diff --git a/.gitignore b/.gitignore
index 11e2513c..d2ecf968 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,5 +14,7 @@
 # Ignore Gradle build output directory
 build
 
-# Ignore the generated template.yml file
+# Ignore the generated template.yml files
 template.yml
+app-template.yml
+packaged-app-template.yml
diff --git a/.ruby-version b/.ruby-version
index 6a81b4c8..15a27998 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.7.8
+3.3.0
diff --git a/README.md b/README.md
index 963fa3b2..bedb8b06 100644
--- a/README.md
+++ b/README.md
@@ -19,19 +19,23 @@ The Javabuilder dev doc can be found at
 * [org-code-javabuilder](https://github.com/code-dot-org/javabuilder/tree/main/org-code-javabuilder)
   contains the Lambda function that builds and runs student code. It also contains the
   local developent version of Javabuilder.
+* [cicd/3-app](https://github.com/code-dot-org/javabuilder/tree/main/cicd/3-app)
+  contains the Ruby deployment script for development stacks, following Code.org patterns.
+* [dev-deployment](https://github.com/code-dot-org/javabuilder/tree/main/dev-deployment)
+  contains legacy deployment scripts (deprecated in favor of cicd/3-app approach).
 * [javabuilder](https://github.com/code-dot-org/javabuilder) (the current directory)
   contains the script and Cloud Formation template for deploying Javabuilder to
   production.
 
 ### Prerequisites
-Use `rbenv` to install Ruby 2.7.2 to build and/or run the Ruby lambda functions
+Use `rbenv` to install Ruby 3.3+ to build and/or run the Ruby lambda functions
 (`javabuilder-authorizer` and `api-gateway-routes`).
 [rbenv](https://github.com/rbenv/rbenv) is required for installing Ruby and managing
 multiple versions of Ruby on a single development environment. Follow the instructions
 [here](https://github.com/rbenv/rbenv#installing-ruby-versions) to use rbenv to install a
 new Ruby version. You may need to also install
 [ruby-build](https://github.com/rbenv/ruby-build#readme) to get the latest Ruby versions.
-The `.ruby-version` file sets the local Ruby version for javabuilder to be 2.7.2
+The `.ruby-version` file sets the local Ruby version for javabuilder to be 3.3.0
 
 ## Deploying Production Javabuilder
 
@@ -57,16 +61,56 @@ There are two main ways to develop and run Javabuilder:
 
 ### Deploying a Dev Instance
 
-1. Make and commit your desired changes.
-1. Push your local changes to your feature branch.
-1. Deploy a development instance of Javabuilder, following the instructions here:
-   [Deploying a Development environment](https://github.com/code-dot-org/javabuilder/tree/main/cicd#deploying-an-development-environment).
+To deploy a development instance of Javabuilder, use the Ruby deployment script in `cicd/3-app`:
 
-To connect your dev instance with Java Lab (Code Studio client) running on your local Dashboard server:   
+1. **Quick Deploy:**
+   ```bash
+   cd cicd/3-app
+   ./deploy-development-stack.rb
+   ```
+   This will:
+   - Build all components (javabuilder-authorizer, org-code-javabuilder, api-gateway-routes)
+   - Process ERB templates following production buildspec pattern
+   - Deploy with SSL certificates using existing wildcard certificate for dev-code.org
+   - Create or update the `javabuilder-dev` CloudFormation stack
+   - Preserve build artifacts in `tmp/` for debugging
+
+2. **Custom Stack Name:**
+   ```bash
+   ./deploy-development-stack.rb --stack_name my-test-stack
+   ```
+
+3. **View All Options:**
+   ```bash
+   ./deploy-development-stack.rb --help
+   ```
+
+4. **Clean Deployment:**
+   If you need to start fresh, manually delete the stack from AWS console or use:
+   ```bash
+   aws cloudformation delete-stack --stack-name javabuilder-dev --profile codeorg-dev
+   ```
+
+### Base Infrastructure Necessity
+
+The `app-template.yml` used for deploying the Javabuilder application does not contain all the necessary infrastructure. Specifically, it relies on IAM roles that need to be set up beforehand via a separate IAM stack. These roles are crucial for handling permissions related to various AWS services used by Javabuilder components.
+
+#### Key Missing Components in `app-template.yml`
+- IAM roles needed for Lambda functions and API Gateway
+- Policies required to allow access to S3 buckets, DynamoDB tables, and other resources
+
+### Why Base Infrastructure is Separate
+- **Modularity**: Separate IAM roles allow multiple deployments to share IAM permissions.
+- **Security**: IAM configurations often require higher privileges and careful management.
+- **Flexibility**: The application stack can be deployed or updated independently of IAM changes.
+
+For more detailed instructions and troubleshooting, refer to the [Development Deployment README](cicd/3-app/README.md).
+
+To connect your dev instance with Java Lab (Code Studio client) running on your local Dashboard server:
 
 1. In your code-dot-org workspace, add an entry to your `locals.yml` file with your dev instance stack name:
    ```
-   local_javabuilder_stack_name: 'javabuilder-dev-<your-branch-name>'
+   local_javabuilder_stack_name: 'javabuilder-dev'
    ```
 1. Launch dashboard using the instructions here:
    https://github.com/code-dot-org/code-dot-org/blob/staging/SETUP.md#overview
diff --git a/api-gateway-routes/.ruby-version b/api-gateway-routes/.ruby-version
new file mode 100644
index 00000000..15a27998
--- /dev/null
+++ b/api-gateway-routes/.ruby-version
@@ -0,0 +1 @@
+3.3.0
diff --git a/api-gateway-routes/Gemfile b/api-gateway-routes/Gemfile
index 57e1d667..5d540191 100644
--- a/api-gateway-routes/Gemfile
+++ b/api-gateway-routes/Gemfile
@@ -1,7 +1,7 @@
 # Gemfile
 source 'https://rubygems.org'
 
-ruby '~> 2.7'
+ruby '~> 3.3'
 
 gem 'aws-sdk-lambda', '1.39.0'
 gem 'aws-sdk-sqs', '1.38.0'
diff --git a/api-gateway-routes/Gemfile.lock b/api-gateway-routes/Gemfile.lock
index b4b89276..38462b5f 100644
--- a/api-gateway-routes/Gemfile.lock
+++ b/api-gateway-routes/Gemfile.lock
@@ -1,25 +1,30 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    aws-eventstream (1.1.1)
-    aws-partitions (1.443.0)
-    aws-sdk-core (3.113.1)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.239.0)
-      aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1134.0)
+    aws-sdk-core (3.227.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+      logger
     aws-sdk-lambda (1.39.0)
       aws-sdk-core (~> 3, >= 3.71.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-sqs (1.38.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.2.3)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    jmespath (1.4.0)
-    minitest (5.15.0)
+    base64 (0.3.0)
+    jmespath (1.6.2)
+    logger (1.7.0)
+    minitest (5.25.5)
 
 PLATFORMS
+  arm64-darwin-24
   ruby
 
 DEPENDENCIES
@@ -28,7 +33,7 @@ DEPENDENCIES
   minitest (~> 5.5)
 
 RUBY VERSION
-   ruby 2.7.4p191
+   ruby 3.3.0p0
 
 BUNDLED WITH
-   1.17.3
+   2.5.3
diff --git a/beta-template.yml.erb b/beta-template.yml.erb
deleted file mode 100644
index d519f46f..00000000
--- a/beta-template.yml.erb
+++ /dev/null
@@ -1,1129 +0,0 @@
-AWSTemplateFormatVersion: 2010-09-09
-Transform: AWS::Serverless-2016-10-31
-Description: Provision an instance of the Javabuilder service. Empty the ContentBucket before deleting this Stack.
-Parameters:
-  BaseDomainName:
-    Type: String
-    Description: Base domain name (e.g. 'code.org' in 'javabuilder.code.org').
-  BaseDomainNameHostedZonedID:
-    Type: String
-    Description: AWS Route53 Hosted Zone ID for base domain name.
-  SubdomainName:
-    Type: String
-    Description: Subdomain name for javabuilder service (e.g. 'javabuilder' in 'javabuilder.code.org').
-  # LogBucket:
-  #   Type: String
-  #   Default: cdo-logs.s3.amazonaws.com
-  ProvisionedConcurrentExecutions:
-    Type: Number
-    Description: The amount of provisioned concurrency to allocate for the BuildAndRunJavaProject Lambda.
-    MinValue: 1
-    Default: 1
-  ReservedConcurrentExecutions:
-    Type: Number
-    Description: The amount of concurrency to allow for the BuildAndRunJavaProject Lambda.
-    MinValue: 1
-    Default: 3
-  LimitPerHour:
-    Type: Number
-    Description: The number of Javabuilder invocations allowed per user per hour.
-    MinValue: 1
-    Default: 50
-  LimitPerDay:
-    Type: Number
-    Description: The number of Javabuilder invocations allowed per user per day.
-    MinValue: 1
-    Default: 150
-  TeacherLimitPerHour:
-    Type: Number
-    Description: The number of Javabuilder invocations allowed for all students in a classroom per hour.
-    MinValue: 1
-    Default: 1000
-  StageName:
-    Type: String
-    Description: The default stage name in the API Gateway APIs
-    Default: Prod
-  SilenceAlerts:
-    Type: String
-    AllowedValues: [true, false]
-    Description: If alerts should be silenced on this instance
-    Default: false
-<%
-JAVALAB_APP_TYPES = %w(
-  Theater
-  Neighborhood
-  Console
-)
--%>
-Globals:
-  Function:
-    Runtime: ruby2.7
-    Timeout: 30
-    MemorySize: 256
-    Tracing: Active
-Conditions:
-  IsDevCondition: !Equals [!Ref BaseDomainName, "dev-code.org"]
-  SilenceAlertsCondition: !Or [Condition: IsDevCondition, !Equals [!Ref SilenceAlerts, "true"]]
-Resources:
-# Note: We can't update the name of a DomainName resource once it has been created because the
-# domain name itself has already been provisioned. When we change from javabuilderbeta to
-# javabuilder, we should update the WebSocket resources here to use the prefix "WebSocket"
-<%{
-  Http: {Prefix: "Http", Suffix: "-http"},
-  WebSocket: {Prefix: "", Suffix: ""},
-}.each do |apiName, config| -%>
-  <%=config[:Prefix]%>Domain:
-    Type: AWS::Route53::RecordSet
-    Properties:
-      HostedZoneName: !Sub "${BaseDomainName}."
-      Name: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-      Type: A
-      AliasTarget:
-        DNSName: !GetAtt <%=config[:Prefix]%>DomainName.RegionalDomainName
-        HostedZoneId: !GetAtt <%=config[:Prefix]%>DomainName.RegionalHostedZoneId
-
-  <%=config[:Prefix]%>DomainName:
-    Type: AWS::ApiGatewayV2::DomainName
-    Properties:
-      DomainName: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-      DomainNameConfigurations:
-        - EndpointType: REGIONAL
-          CertificateArn: !Ref <%=config[:Prefix]%>Certificate
-          CertificateName: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-
-  <%=config[:Prefix]%>Certificate:
-    Type: AWS::CertificateManager::Certificate
-    Properties:
-      DomainName: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-      ValidationMethod: DNS
-      DomainValidationOptions:
-        - DomainName: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-          HostedZoneId: !Ref BaseDomainNameHostedZonedID
-
-  <%=config[:Prefix]%>DomainNameAPIMapping:
-    Type: AWS::ApiGatewayV2::ApiMapping
-    DependsOn:
-      - <%=config[:Prefix]%>Domain
-    Properties:
-      ApiId: !Ref <%=apiName%>API
-      DomainName: !Sub "${SubdomainName}<%=config[:Suffix]%>.${BaseDomainName}"
-      Stage: !Ref <%=apiName%>Stage
-
-<%end -%>
-  HttpAPI:
-    Type: AWS::ApiGatewayV2::Api
-    Properties:
-      Name: !Sub "${SubdomainName}-http.${BaseDomainName}"
-      ProtocolType: HTTP
-
-  PutRoute:
-    Type: AWS::ApiGatewayV2::Route
-    Properties:
-      ApiId: !Ref HttpAPI
-      RouteKey: PUT /seedsources/sources.json
-      AuthorizationType: CUSTOM
-      AuthorizerId: !Ref HttpAuthorizer
-      OperationName: PutRoute
-      Target: !Join
-        - '/'
-        - - 'integrations'
-          - !Ref PutIntegration
-
-  PutSourcesFunction:
-    Type: AWS::Serverless::Function
-    Properties:
-      Description: Puts user sources into the S3 bucket
-      CodeUri: api-gateway-routes/
-      Handler: api_gateway_put_function.lambda_handler
-      Role: !ImportValue JavabuilderPutSourcesLambdaRole
-      Environment:
-        Variables:
-          CONTENT_BUCKET_NAME: !Ref ContentBucket
-
-  PutSourcesPermission:
-    Type: AWS::Lambda::Permission
-    DependsOn:
-      - HttpAPI
-    Properties:
-      Action: lambda:InvokeFunction
-      FunctionName: !Ref PutSourcesFunction
-      Principal: apigateway.amazonaws.com
-
-  PutIntegration:
-    Type: AWS::ApiGatewayV2::Integration
-    Properties:
-      ApiId: !Ref HttpAPI
-      Description: PUT Integration
-      # Integration method must be POST for AWS_PROXY integrations even though we're PUTting into an S3 bucket
-      IntegrationMethod: POST
-      IntegrationType: AWS_PROXY
-      IntegrationUri:
-        Fn::Sub:
-          arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${PutSourcesFunction.Arn}/invocations
-      PayloadFormatVersion: 2.0
-
-  HttpStageLogs:
-    Type: AWS::Logs::LogGroup
-    Properties:
-      LogGroupName: !Sub "/aws/apigateway/accesslog/${SubdomainName}-http.${BaseDomainName}"
-
-  HttpStage:
-    Type: AWS::ApiGatewayV2::Stage
-    Properties:
-      # Using AutoDeploy rather than a Deployment resource (as we do with the WebSocket API) because
-      # the Deployment resource doesn't seem to work with HTTP APIs.
-      AutoDeploy: true
-      StageName: !Sub "${StageName}"
-      Description: The stage to deploy
-      ApiId: !Ref HttpAPI
-      DefaultRouteSettings:
-        DetailedMetricsEnabled: true
-      AccessLogSettings:
-        DestinationArn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/accesslog/${SubdomainName}-http.${BaseDomainName}"
-        # TODO: Also log authorizer status code, authorizer error message, Javabuilder session id, and Origin.
-        Format: '{
-            "host": "$context.domainName",
-            "requestId": "$context.requestId",
-            "ip": "$context.identity.sourceIp",
-            "requestTime": "$context.requestTime",
-            "httpMethod": "$context.httpMethod",
-            "caller": "$context.identity.caller",
-            "routeKey": "$context.routeKey",
-            "status": "$context.status",
-            "protocol": "$context.protocol",
-            "userAgent": "$context.identity.userAgent",
-            "responseLength":"$context.responseLength",
-            "contextErrorMessage": "$context.error.message",
-            "contextErrorMessageString": "$context.error.messageString",
-            "integrationError": "$context.integration.error",
-            "authorizerError": "$context.authorizer.error"
-          }'
-
-  HttpAuthorizer:
-    Type: AWS::ApiGatewayV2::Authorizer
-    Properties:
-      ApiId: !Ref HttpAPI
-      AuthorizerCredentialsArn:
-        Fn::ImportValue: JavabuilderAPIGatewayRole
-      AuthorizerPayloadFormatVersion: 2.0
-      AuthorizerResultTtlInSeconds: 0
-      AuthorizerType: REQUEST
-      AuthorizerUri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HttpAuthorizerLambda.Arn}/invocations"
-      IdentitySource:
-        - "$request.querystring.Authorization"
-      Name: HttpAuthorizer
-
-  WebSocketAPI:
-    Type: AWS::ApiGatewayV2::Api
-    Properties:
-      Name: !Sub "${SubdomainName}.${BaseDomainName}"
-      ProtocolType: WEBSOCKET
-      RouteSelectionExpression: "$request.body.action"
-
-  ConnectRoute:
-    Type: AWS::ApiGatewayV2::Route
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      RouteKey: $connect
-      AuthorizationType: CUSTOM
-      AuthorizerId: !Ref WebSocketAuthorizer
-      OperationName: ConnectRoute
-      Target: !Join
-        - '/'
-        - - 'integrations'
-          - !Ref ConnectInteg
-
-  WebSocketAuthorizer:
-    Type: AWS::ApiGatewayV2::Authorizer
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      AuthorizerType: REQUEST
-      AuthorizerUri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${WebsocketAuthorizerLambda.Arn}/invocations"
-      IdentitySource:
-        - route.request.querystring.Authorization
-      Name: WebSocketAuthorizer
-
-  ConnectInteg:
-    Type: AWS::ApiGatewayV2::Integration
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      Description: Connect Integration
-      IntegrationType: AWS_PROXY
-      IntegrationUri:
-        Fn::Sub:
-          arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${StartSessionAndRelayMessagesFunction.Arn}/invocations
-
-  DefaultRoute:
-    Type: AWS::ApiGatewayV2::Route
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      RouteKey: $default
-      AuthorizationType: NONE
-      OperationName: DefaultRoute
-      Target:
-        Fn::Join:
-          - /
-          - - integrations
-            - Ref: DefaultIntegration
-
-  DefaultIntegration:
-    Type: AWS::ApiGatewayV2::Integration
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      Description: Lambda Proxy Integration
-      IntegrationType: AWS_PROXY
-      IntegrationUri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${StartSessionAndRelayMessagesFunction.Arn}/invocations"
-
-  DisconnectRoute:
-    Type: AWS::ApiGatewayV2::Route
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      RouteKey: $disconnect
-      AuthorizationType: NONE
-      OperationName: DisconnectRoute
-      Target: !Join
-        - '/'
-        - - 'integrations'
-          - !Ref DisconnectInteg
-
-  DisconnectInteg:
-    Type: AWS::ApiGatewayV2::Integration
-    Properties:
-      ApiId: !Ref WebSocketAPI
-      Description: Disconnect Integration
-      IntegrationType: AWS_PROXY
-      IntegrationUri:
-        Fn::Sub:
-          arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${StartSessionAndRelayMessagesFunction.Arn}/invocations
-
-  WebSocketDeployment:
-    Type: AWS::ApiGatewayV2::Deployment
-    DependsOn:
-      - ConnectRoute
-      - DefaultRoute
-      - DisconnectRoute
-    Properties:
-      ApiId: !Ref WebSocketAPI
-
-  WebSocketStage:
-    Type: AWS::ApiGatewayV2::Stage
-    Properties:
-      StageName: !Sub "${StageName}"
-      Description: The stage to deploy
-      DeploymentId: !Ref WebSocketDeployment
-      ApiId: !Ref WebSocketAPI
-      DefaultRouteSettings:
-        DetailedMetricsEnabled: true
-        LoggingLevel: INFO
-        DataTraceEnabled: true
-      AccessLogSettings:
-        DestinationArn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/accesslog/${SubdomainName}.${BaseDomainName}"
-        # TODO: Also log authorizer status code, authorizer error message, Javabuilder session id, and Origin.
-        Format: '{
-            "host": "$context.domainName",
-            "requestId": "$context.requestId",
-            "ip": "$context.identity.sourceIp",
-            "requestTime": "$context.requestTime",
-            "method": "$context.httpMethod",
-            "caller": "$context.identity.caller",
-            "eventType": "$context.eventType",
-            "routeKey": "$context.routeKey",
-            "status": "$context.status",
-            "connectionId": "$context.connectionId",
-            "protocol": "$context.protocol",
-            "userAgent": "$context.identity.userAgent",
-            "contextErrorMessage": "$context.error.message",
-            "contextErrorMessageString": "$context.error.messageString",
-            "integrationError": "$context.integration.error",
-            "authorizerError": "$context.authorizer.error"
-          }'
-
-  StartSessionAndRelayMessagesFunction:
-    Type: AWS::Serverless::Function
-    Properties:
-      Description: Starts the long-running Lambda that compiles and runs a JavaLab project and relays messages to it from the JavaLab client.
-      CodeUri: api-gateway-routes/
-      Handler: api_gateway_proxy_function.lambda_handler
-      Role: !ImportValue JavabuilderSessionManagerMessageRelayLambdaRole
-      Environment:
-        Variables:
-          # The Logical ID of the BuildAndRun Lambda Alias, which is generated by SAM because AutoPublishAlias is enabled
-          # has a predictable format: <function‑LogicalId>Alias<alias‑name>
-          # https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-generated-resources-function.html#sam-specification-generated-resources-function-autopublishalias
-<%JAVALAB_APP_TYPES.each do | name | -%>
-          BUILD_AND_RUN_<%=name.upcase%>_PROJECT_LAMBDA_ARN: !Ref BuildAndRunJava<%=name%>ProjectFunctionAliaslive
-<%end -%>
-
-  StartSessionAndRelayMessagesPermission:
-    Type: AWS::Lambda::Permission
-    DependsOn:
-      - WebSocketAPI
-    Properties:
-      Action: lambda:InvokeFunction
-      FunctionName: !Ref StartSessionAndRelayMessagesFunction
-      Principal: apigateway.amazonaws.com
-
-# AWS does not seem to be case sensitive, but is case aware. Therefore, we can't update from
-# Websocket here to WebSocket as is used elsewhere when updating an existing stack. Updating this is
-# a step we should take when we create our non-beta environment from scratch. At that point, we
-# should also update uses of HttpAPI and WebSocketAPI to be HttpApi and WebSocketApi, respectively,
-# to match the AWS standard elsewhere in this template. Example: "AWS::ApiGatewayV2::ApiMapping"
-#
-# Note: hourly and daily limit values provided to both authorizers here as environment variables,
-# but are only needed in the HTTP authorizer.
-# Both authorizers need to access the token_status DynamoDB table, but only the HTTP authorizer
-# needs to access to the other tables.
-<%{
-  Http: {
-    LambdaName: "Http",
-    Handler: "http_authorizer_function",
-    Description: "'Authorize PUT by decoding JWT in Authorization querystring parameter.'"
-  },
-  WebSocket: {
-    LambdaName: "Websocket",
-    Handler: "websocket_authorizer_function",
-    Description: "'Authorize WebSocket connect by decoding JWT in Authorization querystring parameter.'"
-  },
-}.each do |name, config| -%>
-  <%=config[:LambdaName]%>AuthorizerLambda:
-    Type: AWS::Serverless::Function
-    Properties:
-      Handler: <%=config[:Handler]%>.lambda_handler
-      CodeUri: javabuilder-authorizer/
-      Description: <%=config[:Description]%>
-      Timeout: 3
-      Role: !ImportValue JavabuilderAuthorizerLambdaRole
-      Environment:
-        Variables:
-          limit_per_hour: !Ref LimitPerHour
-          limit_per_day: !Ref LimitPerDay
-          teacher_limit_per_hour: !Ref TeacherLimitPerHour
-          blocked_users_table: !Ref BlockedUsersTable
-          token_status_table: !Ref TokenStatusTable
-          user_requests_table: !Ref UserRequestsTable
-          teacher_associated_requests_table: !Ref TeacherAssociatedRequestsTable
-
-  <%=name%>AuthorizerPermission:
-    Type: AWS::Lambda::Permission
-    DependsOn:
-      - <%=name%>Authorizer
-    Properties:
-      Action: lambda:InvokeFunction
-      FunctionName: !Ref <%=config[:LambdaName]%>AuthorizerLambda
-      Principal: apigateway.amazonaws.com
-      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${<%=name%>API}/authorizers/${<%=name%>Authorizer}"
-
-<%end -%>
-  ChangeJavaRuntimeDirectoryLayer:
-    Type: AWS::Serverless::LayerVersion
-    Properties:
-      CompatibleRuntimes:
-        - java11
-      ContentUri: org-code-javabuilder/change_runtime_directory
-      Description: Change Java runtime to launch from the writeable /tmp directory to enable student projects to write files more easily.
-      LayerName: change-java-runtime-directory
-
-  FontConfigurationLayer:
-    Type: AWS::Serverless::LayerVersion
-    Properties:
-      CompatibleRuntimes:
-        - java11
-      ContentUri: org-code-javabuilder/font_config.zip
-      Description: Add a font configuration file to enable use of fonts.
-      LayerName: font-configuration
-
-<%{
-  Theater: {MemorySize: 1769, Timeout: 90},
-  Neighborhood: {MemorySize: 512, Timeout: 90},
-  Console: {MemorySize: 512, Timeout: 90}
-}.each do |name, config| -%>
-  BuildAndRunJava<%=name%>ProjectFunction:
-    Type: AWS::Serverless::Function
-    Properties:
-      Layers:
-        - !Ref FontConfigurationLayer
-        - !Ref ChangeJavaRuntimeDirectoryLayer
-      Handler: org.code.javabuilder.LambdaRequestHandler::handleRequest
-      Runtime: java11
-      CodeUri: org-code-javabuilder/lib/build/distributions/lib.zip
-      AutoPublishAlias: live
-      ReservedConcurrentExecutions: !Ref ReservedConcurrentExecutions
-      ProvisionedConcurrencyConfig:
-        ProvisionedConcurrentExecutions: !Ref ProvisionedConcurrentExecutions
-      Description: Compile and execute a JavaLab <%=name%> project.
-      MemorySize: <%=config[:MemorySize]%>
-      Timeout: <%=config[:Timeout]%>
-      EventInvokeConfig:
-        MaximumRetryAttempts: 0
-      Role:
-        Fn::ImportValue: JavabuilderBuildAndRunLambdaRole
-      Environment:
-        Variables:
-          AWS_LAMBDA_EXEC_WRAPPER: /opt/change_runtime_directory
-          CONTENT_BUCKET_NAME: !Ref ContentBucket
-          CONTENT_BUCKET_URL: !Sub "https://${ContentDomain}"
-          API_ENDPOINT: !Sub
-            - "https://${ApiId}.execute-api.${AWS::Region}.amazonaws.com/${StageName}"
-            - ApiId: !Ref WebSocketAPI
-<%end -%>
-
-  ContentBucket:
-    Type: AWS::S3::Bucket
-    Properties:
-      BucketName: !If [IsDevCondition, !Sub "cdo-dev-${SubdomainName}-content", !Sub "cdo-${SubdomainName}-content"]
-      CorsConfiguration:
-        CorsRules:
-          - AllowedMethods: [GET, PUT]
-            AllowedOrigins: ['*']
-            AllowedHeaders: ['*']
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: 'AES256'
-      LifecycleConfiguration:
-        Rules:
-          - Id: ExpirationRule
-            Status: Enabled
-            ExpirationInDays: 1
-
-  ContentBucketPolicy:
-    Type: AWS::S3::BucketPolicy
-    Properties:
-      Bucket: !Ref ContentBucket
-      PolicyDocument:
-        Statement:
-        - Action: ['s3:GetObject']
-          Effect: Allow
-          Resource: !Sub "arn:aws:s3:::${ContentBucket}/*"
-          Principal: '*'
-
-  ContentAPICertificate:
-    Type: AWS::CertificateManager::Certificate
-    Properties:
-      DomainName: !Sub "${SubdomainName}-content.${BaseDomainName}"
-      ValidationMethod: DNS
-      DomainValidationOptions:
-        - DomainName: !Sub "${SubdomainName}-content.${BaseDomainName}"
-          HostedZoneId: !Ref BaseDomainNameHostedZonedID
-
-  ContentDomain:
-    Type: AWS::Route53::RecordSet
-    Properties:
-      HostedZoneName: !Sub "${BaseDomainName}."
-      Name: !Sub "${SubdomainName}-content.${BaseDomainName}"
-      Type: A
-      AliasTarget:
-        DNSName: !GetAtt ContentCDN.DomainName
-        HostedZoneId: Z2FDTNDATAQYW2 # static ID for cloudfront aliases
-
-  ContentCDN:
-    Type: AWS::CloudFront::Distribution
-    Properties:
-      DistributionConfig:
-        Enabled: true
-        Aliases: [!Sub "${SubdomainName}-content.${BaseDomainName}"]
-        ViewerCertificate:
-          AcmCertificateArn: !Ref ContentAPICertificate
-          MinimumProtocolVersion: TLSv1
-          SslSupportMethod: sni-only
-        CustomErrorResponses:
-          - ErrorCode: 403
-            ErrorCachingMinTTL: 0
-        # TODO: enable logging when LogBucket is set up
-        # Logging:
-        #   Bucket: !Ref LogBucket
-        #   IncludeCookies: false
-        #   Prefix: !Sub "${SubdomainName}-content.${BaseDomainName}"
-        Origins:
-          - Id: ContentBucket
-            DomainName: !GetAtt ContentBucket.DomainName
-            S3OriginConfig: {}
-        DefaultCacheBehavior:
-          TargetOriginId: ContentBucket
-          AllowedMethods: [DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT]
-          Compress: true
-          DefaultTTL: 0
-          ForwardedValues: {QueryString: true}
-          ViewerProtocolPolicy: redirect-to-https
-
-  HighConcurrentExecutionsAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_high_concurrent_executions"
-      AlarmDescription: !Sub |
-          This will page the DOTD if javabuilder usage exceeds 50 concurrent
-          executions for 10 minutes. Occasional spikes are expected, but
-          long-running high usage is an indication of an attack. Go to the
-          following URLs and set reserved concurrency to 10 immediately
-<%JAVALAB_APP_TYPES.each do | name | -%>
-          https://console.aws.amazon.com/lambda/home?region=${AWS::Region}#/functions/${BuildAndRunJava<%=name%>ProjectFunction}/edit/concurrency?tab=configure
-<%end -%>
-          Then post in #ap-csa-dev.
-      ActionsEnabled: true
-      AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:CDO-Urgent"]
-      EvaluationPeriods: 10
-      DatapointsToAlarm: 10
-      Threshold: 50
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Metrics:
-        - Id: e1
-          Label: Concurrent Executions Across All Lambdas
-          ReturnData: true
-          Expression: SUM(METRICS())
-<%{Theater: "m2", Neighborhood: "m3", Console: "m4"}.each do |name, id| -%>
-        - Id: <%=id%>
-          ReturnData: false
-          MetricStat:
-              Metric:
-                  Namespace: AWS/Lambda
-                  MetricName: ConcurrentExecutions
-                  Dimensions:
-                      - Name: FunctionName
-                        Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-              Period: 60
-              Stat: Maximum
-<%end -%>
-
-  HighWebsocketConnectionsAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_high_websocket_connections"
-      AlarmDescription: Significantly higher websocket connections than normal detected. Investigate if there is a DDOS.
-      ActionsEnabled: false
-      EvaluationPeriods: 20
-      DatapointsToAlarm: 20
-      ComparisonOperator: GreaterThanUpperThreshold
-      TreatMissingData: notBreaching
-      Metrics:
-          - Id: m1
-            ReturnData: true
-            MetricStat:
-                Metric:
-                    Namespace: AWS/ApiGateway
-                    MetricName: ConnectCount
-                    Dimensions:
-                        - Name: Stage
-                          Value: !Sub "${StageName}"
-                        - Name: ApiId
-                          Value: !Ref WebSocketAPI
-                Period: 60
-                Stat: Sum
-          - Id: ad1
-            Label: ConnectCount (expected)
-            ReturnData: true
-            Expression: ANOMALY_DETECTION_BAND(m1, 8)
-      ThresholdMetricId: ad1
-
-  HighHttpRequestsAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_high_http_requests"
-        AlarmDescription: Significantly higher HTTP requests than normal detected.
-            Investigate if there is a DDOS.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions: []
-        InsufficientDataActions: []
-        EvaluationPeriods: 20
-        DatapointsToAlarm: 20
-        ComparisonOperator: GreaterThanUpperThreshold
-        TreatMissingData: notBreaching
-        Metrics:
-            - Id: m1
-              ReturnData: true
-              MetricStat:
-                  Metric:
-                      Namespace: AWS/ApiGateway
-                      MetricName: Count
-                      Dimensions:
-                          - Name: ApiId
-                            Value: !Ref HttpAPI
-                  Period: 60
-                  Stat: Sum
-            - Id: ad1
-              Label: Count (expected)
-              ReturnData: true
-              Expression: ANOMALY_DETECTION_BAND(m1, 8)
-        ThresholdMetricId: ad1
-
-  HighUsageCompositeAlarm:
-    Type: AWS::CloudWatch::CompositeAlarm
-    DependsOn:
-      - HighHttpRequestsAlarm
-      -  HighWebsocketConnectionsAlarm
-      -  NeighborhoodHighInvocationsAlarm
-      -  TheaterHighInvocationsAlarm
-    Properties:
-        ActionsEnabled: true
-        AlarmActions:
-            # TODO: after we have run at high usage for a while, consider re-enabling this alarm. Right now it is too noisy
-            # - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-usage"]
-            - !Ref AWS::NoValue
-        AlarmDescription: Send message if abnormally high Javabuilder usage detected.
-            Monitors usage across the HTTP API, WebSocket API, and all Build and Run
-            Lambdas.
-        AlarmName: !Sub "${SubdomainName}_high_usage_composite"
-        AlarmRule: !Sub "ALARM(${SubdomainName}_console_high_invocations) OR
-            ALARM(${SubdomainName}_high_http_requests) OR
-            ALARM(${SubdomainName}_high_websocket_connections) OR
-            ALARM(${SubdomainName}_neighborhood_high_invocations) OR
-            ALARM(${SubdomainName}_theater_high_invocations)"
-        InsufficientDataActions: []
-        OKActions: []
-
-<%JAVALAB_APP_TYPES.each do | name | -%>
-
-  <%=name%>HighSevereErrorRateAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_high_severe_error_rate"
-      AlarmDescription: Send page if Javabuilder severe error rate exceeds 10% for 20
-          minutes. Occasional spikes are expected, but a sustained high error rate
-          is an indication of an outage.
-      ActionsEnabled: true
-      AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:Javabuilder-high-error-rate"]
-      EvaluationPeriods: 4
-      DatapointsToAlarm: 4
-      Threshold: 10
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Metrics:
-          - Id: e1
-            Label: Error Rate (%)
-            ReturnData: true
-            Expression: (m1 / m2) * 100
-          - Id: m1
-            ReturnData: false
-            MetricStat:
-                Metric:
-                    Namespace: Javabuilder
-                    MetricName: SevereError
-                    Dimensions:
-                      - Name: functionName
-                        Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                Period: 300
-                Stat: Sum
-          - Id: m2
-            ReturnData: false
-            MetricStat:
-                Metric:
-                    Namespace: AWS/Lambda
-                    MetricName: Invocations
-                    Dimensions:
-                        - Name: FunctionName
-                          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                Period: 300
-                Stat: Sum
-
-  <%=name%>HighErrorRateAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_build_and_run_<%=name.downcase%>_lambda_error_rate"
-      AlarmDescription: Error rate in Javabuilder's <%=name%> build and run lambda (the core of
-          Javabuilder, which executes student <%=name%> code) exceeded 10% for four
-          consecutive 5 minute periods.
-      ActionsEnabled: true
-      AlarmActions:
-        - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-build-and-run-lambda-error-rate"]
-      EvaluationPeriods: 4
-      DatapointsToAlarm: 4
-      Threshold: 25
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Metrics:
-          - Id: e1
-            Label: Errors / Invocations
-            ReturnData: true
-            Expression: ((m1 - m3) / m2) * 100
-          - Id: m1
-            ReturnData: false
-            MetricStat:
-                Metric:
-                    Namespace: AWS/Lambda
-                    MetricName: Errors
-                    Dimensions:
-                        - Name: FunctionName
-                          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                Period: 300
-                Stat: Sum
-          - Id: m2
-            ReturnData: false
-            MetricStat:
-                Metric:
-                    Namespace: AWS/Lambda
-                    MetricName: Invocations
-                    Dimensions:
-                        - Name: FunctionName
-                          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                Period: 300
-                Stat: Sum
-          - Id: m3
-            ReturnData: false
-            MetricStat:
-                Metric:
-                    Namespace: AWS/Lambda
-                    MetricName: Duration
-                    Dimensions:
-                        - Name: FunctionName
-                          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                Period: 300
-                Stat: TC(89000:)
-
-  <%=name%>SlowCleanupTimeAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_slow_cleanup_time"
-      AlarmDescription: Average cleanup time in Javabuilder's <%=name%> build and run lambda was high for at 
-        least 15 out of the last 20 minutes. Investigate if there has been a performance regression.
-      ActionsEnabled: true
-      OKActions: []
-      AlarmActions:
-        - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-slow-performance"]
-      InsufficientDataActions: []
-      MetricName: CleanupTime
-      Namespace: Javabuilder
-      Statistic: Average
-      Dimensions:
-        - Name: functionName
-          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-      EvaluationPeriods: 20
-      DatapointsToAlarm: 15
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Threshold: 200
-      Period: 60
-  
-  <%=name%>SlowColdBootTimeAlarm:    
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_slow_cold_boot_time"
-      AlarmDescription: Average cold boot time in Javabuilder's <%=name%> build and run lambda was high for at 
-        least 15 out of the last 20 minutes. Investigate if there has been a performance regression.
-      ActionsEnabled: true
-      OKActions: []
-      AlarmActions:
-        - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-slow-performance"]
-      InsufficientDataActions: []
-      MetricName: ColdBootTime
-      Namespace: Javabuilder
-      Statistic: Average
-      Dimensions:
-        - Name: functionName
-          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-      EvaluationPeriods: 20
-      DatapointsToAlarm: 15
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Threshold: 10500
-      Period: 60
-
-  <%=name%>SlowInitializationTimeAlarm:    
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-      AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_slow_initialization_time"
-      AlarmDescription: Average initialization time in Javabuilder's <%=name%> build and run lambda was high for at 
-        least 15 out of the last 20 minutes. Investigate if there has been a performance regression.
-      ActionsEnabled: true
-      OKActions: []
-      AlarmActions:
-        - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-slow-performance"]
-      InsufficientDataActions: []
-      MetricName: InitializationTime
-      Namespace: Javabuilder
-      Statistic: Average
-      Dimensions:
-        - Name: functionName
-          Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-      EvaluationPeriods: 20
-      DatapointsToAlarm: 15
-      ComparisonOperator: GreaterThanThreshold
-      TreatMissingData: notBreaching
-      Threshold: 5000
-      Period: 60
-
-  
-  <%=name%>SlowTransitionTimeAlarm:    
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_slow_transition_time"
-        AlarmDescription: Average transition time in Javabuilder's <%=name%> build and run lambda was high for at 
-          least 15 out of the last 20 minutes. Investigate if there has been a performance regression.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-slow-performance"]
-        InsufficientDataActions: []
-        MetricName: TransitionTime
-        Namespace: Javabuilder
-        Statistic: Average
-        Dimensions:
-          - Name: functionName
-            Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-        EvaluationPeriods: 20
-        DatapointsToAlarm: 15
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-        Threshold: 2500
-        Period: 60
-
-  <%=name%>HighInvocationsAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_<%=name.downcase%>_high_invocations"
-        AlarmDescription: Significantly higher <%=name%> build and run invocations than
-            normal detected. Investigate if there is a DDOS.
-        ActionsEnabled: false
-        EvaluationPeriods: 20
-        DatapointsToAlarm: 20
-        ComparisonOperator: GreaterThanUpperThreshold
-        TreatMissingData: notBreaching
-        Metrics:
-            - Id: m1
-              ReturnData: true
-              MetricStat:
-                  Metric:
-                      Namespace: AWS/Lambda
-                      MetricName: Invocations
-                      Dimensions:
-                          - Name: FunctionName
-                            Value: !Ref BuildAndRunJava<%=name%>ProjectFunction
-                  Period: 60
-                  Stat: Sum
-            - Id: ad1
-              Label: Invocations (expected)
-              ReturnData: true
-              Expression: ANOMALY_DETECTION_BAND(m1, 8)
-        ThresholdMetricId: ad1
-
-<%end -%>
-
-# We use shortened versions of names for partition keys (eg, user_id),
-# but values will be a concatenation of the domain name and appropriate ID.
-# Values will look something like:
-# studio.code.org#123456 (user_requests table)
-# studio.code.org#UserId#123456 (blocked_users table)
-<%
-  DOMAIN_AND_USER_ID_COMPOSITE_ATTRIBUTE_NAME = 'user_id'
-  DOMAIN_AND_SECTION_OWNER_ID_COMPOSITE_ATTRIBUTE_NAME = 'section_owner_id'
-  TOKEN_ID_ATTRIBUTE_NAME = 'token_id'
-  ISSUED_AT_TIMESTAMP_ATTRIBUTE_NAME = 'issued_at'
-  TIME_TO_LIVE_ATTRIBUTE_NAME = 'ttl'
--%>
-  BlockedUsersTable:
-    Type: AWS::DynamoDB::Table
-    Properties:
-      TableName: !Sub "${SubdomainName}_blocked_users"
-      KeySchema:
-        - AttributeName: <%=DOMAIN_AND_USER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          KeyType: HASH
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: <%=DOMAIN_AND_USER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          AttributeType: S
-      PointInTimeRecoverySpecification:
-        PointInTimeRecoveryEnabled: true
-
-  TokenStatusTable:
-    Type: AWS::DynamoDB::Table
-    Properties:
-      TableName: !Sub "${SubdomainName}_tokens"
-      KeySchema:
-        - AttributeName: <%=TOKEN_ID_ATTRIBUTE_NAME%>
-          KeyType: HASH
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: <%=TOKEN_ID_ATTRIBUTE_NAME%>
-          AttributeType: S
-      TimeToLiveSpecification:
-        AttributeName: <%=TIME_TO_LIVE_ATTRIBUTE_NAME%>
-        Enabled: true
-
-  UserRequestsTable:
-    Type: AWS::DynamoDB::Table
-    Properties:
-      TableName: !Sub "${SubdomainName}_user_requests"
-      KeySchema:
-        - AttributeName: <%=DOMAIN_AND_USER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          KeyType: HASH
-        - AttributeName: <%=ISSUED_AT_TIMESTAMP_ATTRIBUTE_NAME%>
-          KeyType: RANGE
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: <%=DOMAIN_AND_USER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          AttributeType: S
-        - AttributeName: <%=ISSUED_AT_TIMESTAMP_ATTRIBUTE_NAME%>
-          AttributeType: N
-      TimeToLiveSpecification:
-        AttributeName: <%=TIME_TO_LIVE_ATTRIBUTE_NAME%>
-        Enabled: true
-
-  TeacherAssociatedRequestsTable:
-    Type: AWS::DynamoDB::Table
-    Properties:
-      TableName: !Sub "${SubdomainName}_teacher_associated_requests"
-      KeySchema:
-        - AttributeName: <%=DOMAIN_AND_SECTION_OWNER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          KeyType: HASH
-        - AttributeName: <%=ISSUED_AT_TIMESTAMP_ATTRIBUTE_NAME%>
-          KeyType: RANGE
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: <%=DOMAIN_AND_SECTION_OWNER_ID_COMPOSITE_ATTRIBUTE_NAME%>
-          AttributeType: S
-        - AttributeName: <%=ISSUED_AT_TIMESTAMP_ATTRIBUTE_NAME%>
-          AttributeType: N
-      TimeToLiveSpecification:
-        AttributeName: <%=TIME_TO_LIVE_ATTRIBUTE_NAME%>
-        Enabled: true
-
-  HighUsersBlockedAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_high_users_blocked"
-        AlarmDescription: Unusually high number of users being blocked by our throttling
-            thresholds.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-throttling"]
-        InsufficientDataActions: []
-        MetricName: UserBlocked
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref HttpAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 100
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-  HighClassroomsBlockedAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_high_classrooms_blocked"
-        AlarmDescription: Unusually high number of classrooms being blocked by our throttling
-            thresholds.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-throttling"]
-        InsufficientDataActions: []
-        MetricName: ClassroomBlocked
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref HttpAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 10
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-  HighUnknownTokensAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_high_unknown_tokens"
-        AlarmDescription: Websocket authorizer is receiving connection requests using
-            tokens that did not pass through the HTTP authorizer first.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-token-errors"]
-        InsufficientDataActions: []
-        MetricName: TokenUnknownId
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref WebsocketAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 100
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-  HighUnvettedTokensAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_high_unvetted_tokens"
-        AlarmDescription: Websocket authorizer is receiving connection requests using
-            tokens that were observed but not vetted as valid by the HTTP authorizer.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-token-errors"]
-        InsufficientDataActions: []
-        MetricName: TokenNotVetted
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref WebsocketAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 100
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-  WebsocketHighUsedTokensAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_websocket_high_used_tokens"
-        AlarmDescription: Websocket authorizer is receiving connection requests using
-            tokens have already been used.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-token-errors"]
-        InsufficientDataActions: []
-        MetricName: TokenUsed
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref WebsocketAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 100
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-  HttpHighUsedTokensAlarm:
-    Type: AWS::CloudWatch::Alarm
-    Properties:
-        AlarmName: !Sub "${SubdomainName}_http_high_used_tokens"
-        AlarmDescription: HTTP authorizer is receiving connection requests using
-            tokens have already been used.
-        ActionsEnabled: true
-        OKActions: []
-        AlarmActions:
-          - !If [SilenceAlertsCondition, !Ref AWS::NoValue, !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:javabuilder-high-token-errors"]
-        InsufficientDataActions: []
-        MetricName: TokenUsed
-        Namespace: Javabuilder
-        Statistic: Sum
-        Dimensions:
-            - Name: functionName
-              Value: !Ref HttpAuthorizerLambda
-        Period: 60
-        EvaluationPeriods: 1
-        DatapointsToAlarm: 1
-        Threshold: 100
-        ComparisonOperator: GreaterThanThreshold
-        TreatMissingData: notBreaching
-
-Outputs:
-  JavabuilderURL:
-    Value:
-      Fn::Sub: wss://${SubdomainName}.${BaseDomainName}
diff --git a/cicd/3-app/.gitignore b/cicd/3-app/.gitignore
new file mode 100644
index 00000000..a72fbafa
--- /dev/null
+++ b/cicd/3-app/.gitignore
@@ -0,0 +1,15 @@
+# Build artifacts and temporary files
+tmp/
+*.yml
+!template.yml.erb
+packaged-*.yml
+app-template*.yml
+parameters_*.json
+
+# Component copies (copied during build process)
+api-gateway-routes/
+javabuilder-authorizer/
+org-code-javabuilder/
+
+# Logs
+*.log
diff --git a/cicd/3-app/README.md b/cicd/3-app/README.md
new file mode 100644
index 00000000..5f04e72b
--- /dev/null
+++ b/cicd/3-app/README.md
@@ -0,0 +1,149 @@
+# JavaBuilder Development Stack Deployment
+
+This directory contains the deployment scripts and templates for deploying a JavaBuilder development stack to AWS.
+
+## Quick Start
+
+To deploy a development stack:
+
+```bash
+cd cicd/3-app
+./deploy-development-stack.rb
+```
+
+The script will build all components, process the CloudFormation template, and deploy the stack to AWS using the default configuration.
+
+## Prerequisites
+
+Before running the deployment script, ensure you have:
+
+- **AWS CLI** configured with appropriate credentials for the dev account
+- **S3 Artifact Bucket** created in your target AWS account (see setup instructions below)
+- **Java SDK** installed (OpenJDK 11+ recommended)
+- **Ruby 3.3+** installed
+- **Bundler** installed for Ruby dependencies
+- **cfn-lint** installed (optional, for template validation): `pip install cfn-lint`
+
+## Script Options
+
+The deployment script accepts several command-line options:
+
+```bash
+./deploy-development-stack.rb --help
+```
+
+Common options:
+- `--profile PROFILE`: AWS CLI profile to use (default: codeorg-dev)
+- `--stack_name NAME`: CloudFormation stack name (default: javabuilder-dev)
+- `--artifact_bucket BUCKET`: S3 bucket for build artifacts (must exist)
+- `--subdomain_name SUBDOMAIN`: Subdomain for the service (default: javabuilder-dev)
+
+## Setup
+
+### Artifact Bucket Setup
+
+**IMPORTANT:** Before deploying, you must create an S3 bucket in your target AWS account for storing deployment artifacts. The deployment script will not create this bucket automatically.
+
+```bash
+# Create a bucket (replace with your desired bucket name)
+aws s3 mb s3://my-javabuilder-artifacts --profile codeorg-dev --region us-east-1
+
+# Then use it in deployment
+./deploy-development-stack.rb --artifact_bucket my-javabuilder-artifacts
+```
+
+If no `--artifact_bucket` is specified, the script will use `{stack_name}-artifacts` as the default bucket name. **This bucket must already exist before running the deployment.**
+
+## What the Script Does
+
+1. **Artifact Bucket Verification**: Verifies the required S3 bucket exists for deployment artifacts (fails if not found)
+2. **Component Building**: 
+   - Builds `javabuilder-authorizer` using its build script
+   - Builds `org-code-javabuilder` using Gradle (including tests)
+   - Prepares `api-gateway-routes` (tests skipped due to dependency conflicts)
+3. **Artifact Management**: Copies built components to `tmp/` directory for debugging
+4. **Template Processing**: Processes the ERB template to generate CloudFormation YAML
+5. **Template Validation**: Runs cfn-lint if available
+6. **Template Packaging**: Uploads Lambda packages to S3 and updates template references
+7. **Stack Deployment**: Deploys or updates the CloudFormation stack
+8. **Output Display**: Shows stack outputs including service endpoints
+
+## Build Artifacts
+
+Build artifacts are preserved in the `tmp/` directory for debugging purposes:
+- `tmp/api-gateway-routes/`: API Gateway routes component
+- `tmp/javabuilder-authorizer/`: Lambda authorizer component  
+- `tmp/org-code-javabuilder/`: Main JavaBuilder application
+- `tmp/app-template-*.yml`: Processed CloudFormation template
+- `tmp/packaged-app-template-*.yml`: Packaged template with S3 references
+
+The `tmp/` directory is gitignored and safe to delete between deployments.
+
+## SSL Configuration
+
+The deployment uses the existing wildcard certificate for `*.dev-code.org` by default. The certificate ARN is hardcoded in the script but can be overridden via command-line options if needed.
+
+## Stack Management
+
+### Deploying a Stack
+```bash
+./deploy-development-stack.rb --stack_name my-javabuilder-test
+```
+
+### Deleting a Stack
+Since development stack provisioning is rare, manual deletion from the AWS console is recommended:
+
+1. Go to AWS CloudFormation console
+2. Select your stack (e.g., `javabuilder-dev`)
+3. Click "Delete" 
+4. Confirm deletion
+
+Alternatively, use AWS CLI:
+```bash
+aws cloudformation delete-stack --stack-name javabuilder-dev --profile codeorg-dev
+```
+
+## Differences from Production
+
+- Uses wildcard certificate instead of generating new certificates
+- Simplified parameter configuration suitable for development
+- Build artifacts preserved locally for debugging
+- Reduced concurrent execution limits appropriate for development usage
+
+## Troubleshooting
+
+### Java Build Issues
+Ensure OpenJDK 11+ is installed and accessible in your PATH.
+
+**Installation options:**
+- **macOS with Homebrew:** `brew install openjdk@11`
+- **Ubuntu/Debian:** `sudo apt-get install openjdk-11-jdk`
+- **CentOS/RHEL:** `sudo yum install java-11-openjdk-devel`
+- **Manual installation:** Download from [OpenJDK website](https://openjdk.org/)
+
+**Verify installation:**
+```bash
+java -version
+```
+
+### Ruby Version Issues
+Ensure you're using Ruby 3.3+:
+```bash
+ruby --version
+gem install bundler
+```
+
+### Template Validation Errors
+Install cfn-lint for better error messages:
+```bash
+pip install cfn-lint
+```
+
+### S3 Bucket Access Issues
+Verify your AWS credentials have permissions to:
+- Access the pre-created S3 artifact bucket
+- Deploy CloudFormation stacks
+- Create Lambda functions and other AWS resources
+
+If you get an error that the artifact bucket doesn't exist, ensure you've created it according to the setup instructions above.
+
diff --git a/cicd/3-app/deploy-development-stack.rb b/cicd/3-app/deploy-development-stack.rb
new file mode 100755
index 00000000..121462bc
--- /dev/null
+++ b/cicd/3-app/deploy-development-stack.rb
@@ -0,0 +1,429 @@
+#!/usr/bin/env ruby
+require 'optparse'
+require 'fileutils'
+require 'open3'
+require 'erb'
+require 'json'
+
+def get_branch_name
+  # Get current git branch
+  branch_output = `git branch --show-current`.strip
+  if $?.success? && !branch_output.empty?
+    # Extract the text after the last '/' (e.g., 'feature/dev-environment-setup' -> 'dev-environment-setup')
+    branch_output.split('/').last
+  else
+    puts "❌ Error: Unable to determine current git branch"
+    exit 1
+  end
+end
+
+# Get the current branch name for default naming
+default_branch_name = get_branch_name
+default_stack_name = "javabuilder-dev-#{default_branch_name}"
+default_subdomain_name = "javabuilder-dev-#{default_branch_name}"
+
+# Default options
+options = {
+  profile: 'codeorg-dev',
+  region: 'us-east-1',
+  stack_name: nil,  # Now required
+  base_domain_name: 'dev-code.org',
+  subdomain_name: nil,  # Now required
+  hosted_zone_id: 'Z07248463JGJ44FME5BZ5',
+  provisioned_concurrent_executions: 1,
+  reserved_concurrent_executions: 3,
+  limit_per_hour: 50,
+  limit_per_day: 150,
+  teacher_limit_per_hour: 5000,
+  stage_name: 'Prod',
+  silence_alerts: true,
+  high_concurrent_executions_topic: 'CDO-Urgent',
+  high_concurrent_executions_alarm_threshold: 400,
+  template_path: '3-app/javabuilder'
+}
+
+opt_parser = OptionParser.new do |opts|
+  opts.banner = "Usage: ./deploy-development-stack.rb [options]"
+
+  opts.on(
+    '--profile PROFILE',
+    String,
+    "AWS CLI profile to use for deployment",
+    "Default: codeorg-dev"
+  ) do |profile|
+    options[:profile] = profile
+  end
+
+  opts.on(
+    '--region REGION',
+    String,
+    "AWS Region to deploy this stack",
+    "Default: us-east-1"
+  ) do |region|
+    options[:region] = region
+  end
+
+  opts.on(
+    '--stack_name NAME',
+    String,
+    "Name of the CloudFormation stack to create or update (REQUIRED)",
+    "Recommended: javabuilder-dev-<branch-name>",
+    "Example: javabuilder-dev-#{default_branch_name}"
+  ) do |name|
+    options[:stack_name] = name
+  end
+
+  opts.on(
+    '--artifact_bucket BUCKET',
+    String,
+    "S3 bucket for storing deployment artifacts",
+    "Must exist in the target AWS account"
+  ) do |bucket|
+    options[:artifact_bucket] = bucket
+  end
+
+  opts.on(
+    '--subdomain_name SUBDOMAIN',
+    String,
+    "Subdomain name for the JavaBuilder service (REQUIRED)",
+    "Recommended: javabuilder-dev-<branch-name>",
+    "Example: javabuilder-dev-#{default_branch_name}"
+  ) do |subdomain|
+    options[:subdomain_name] = subdomain
+  end
+
+  opts.on('-h', '--help', 'Show this help message') do
+    puts opts
+    puts "\nPrerequisites:"
+    puts "  - AWS CLI configured with appropriate credentials"
+    puts "  - Java SDK installed (OpenJDK 11 recommended)"
+    puts "  - Ruby 3.3+ installed"
+    puts "  - cfn-lint installed (optional, for template validation)"
+    puts "  - Bundler installed for Ruby dependencies"
+    puts "\nNaming Convention:"
+    puts "  - Multiple development stacks are supported in the same AWS Account & Region"
+    puts "  - Use branch-based naming: javabuilder-dev-<branch-name>"
+    puts "  - Current branch: #{get_branch_name}"
+    puts "  - Suggested stack name: #{default_stack_name}"
+    puts "  - Suggested subdomain: #{default_subdomain_name}"
+    puts "\nExample Usage:"
+    puts "  ./deploy-development-stack.rb --stack_name #{default_stack_name} --subdomain_name #{default_subdomain_name} --artifact_bucket my-artifacts"
+    puts "\nThis script will:"
+    puts "  1. Build all JavaBuilder components (API Gateway routes, authorizer, main app)"
+    puts "  2. Process the CloudFormation template"
+    puts "  3. Package and deploy the stack to AWS"
+    puts "  4. Store build artifacts in cicd/3-app/tmp/ for debugging"
+    exit
+  end
+end
+
+def execute_command(command, description, exit_on_failure: true)
+  puts "🔄 #{description}..."
+  stdout, stderr, status = Open3.capture3(command)
+
+  if status.success?
+    puts "✅ #{description}"
+    puts stdout unless stdout.empty?
+    return stdout
+  else
+    puts "❌ Error: #{description} failed"
+    puts stderr
+    exit 1 if exit_on_failure
+    return nil
+  end
+end
+
+def process_template(template_file, output_file, binding_object)
+  # Verify template exists
+  unless File.exist?(template_file)
+    puts "❌ Error: Template file '#{template_file}' does not exist"
+    exit 1
+  end
+
+  # Create temp dir if it doesn't exist
+  temp_dir = File.join(Dir.pwd, 'tmp')
+  FileUtils.mkdir_p(temp_dir)
+
+  # Generate temp file path
+  output_path = File.join(temp_dir, output_file)
+
+  # Read the template file
+  template_content = File.read(template_file)
+
+  # Process the ERB template
+  begin
+    renderer = ERB.new(template_content, trim_mode: '-')
+    result = renderer.result(binding_object)
+
+    # Write the processed template to the output file
+    File.write(output_path, result)
+
+    puts "✅ Template processed successfully: #{output_path}"
+    return output_path
+  rescue => exception
+    puts "❌ Exception processing template: #{exception.message}"
+    exit 1
+  end
+end
+
+def deploy_stack(stack_name:, template_file:, parameters: {}, region:, profile:, capabilities: [], s3_bucket: nil)
+  temp_dir = File.join(Dir.pwd, 'tmp')
+  FileUtils.mkdir_p(temp_dir)
+
+  # Build the AWS CLI command
+  command_parts = [
+    "aws cloudformation deploy",
+    "--stack-name #{stack_name}",
+    "--template-file #{template_file}",
+    "--region #{region}",
+    "--profile #{profile}"
+  ]
+
+  # Add S3 bucket if specified (required for large templates)
+  if s3_bucket
+    command_parts << "--s3-bucket #{s3_bucket}"
+  end
+
+  # Add capabilities if any are specified
+  unless capabilities.empty?
+    command_parts << "--capabilities #{capabilities.join(' ')}"
+  end
+
+  # Add parameters if any
+  unless parameters.empty?
+    param_overrides = parameters.map { |k, v| "#{k}=#{v}" }.join(" ")
+    command_parts << "--parameter-overrides #{param_overrides}"
+  end
+
+  command = command_parts.join(" \\\n    ")
+
+  execute_command(command, "Deploying stack '#{stack_name}' in region '#{region}'")
+end
+
+def ensure_artifact_bucket(bucket_name, profile, region)
+  check_cmd = "aws s3api head-bucket --bucket #{bucket_name} --profile #{profile} --region #{region}"
+  
+  puts "🔍 Checking if artifact bucket exists: #{bucket_name}"
+  
+  # Check if bucket exists
+  _, _, status = Open3.capture3("#{check_cmd} 2>/dev/null")
+  
+  if status.success?
+    puts "✅ Artifact bucket found: #{bucket_name}"
+  else
+    puts "❌ Error: Artifact bucket '#{bucket_name}' does not exist."
+    puts "   Please create the S3 bucket manually or specify an existing bucket."
+    puts "   See README.md for setup instructions."
+    exit 1
+  end
+end
+
+def build_components
+  puts "\n=== Building JavaBuilder Components ==="
+  
+  # Verify Java is available
+  java_version = execute_command("java -version 2>&1 | head -1", "Checking Java version", exit_on_failure: false)
+  if java_version.nil?
+    puts "❌ Error: Java SDK not found. Please install OpenJDK 11+ and ensure it's in your PATH."
+    puts "   See README.md for installation instructions."
+    exit 1
+  end
+  
+  # Build javabuilder-authorizer
+  puts "\n🔐 Building javabuilder-authorizer..."
+  Dir.chdir('../javabuilder-authorizer') do
+    execute_command('./build.sh', 'Building javabuilder-authorizer')
+  end
+  
+  # Build org-code-javabuilder
+  puts "\n🔨 Building org-code-javabuilder..."
+  Dir.chdir('../org-code-javabuilder') do
+    execute_command('./gradlew test', 'Running tests for org-code-javabuilder')
+    execute_command('./build.sh', 'Building org-code-javabuilder')
+  end
+  
+  # Build api-gateway-routes (skip tests due to dependency conflicts)
+  puts "\n🌐 Building api-gateway-routes..."
+  Dir.chdir('../api-gateway-routes') do
+    puts "⚠️ Skipping Ruby tests due to gem dependency conflicts - proceeding with deployment..."
+  end
+  
+  puts "✅ All components built successfully"
+end
+
+def copy_artifacts_to_temp
+  puts "\n📋 Copying built artifacts to temp directory..."
+  
+  temp_dir = File.join(Dir.pwd, 'tmp')
+  FileUtils.mkdir_p(temp_dir)
+  
+  components = ['api-gateway-routes', 'javabuilder-authorizer', 'org-code-javabuilder']
+  
+  components.each do |component|
+    source = File.join('..', component)
+    destination = File.join(temp_dir, component)
+    
+    if File.exist?(source)
+      FileUtils.rm_rf(destination) if File.exist?(destination)
+      execute_command("rsync -av #{source}/ #{destination}/", "Copying #{component}", exit_on_failure: false)
+    else
+      puts "⚠️ Warning: #{source} not found, skipping..."
+    end
+  end
+  
+  puts "✅ Artifacts copied to temp directory"
+end
+
+begin
+  opt_parser.parse!
+
+  # Validate required parameters
+  missing_params = []
+  missing_params << '--stack_name' if options[:stack_name].nil?
+  missing_params << '--subdomain_name' if options[:subdomain_name].nil?
+  
+  unless missing_params.empty?
+    puts "❌ Error: Missing required parameters: #{missing_params.join(', ')}"
+    puts "\nTo support multiple development environments, both stack_name and subdomain_name are required."
+    puts "\nRecommended values for current branch (#{get_branch_name}):"
+    puts "  --stack_name #{default_stack_name}"
+    puts "  --subdomain_name #{default_subdomain_name}"
+    puts "\nExample:"
+    puts "  ./deploy-development-stack.rb --stack_name #{default_stack_name} --subdomain_name #{default_subdomain_name} --artifact_bucket my-artifacts"
+    puts "\nUse --help for more information."
+    exit 1
+  end
+
+  # Set default artifact bucket if not provided
+  if options[:artifact_bucket].nil?
+    options[:artifact_bucket] = "#{options[:stack_name]}-artifacts"
+  end
+
+  puts "🚀 JavaBuilder Development Stack Deployment"
+  puts "==========================================="
+  puts "Deployment configuration:"
+  options.each do |key, value|
+    puts "  #{key}: #{value}"
+  end
+
+  if ENV['CI'] == 'true'
+    puts "Running in CI mode. Skipping confirmation..."
+    confirmation = 'yes'
+  else
+    puts "\nDo you want to continue? [y/N]: "
+    confirmation = $stdin.gets.chomp.downcase
+  end
+
+  if ['y', 'yes'].include?(confirmation)
+    # Create temp directory for build artifacts
+    temp_dir = File.join(Dir.pwd, 'tmp')
+    FileUtils.mkdir_p(temp_dir)
+
+    # Step 1: Ensure artifact bucket exists
+    puts "\n=== Step 1: Setting up artifact bucket ==="
+    ensure_artifact_bucket(options[:artifact_bucket], options[:profile], options[:region])
+
+    # Step 2: Build all components
+    build_components
+
+    # Step 3: Copy artifacts to temp directory
+    copy_artifacts_to_temp
+
+    # Step 4: Process ERB template
+    puts "\n=== Step 4: Processing CloudFormation template ==="
+    template_file = File.join(options[:template_path], 'template.yml.erb')
+    app_template_path = process_template(
+      template_file,
+      "app-template-#{Time.now.to_i}.yml",
+      binding
+    )
+
+    # Step 5: Lint template (optional)
+    puts "\n=== Step 5: Validating CloudFormation template ==="
+    lint_cmd = "cfn-lint #{app_template_path}"
+    if execute_command("which cfn-lint >/dev/null 2>&1", "Checking for cfn-lint", exit_on_failure: false)
+      execute_command(lint_cmd, "Linting CloudFormation template", exit_on_failure: false)
+    else
+      puts "⚠️ cfn-lint not found, skipping template validation"
+    end
+
+    # Step 6: Package template
+    puts "\n=== Step 6: Packaging CloudFormation template ==="
+    packaged_template_path = File.join(temp_dir, "packaged-app-template-#{Time.now.to_i}.yml")
+    package_cmd = [
+      "aws cloudformation package",
+      "--template-file #{app_template_path}",
+      "--s3-bucket #{options[:artifact_bucket]}",
+      "--s3-prefix package",
+      "--output-template-file #{packaged_template_path}",
+      "--profile #{options[:profile]}"
+    ].join(" \\\n    ")
+    
+    execute_command(package_cmd, "Packaging CloudFormation template")
+
+    # Step 7: Deploy stack
+    puts "\n=== Step 7: Deploying CloudFormation stack ==="
+    
+    stack_parameters = {
+      'BaseDomainName' => options[:base_domain_name],
+      'BaseDomainNameHostedZonedID' => options[:hosted_zone_id],
+      'SubdomainName' => options[:subdomain_name],
+      'ProvisionedConcurrentExecutions' => options[:provisioned_concurrent_executions],
+      'ReservedConcurrentExecutions' => options[:reserved_concurrent_executions],
+      'LimitPerHour' => options[:limit_per_hour],
+      'LimitPerDay' => options[:limit_per_day],
+      'TeacherLimitPerHour' => options[:teacher_limit_per_hour],
+      'StageName' => options[:stage_name],
+      'SilenceAlerts' => options[:silence_alerts],
+      'HighConcurrentExecutionsTopic' => options[:high_concurrent_executions_topic],
+      'HighConcurrentExecutionsAlarmThreshold' => options[:high_concurrent_executions_alarm_threshold]
+    }
+
+    deploy_stack(
+      stack_name: options[:stack_name],
+      template_file: packaged_template_path,
+      parameters: stack_parameters,
+      region: options[:region],
+      profile: options[:profile],
+      capabilities: %w(CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND),
+      s3_bucket: options[:artifact_bucket]
+    )
+
+    # Step 8: Display stack outputs
+    puts "\n=== Step 8: Stack deployment completed ==="
+    outputs_cmd = [
+      "aws cloudformation describe-stacks",
+      "--stack-name #{options[:stack_name]}",
+      "--profile #{options[:profile]}",
+      "--region #{options[:region]}",
+      "--query 'Stacks[0].Outputs[*].[OutputKey,OutputValue,Description]'",
+      "--output table"
+    ].join(" \\\n    ")
+    
+    execute_command(outputs_cmd, "Retrieving stack outputs")
+
+    puts "\n🎉 Deployment Summary:"
+    puts "   Stack Name: #{options[:stack_name]}"
+    puts "   Region: #{options[:region]}"
+    puts "   SSL Certificates: ENABLED (individual domain certificates)"
+    puts "   Build artifacts preserved in: #{temp_dir}"
+    puts "   🔗 HTTPS endpoints ready for testing"
+    puts "\n✅ Deployment complete!"
+
+  else
+    puts "Deployment cancelled."
+    exit 0
+  end
+
+rescue OptionParser::InvalidOption, OptionParser::MissingArgument, OptionParser::InvalidArgument => exception
+  puts "❌ Error: #{exception.message}"
+  puts opt_parser
+  exit 1
+rescue Interrupt
+  puts "\n❌ Deployment interrupted by user"
+  exit 1
+rescue => exception
+  puts "❌ Unexpected error: #{exception.message}"
+  puts exception.backtrace
+  exit 1
+end
diff --git a/cicd/3-app/javabuilder/buildspec.yml b/cicd/3-app/javabuilder/buildspec.yml
index 39544303..5706a0e3 100644
--- a/cicd/3-app/javabuilder/buildspec.yml
+++ b/cicd/3-app/javabuilder/buildspec.yml
@@ -2,7 +2,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      ruby: 2.7
+      ruby: 3.3.0
       java: corretto11
       python: 3.8
     commands:
diff --git a/cicd/3-app/javabuilder/config/dev.config.json b/cicd/3-app/javabuilder/config/dev.config.json
index 51b52d4b..c420679e 100644
--- a/cicd/3-app/javabuilder/config/dev.config.json
+++ b/cicd/3-app/javabuilder/config/dev.config.json
@@ -1,4 +1,5 @@
 {
+  "_comment": "This file is used by AWS CodePipeline for automated dev deployments. Referenced in cicd as TemplateConfiguration. Local dev scripts use hardcoded parameters instead.",
   "Parameters": {
     "BaseDomainName": "code.org",
     "BaseDomainNameHostedZonedID": "Z2LCOI49SCXUGU",
diff --git a/cicd/3-app/javabuilder/pr-buildspec.yml b/cicd/3-app/javabuilder/pr-buildspec.yml
index bc6f7f34..6d86feb5 100644
--- a/cicd/3-app/javabuilder/pr-buildspec.yml
+++ b/cicd/3-app/javabuilder/pr-buildspec.yml
@@ -4,7 +4,7 @@ phases:
     runtime-versions:
       ruby: 2.7
       java: corretto11
-      python: 3.8
+      python: 3.3.0
     commands:
       - rbenv versions
       # downgrade from default codebuild ruby runtime to the version we specify in .ruby-version, if different
diff --git a/cicd/3-app/javabuilder/template.yml.erb b/cicd/3-app/javabuilder/template.yml.erb
index 9cb765df..ac484fe7 100644
--- a/cicd/3-app/javabuilder/template.yml.erb
+++ b/cicd/3-app/javabuilder/template.yml.erb
@@ -65,7 +65,7 @@ JAVALAB_APP_TYPES = %w(
 -%>
 Globals:
   Function:
-    Runtime: ruby2.7
+    Runtime: ruby3.3
     Timeout: 30
     MemorySize: 256
     Tracing: Active
@@ -420,7 +420,7 @@ Resources:
     Type: AWS::Serverless::LayerVersion
     Properties:
       CompatibleRuntimes:
-        - java11
+        - java17
       ContentUri: org-code-javabuilder/change_runtime_directory
       Description: Change Java runtime to launch from the writeable /tmp directory to enable student projects to write files more easily.
       LayerName: change-java-runtime-directory
@@ -429,7 +429,7 @@ Resources:
     Type: AWS::Serverless::LayerVersion
     Properties:
       CompatibleRuntimes:
-        - java11
+        - java17
       ContentUri: org-code-javabuilder/font_config.zip
       Description: Add a font configuration file to enable use of fonts.
       LayerName: font-configuration
@@ -446,7 +446,7 @@ Resources:
         - !Ref FontConfigurationLayer
         - !Ref ChangeJavaRuntimeDirectoryLayer
       Handler: org.code.javabuilder.LambdaRequestHandler::handleRequest
-      Runtime: java11
+      Runtime: java17
       CodeUri: org-code-javabuilder/lib/build/distributions/lib.zip
       AutoPublishAlias: live
       ReservedConcurrentExecutions: !Ref ReservedConcurrentExecutions
@@ -498,7 +498,11 @@ Resources:
         - Action: ['s3:GetObject']
           Effect: Allow
           Resource: !Sub "arn:aws:s3:::${ContentBucket}/*"
-          Principal: '*'
+          Principal:
+            Service: cloudfront.amazonaws.com
+          Condition:
+            StringEquals:
+              "AWS:SourceArn": !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${ContentCDN}"
 
   ContentApiCertificate:
     Type: AWS::CertificateManager::Certificate
@@ -539,7 +543,7 @@ Resources:
         #   Prefix: !Sub "${SubdomainName}-content.${BaseDomainName}"
         Origins:
           - Id: ContentBucket
-            DomainName: !GetAtt ContentBucket.DomainName
+            DomainName: !GetAtt ContentBucket.RegionalDomainName
             S3OriginConfig: {}
         DefaultCacheBehavior:
           TargetOriginId: ContentBucket
diff --git a/cicd/3-app/load-test/load-test.buildspec.yml b/cicd/3-app/load-test/load-test.buildspec.yml
index caeb63b7..08ea5e04 100644
--- a/cicd/3-app/load-test/load-test.buildspec.yml
+++ b/cicd/3-app/load-test/load-test.buildspec.yml
@@ -4,7 +4,7 @@ phases:
     runtime-versions:
       ruby: 2.7
       java: corretto11
-      python: 3.8
+      python: 3.3.0
     commands:
       - gem install bundler
       - pip install cfn-lint
diff --git a/cicd/README.md b/cicd/README.md
index 1c259fa6..a2a98946 100644
--- a/cicd/README.md
+++ b/cicd/README.md
@@ -38,8 +38,6 @@ Finally, all of the above need some Roles to exist in the AWS accounts before we
 
 ### Deploying the `main` CI/CD Pipeline
 
-_Note: If you receive errors with the 'aws-google' gem, you may need to switch to Ruby 2.7.5 first, via `rbenv local 2.7.5`._
-
 1. Create/Update the Setup stack (one time, or when changes to the Setup stack occur)
    `cicd/1-setup/deploy-cicd-dependencies.sh` (with elevated AWS permissions)
 2. Create/Update the CI/CD stack (one time, or when changes to the CI/CD stack occur)
@@ -96,7 +94,7 @@ Because of some nuances of our AWS SSO integration and tooling, you might need t
 Error when retrieving credentials from custom-process: rbenv: aws-google: command not found
 
 The `aws-google' command exists in these Ruby versions:
-  2.7.5
+  3.1.0
 ```
 
-If this occurs, you can simply run `rbenv local 2.7.5` or whatever version is suggested (should be the same version used in the code-dot-org/code-dot-org repository) and try running the script again.
+If this occurs, you can try `gem install aws-google` to try installing into your current Ruby version (ideally the one in ".ruby-version") or run `rbenv local 3.1.0` or whatever version is suggested (should be the same version used in the code-dot-org/code-dot-org repository) and try running the script again.
\ No newline at end of file
diff --git a/javabuilder-authorizer/.ruby-version b/javabuilder-authorizer/.ruby-version
new file mode 100644
index 00000000..15a27998
--- /dev/null
+++ b/javabuilder-authorizer/.ruby-version
@@ -0,0 +1 @@
+3.3.0
diff --git a/javabuilder-authorizer/Gemfile b/javabuilder-authorizer/Gemfile
index cbbf2e19..674851ba 100644
--- a/javabuilder-authorizer/Gemfile
+++ b/javabuilder-authorizer/Gemfile
@@ -1,7 +1,7 @@
 # Gemfile
 source 'https://rubygems.org'
 
-ruby '~> 2.7'
+ruby '~> 3.3'
 
 gem 'aws-sdk-lambda', '1.39.0'
 gem 'jwt'
diff --git a/javabuilder-authorizer/Gemfile.lock b/javabuilder-authorizer/Gemfile.lock
index 9abe765f..ba20e835 100644
--- a/javabuilder-authorizer/Gemfile.lock
+++ b/javabuilder-authorizer/Gemfile.lock
@@ -1,29 +1,35 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    aws-eventstream (1.1.1)
-    aws-partitions (1.441.0)
-    aws-sdk-cloudwatch (1.52.0)
-      aws-sdk-core (~> 3, >= 3.112.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.113.1)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.239.0)
-      aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-dynamodb (1.60.0)
-      aws-sdk-core (~> 3, >= 3.112.0)
-      aws-sigv4 (~> 1.1)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1134.0)
+    aws-sdk-cloudwatch (1.117.0)
+      aws-sdk-core (~> 3, >= 3.227.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-core (3.227.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-dynamodb (1.147.0)
+      aws-sdk-core (~> 3, >= 3.227.0)
+      aws-sigv4 (~> 1.5)
     aws-sdk-lambda (1.39.0)
       aws-sdk-core (~> 3, >= 3.71.0)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.2.3)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    jmespath (1.4.0)
-    jwt (2.2.2)
-    minitest (5.15.0)
+    base64 (0.3.0)
+    jmespath (1.6.2)
+    jwt (3.1.2)
+      base64
+    logger (1.7.0)
+    minitest (5.25.5)
 
 PLATFORMS
+  arm64-darwin-24
   ruby
 
 DEPENDENCIES
@@ -34,7 +40,7 @@ DEPENDENCIES
   minitest (~> 5.5)
 
 RUBY VERSION
-   ruby 2.7.4p191
+   ruby 3.3.0p0
 
 BUNDLED WITH
-   2.1.4
+   2.5.3