,11 @@ func TestMakeRequests(t *testing.T) {
 	makeRequests(config, mapRequests)
 	requestsForautomate, ok := mapRequests[constants.AUTOMATE]
 	assert.True(t, ok)
-	assert.Equal(t, len(requestsForautomate), 8)
+	assert.Equal(t, 16, len(requestsForautomate))
 
 	requestsForchefServer, ok := mapRequests[constants.CHEF_INFRA_SERVER]
 	assert.True(t, ok)
-	assert.Equal(t, 4, len(requestsForchefServer))
+	assert.Equal(t, 8, len(requestsForchefServer))
 
 	//As there are two postgress nodes which needs to interact with eachother
 	requestsForPostgres, ok := mapRequests[constants.POSTGRESQL]
@@ -348,7 +380,8 @@ func TestFirewallCheck_Run(t *testing.T) {
 			httpStatusCode:       http.StatusOK,
 			isError:              true,
 			invalidParseResponse: true,
-		}, {
+		},
+		{
 			name: "Status Bad Request",
 			args: args{
 				config: &models.Config{
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger_test.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger_test.go
index be31cca5a..cdd9738fd 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger_test.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/sshuseraccesschecktrigger/sshuseraccesschecktrigger_test.go
@@ -439,7 +439,7 @@ func TestGetSShUserAPIRquest(t *testing.T) {
 		assert.Equal(t, err.Error(), actualerr.Error())
 	})
 
-	t.Run("Permission is greater the 400", func(t *testing.T) {
+	t.Run("Permission is greater than 600", func(t *testing.T) {
 		fwc := NewSshUserAccessCheck(logger.NewLogrusStandardLogger(), &fileutils.MockFileSystemUtils{
 			ReadFileFunc: func(filepath string) ([]byte, error) {
 				return []byte("test_key"), nil
@@ -449,7 +449,7 @@ func TestGetSShUserAPIRquest(t *testing.T) {
 			},
 		}, "1234")
 		ip := "1.2.3.4"
-		expected, err := models.SShUserRequest{}, errors.New("Provide permission on the SSH key file as 400 (Read Only by Owner).")
+		expected, err := models.SShUserRequest{}, errors.New("Provide permission on the SSH key file as 400 (Read Only by Owner) or 600 (Read and Write by Owner).")
 		actual, actualerr := fwc.getSShUserAPIRequest(ip, GetRequestJson().SSHUser)
 		assert.Equal(t, expected, actual)
 		assert.Equal(t, err.Error(), actualerr.Error())
@@ -469,6 +469,21 @@ func TestGetSShUserAPIRquest(t *testing.T) {
 		assert.Equal(t, expected, actual)
 	})
 
+	t.Run("Reading was successfull with 600 permissions", func(t *testing.T) {
+		fwc := NewSshUserAccessCheck(logger.NewLogrusStandardLogger(), &fileutils.MockFileSystemUtils{
+			ReadFileFunc: func(filepath string) ([]byte, error) {
+				return []byte("test_key"), nil
+			},
+			GetFilePermissionFunc: func(filePath string) (int64, error) {
+				return 600, nil
+			},
+		}, "1234")
+		ip := "1.2.3.4"
+		expected := GetSshRequest()
+		actual, _ := fwc.getSShUserAPIRequest(ip, GetRequestJson().SSHUser)
+		assert.Equal(t, expected, actual)
+	})
+
 	t.Run("Reading was unsuccessfull", func(t *testing.T) {
 		fwc := NewSshUserAccessCheck(logger.NewLogrusStandardLogger(), &fileutils.MockFileSystemUtils{
 			ReadFileFunc: func(filepath string) ([]byte, error) {
diff --git a/components/automate-cli/pkg/verifyserver/services/sshusercheckservice/sshusercheckservice_test.go b/components/automate-cli/pkg/verifyserver/services/sshusercheckservice/sshusercheckservice_test.go
index 0162ab9db..3014fe818 100644
--- a/components/automate-cli/pkg/verifyserver/services/sshusercheckservice/sshusercheckservice_test.go
+++ b/components/automate-cli/pkg/verifyserver/services/sshusercheckservice/sshusercheckservice_test.go
@@ -201,7 +201,7 @@ func TestCheckSshConnection(t *testing.T) {
 					Passed:        false,
 					SuccessMsg:    "",
 					ErrorMsg:      "SSH user is unaccessible for the node with IP: " + nodeIp,
-					ResolutionMsg: "Give SSH access to the user with the give key on the node: " + nodeIp,
+					ResolutionMsg: "Give SSH access to the user with the given key on the node: " + nodeIp,
 				},
 				{
 					Title:         FailureSudoPassword,
diff --git a/lib/config/genconfig/awshaprovisionconfig_test.go b/lib/config/genconfig/awshaprovisionconfig_test.go
index 53d01bad2..a12562464 100644
--- a/lib/config/genconfig/awshaprovisionconfig_test.go
+++ b/lib/config/genconfig/awshaprovisionconfig_test.go
@@ -5,10 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"os"
 	"testing"
 
 	"github.com/chef/automate/lib/config"
+	"github.com/chef/automate/lib/httputils"
 	"github.com/chef/automate/lib/io/fileutils"
 	"github.com/chef/automate/lib/ioutils"
 	"github.com/chef/automate/lib/pmt"
@@ -47,6 +49,8 @@ func TestPromptsCidrAWSManaged(t *testing.T) {
 	enableCustomCerts := false
 	input(b, "\r")
 
+	input(b, moveDown+"\r")
+
 	awsProfile := "default"
 	input(b, "\r")
 
@@ -145,6 +149,9 @@ func TestPromptsCidrAWSManaged(t *testing.T) {
 	osDefaultCerts := true
 	input(b, "\r")
 
+	// To not skip role cred
+	input(b, moveDown+"\r")
+
 	osSnapshotRoleArn := "arn-os-snapshot-role"
 	input(b, osSnapshotRoleArn+"\r")
 
@@ -208,6 +215,21 @@ func TestPromptsCidrAWSManaged(t *testing.T) {
 		Prompt:    p,
 		FileUtils: mfsu,
 		Config:    &config.HaDeployConfig{},
+		httpRequestClient: &httputils.MockHTTPClient{
+			MakeRequestWithHeadersfunc: func(requestMethod, url string, body interface{}, headerkey, headerValue string) (*http.Response, []byte, error) {
+				if url == TOKEN_URLS {
+					return &http.Response{
+						StatusCode: 200,
+					}, []byte("dummytoken"), nil
+				}
+				return &http.Response{StatusCode: 200}, []byte(`{
+					"Code" : "Success",
+					"LastUpdated" : "2023-08-09T11:23:21Z",
+					"InstanceProfileArn" : "arn:aws:iam::1234:instance-profile/bastion-role-user",
+					"InstanceProfileId" : "AIPARHU"
+				}`), nil
+			},
+		},
 	}
 
 	err := c.Prompts()
@@ -1124,6 +1146,21 @@ func testPromptsCidrAWSManagedErrRun(t *testing.T, upto int) {
 		Prompt:    p,
 		FileUtils: mfsu,
 		Config:    &config.HaDeployConfig{},
+		httpRequestClient: &httputils.MockHTTPClient{
+			MakeRequestWithHeadersfunc: func(requestMethod, url string, body interface{}, headerkey, headerValue string) (*http.Response, []byte, error) {
+				if url == TOKEN_URLS {
+					return &http.Response{
+						StatusCode: 200,
+					}, []byte("dummytoken"), nil
+				}
+				return &http.Response{StatusCode: 200}, []byte(`{
+					"Code" : "Success",
+					"LastUpdated" : "2023-08-09T11:23:21Z",
+					"InstanceProfileArn" : "arn:aws:iam::1234:instance-profile/bastion-role-user",
+					"InstanceProfileId" : "AIPARHU"
+				}`), nil
+			},
+		},
 	}
 
 	err := c.Prompts()
@@ -1156,6 +1193,9 @@ func callInput(upto int, b *bytes.Buffer) {
 	if upto >= 5 {
 		input(b, "\r")
 	}
+	if upto >= 5 {
+		input(b, moveDown+"\r")
+	}
 	if upto >= 6 {
 		input(b, "\r")
 	}