diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e53387e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+setup.env
+*/gerrit/plugins/*.jar
+*/gerrit/etc/
+!*/gerrit/etc/*.template
+!*/gerrit/etc/gerrit.config
diff --git a/single-master/Makefile b/single-master/Makefile
index 9b94f1c..da8ecc5 100644
--- a/single-master/Makefile
+++ b/single-master/Makefile
@@ -1,18 +1,15 @@
-CLUSTER_STACK_NAME:=gerrit-cluster
+include setup.env
+
 CLUSTER_TEMPLATE:=cf-cluster.yml
 SERVICE_TEMPLATE:=cf-service.yml
-SERVICE_STACK_NAME:=gerrit-service
-DNS_ROUTING_STACK_NAME:=gerrit-dns-routing
 DNS_ROUTING_TEMPLATE:=cf-dns-route.yml
-HOSTED_ZONE_NAME:=mycompany.com
-SUBDOMAIN:=gerrit-master-demo
-AWS_REGION:=us-east-2
 AWS_FC_COMMAND=export AWS_PAGER=;aws cloudformation
 
 .PHONY: create-all delete-all \
 				cluster service dns-routing \
 				wait-for-cluster-creation wait-for-service-creation wait-for-dns-routing-creation \
-				wait-for-cluster-deletion wait-for-service-deletion wait-for-dns-routing-deletion
+				wait-for-cluster-deletion wait-for-service-deletion wait-for-dns-routing-deletion \
+				gerrit-build gerrit-publish
 
 create-all: cluster wait-for-cluster-creation \
 						service wait-for-service-creation \
@@ -34,7 +31,8 @@
 		--parameters \
 		ParameterKey=ClusterStackName,ParameterValue=$(CLUSTER_STACK_NAME) \
 		ParameterKey=HostedZoneName,ParameterValue=$(HOSTED_ZONE_NAME) \
-		ParameterKey=Subdomain,ParameterValue=$(SUBDOMAIN)
+		ParameterKey=Subdomain,ParameterValue=$(SUBDOMAIN) \
+		ParameterKey=DockerRegistryUrl,ParameterValue=$(DOCKER_REGISTRY_URI)
 
 dns-routing:
 	$(AWS_FC_COMMAND) create-stack \
@@ -105,3 +103,6 @@
 delete-all: delete-dns-routing wait-for-dns-routing-deletion \
 						delete-service wait-for-service-deletion \
 						delete-cluster wait-for-cluster-deletion \
+
+gerrit-publish:
+	$(MAKE) -C gerrit gerrit-publish
diff --git a/single-master/README.md b/single-master/README.md
index 7d3766d..c3453c8 100644
--- a/single-master/README.md
+++ b/single-master/README.md
@@ -23,6 +23,14 @@
 * 1 Internet Gateway
 * 1 type A alias DNS entry
 
+### Data persistency
+
+* EBS volumes for:
+  * Indexes
+  * Caches
+  * Data
+  * Git repositories
+
 ### Deployment type
 
 * Latest Gerrit version deployed using the official [Docker image](https://hub.docker.com/r/gerritcodereview/gerrit)
@@ -39,13 +47,78 @@
 
 ## How to run it
 
+### Setup
+
+The `setup.env.template` is an example of setup file for the creation of the stacks.
+
+Before creating the stacks, create a `setup.env` in the `Makefile` directory and
+correctly set the value of the environment variables.
+
+This is the list of available parameters:
+
+* `DOCKER_REGISTRY_URI`: Mandatory. URI of the Docker registry. See the
+  [prerequisites](#prerequisites) section for more details.
+* `CLUSTER_STACK_NAME`: Optional. Name of the cluster stack. `gerrit-cluster` by default.
+* `SERVICE_STACK_NAME`: Optional. Name of the service stack. `gerrit-service` by default.
+* `DNS_ROUTING_STACK_NAME`: Optional. Name of the DNS routing stack. `gerrit-dns-routing` by default.
+* `HOSTED_ZONE_NAME`: Optional. Name of the hosted zone. `mycompany.com` by default.
+* `SUBDOMAIN`: Optional. Name of the sub domain. `gerrit-master-demo` by default.
+
+### Prerequisites
+
+As a prerequisite to run this stack, you will need:
+* a registered and correctly configured domain in
+[Route53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.html)
+* to [publish the Docker image](#publish-custom-gerrit-docker-image) with your
+Gerrit configuration
+* to [add Gerrit secrets](#add-gerrit-secrets-in-aws-secret-manager) in AWS Secret
+Manager
+
+### Add Gerrit Secrets in AWS Secret Manager
+
+[AWS Secret Manager](https://aws.amazon.com/secrets-manager/) is a secure way of
+storing and managing secrets of any type.
+
+The secrets you will have to add are the Gerrit SSH keys and the Register Email
+Private Key set in `secure.config`.
+
+#### SSH Keys
+
+The SSH keys you will need to add are the one usually created and used by Gerrit:
+* ssh_host_ecdsa_384_key
+* ssh_host_ecdsa_384_key.pub
+* ssh_host_ecdsa_521_key
+* ssh_host_ecdsa_521_key.pub
+* ssh_host_ecdsa_key
+* ssh_host_ecdsa_key.pub
+* ssh_host_ed25519_key
+* ssh_host_ed25519_key.pub
+* ssh_host_rsa_key
+* ssh_host_rsa_key.pub
+
+You will have to create the keys and place them in a directory.
+
+#### Register Email Private Key
+
+You will need to create a secret and put it in a file called `registerEmailPrivateKey`
+in the same directory of the SSH keys.
+
+#### Import into AWS Secret Manager
+
+You can now run the script to upload them to AWS Secret Manager:
+`add_secrets_aws_secrets_manager.sh /path/to/your/keys/directory`
+
+### Publish custom Gerrit Docker image
+
+* Create the repository in the Docker registry:
+  `aws ecr create-repository --repository-name aws-gerrit/gerrit`
+* Set the Docker registry URI in `DOCKER_REGISTRY_URI`
+* Adjust the `gerrit.config` in `./gerrit/etc`
+* Add the plugins you want to install in `./gerrit/plugins`
+* Publish the image: `make gerrit-publish`
+
 ### Getting Started
 
-As a prerequisite to run this stack, you will need a registered and correctly
-configured domain in [Route53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.html).
-
-Once you will have it you can continue with the next steps:
-
 * Create a key pair to access the EC2 instances in the cluster:
 
 ```
@@ -69,30 +142,6 @@
 make delete-all
 ```
 
-### Stack parameters
-
-The above commands for the creation and deletion of the stacks use a set of default
-parameters which can be overridden as in the following example:
-
-```
-make create-all CLUSTER_STACK_NAME=my-cluster-stack SERVICE_STACK_NAME=my-service-stack
-```
-
-Keep in mind, that once you override a parameter in the creation of the stack,
-you will have to do the same in the deletion, i.e.:
-
-```
-make delete-all CLUSTER_STACK_NAME=my-cluster-stack SERVICE_STACK_NAME=my-service-stack
-```
-
-This is the list of the parameters:
-
-* `CLUSTER_STACK_NAME`: name of the cluster stack. `gerrit-cluster` by default.
-* `SERVICE_STACK_NAME`: name of the service stack. `gerrit-service` by default.
-* `DNS_ROUTING_STACK_NAME`: name of the DNS routing stack. `gerrit-dns-routing` by default.
-* `HOSTED_ZONE_NAME`: name of the hosted zone. `mycompany.com` by default.
-* `SUBDOMAIN`: name of the sub domain. `gerrit-master-demo` by default.
-
 ### Access your Gerrit
 
 You Gerrit instance will be available at this URL: `http://<HOSTED_ZONE_NAME>.<SUBDOMAIN>`.
diff --git a/single-master/add_secrets_aws_secrets_manager.sh b/single-master/add_secrets_aws_secrets_manager.sh
new file mode 100755
index 0000000..5917ced
--- /dev/null
+++ b/single-master/add_secrets_aws_secrets_manager.sh
@@ -0,0 +1,51 @@
+#!/bin/bash -e
+
+SECRETS_DIRECTORY=$1
+if [ -z "$SECRETS_DIRECTORY" ];
+then
+  echo "Secrets directory must be specified"
+  exit 1
+fi
+
+# Avoid to open output in less for each AWS command
+export AWS_PAGER=;
+KEY_PREFIX=gerrit_secret
+
+echo "Adding SSH Keys..."
+
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_384_key \
+    --description "Gerrit ssh_host_ecdsa_384_key" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_384_key
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_384_key.pub \
+    --description "Gerrit ssh_host_ecdsa_384_key.pub" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_384_key.pub
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_521_key \
+    --description "Gerrit ssh_host_ecdsa_521_key" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_521_key
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_521_key.pub \
+    --description "Gerrit ssh_host_ecdsa_521_key.pub" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_521_key.pub
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_key \
+    --description "Gerrit ssh_host_ecdsa_key" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_key
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ecdsa_key.pub \
+    --description "Gerrit ssh_host_ecdsa_key.pub" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ecdsa_key.pub
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ed25519_key \
+    --description "Gerrit ssh_host_ed25519_key" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ed25519_key
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_ed25519_key.pub \
+    --description "Gerrit ssh_host_ed25519_key.pub" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_ed25519_key.pub
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_rsa_key \
+    --description "Gerrit ssh_host_rsa_key" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_rsa_key
+aws secretsmanager create-secret --name ${KEY_PREFIX}_ssh_host_rsa_key.pub \
+    --description "Gerrit ssh_host_rsa_key.pub" \
+    --secret-string file://$SECRETS_DIRECTORY/ssh_host_rsa_key.pub
+
+echo "Adding Register Email Private Key..."
+
+aws secretsmanager create-secret --name ${KEY_PREFIX}_registerEmailPrivateKey \
+    --description "Gerrit Register Email Private Key" \
+    --secret-string file://$SECRETS_DIRECTORY/registerEmailPrivateKey
diff --git a/single-master/cf-service.yml b/single-master/cf-service.yml
index dec60ec..bfb20bb 100644
--- a/single-master/cf-service.yml
+++ b/single-master/cf-service.yml
@@ -15,7 +15,10 @@
   DockerImage:
         Description: Gerrit official Docker image
         Type: String
-        Default: gerritcodereview/gerrit:latest
+        Default: aws-gerrit/gerrit:latest
+  DockerRegistryUrl:
+        Description: Docker registry URL
+        Type: String
   DesiredCount:
         Description: How many instances of this task should we run across our cluster?
         Type: Number
@@ -35,6 +38,26 @@
         Description: The subdomain of the Gerrit cluster
         Type: String
         Default: gerrit-master-demo
+  GerritGitVolume:
+      Description: Gerrit git volume name
+      Type: String
+      Default: gerrit-git
+  GerritDataVolume:
+      Description: Gerrit data volume name
+      Type: String
+      Default: gerrit-data
+  GerritIndexVolume:
+      Description: Gerrit index volume name
+      Type: String
+      Default: gerrit-index
+  GerritCacheVolume:
+      Description: Gerrit cache volume name
+      Type: String
+      Default: gerrit-cache
+  GerritDbVolume:
+      Description: Gerrit db volume name
+      Type: String
+      Default: gerrit-db
 
 Resources:
     Service:
@@ -66,13 +89,23 @@
             ContainerDefinitions:
                 - Name: !Ref GerritServiceName
                   Essential: true
-                  Image: !Ref DockerImage
+                  Image: !Sub '${DockerRegistryUrl}/${DockerImage}'
                   Environment:
-                    - Name: "CANONICAL_WEB_URL"
+                    - Name: CANONICAL_WEB_URL
                       Value: !Join [ '', [ 'http://', !Ref 'Subdomain', '.', !Ref 'HostedZoneName' ] ]
-                  Environment:
-                    - Name: "region"
+                    - Name: AWS_REGION
                       Value: !Ref AWS::Region
+                  MountPoints:
+                    - SourceVolume: !Ref GerritGitVolume
+                      ContainerPath: /var/gerrit/git
+                    - SourceVolume: !Ref GerritDataVolume
+                      ContainerPath: /var/gerrit/data
+                    - SourceVolume: !Ref GerritIndexVolume
+                      ContainerPath: /var/gerrit/index
+                    - SourceVolume: !Ref GerritCacheVolume
+                      ContainerPath: /var/gerrit/cache
+                    - SourceVolume: !Ref GerritDbVolume
+                      ContainerPath: /var/gerrit/db
                   Cpu: 1024
                   Memory: 2048
                   PortMappings:
@@ -88,7 +121,42 @@
                         awslogs-group: !Ref AWS::StackName
                         awslogs-region: !Ref AWS::Region
                         awslogs-stream-prefix: !Ref EnvironmentName
-
+            Volumes:
+              - Name: !Ref 'GerritDbVolume'
+                DockerVolumeConfiguration:
+                  Scope: shared
+                  Autoprovision: true
+                  Driver: local
+                  Labels:
+                    gerrit-db: !Join ['-', [!Ref EnvironmentName, !Ref GerritDbVolume]]
+              - Name: !Ref 'GerritGitVolume'
+                DockerVolumeConfiguration:
+                  Scope: shared
+                  Autoprovision: true
+                  Driver: local
+                  Labels:
+                    gerrit-git: !Join ['-', [!Ref EnvironmentName, !Ref GerritGitVolume]]
+              - Name: !Ref 'GerritDataVolume'
+                DockerVolumeConfiguration:
+                  Scope: shared
+                  Autoprovision: true
+                  Driver: local
+                  Labels:
+                    gerrit-data: !Join ['-', [!Ref EnvironmentName, !Ref GerritDataVolume]]
+              - Name: !Ref 'GerritCacheVolume'
+                DockerVolumeConfiguration:
+                  Scope: shared
+                  Autoprovision: true
+                  Driver: local
+                  Labels:
+                    gerrit-cache: !Join ['-', [!Ref EnvironmentName, !Ref GerritCacheVolume]]
+              - Name: !Ref 'GerritIndexVolume'
+                DockerVolumeConfiguration:
+                  Scope: shared
+                  Autoprovision: true
+                  Driver: local
+                  Labels:
+                    gerrit-index: !Join ['-', [!Ref EnvironmentName, !Ref GerritIndexVolume]]
     CloudWatchLogsGroup:
         Type: AWS::Logs::LogGroup
         Properties:
@@ -175,6 +243,15 @@
                   - 'logs:CreateLogStream'
                   - 'logs:PutLogEvents'
                 Resource: '*'
+          - PolicyName: AmazonECSTaskSecretManagerRolePolicy
+            PolicyDocument:
+              Statement:
+              - Effect: Allow
+                Action:
+                  # Allow the ECS Tasks to get SSH Keys
+                  - 'secretsmanager:GetSecretValue'
+                  - 'kms:Decrypt'
+                Resource: '*'
 Outputs:
   PublicLoadBalancerDNSName:
     Description: The DNS name of the external load balancer
diff --git a/single-master/gerrit/Dockerfile b/single-master/gerrit/Dockerfile
new file mode 100644
index 0000000..7bbd4c7
--- /dev/null
+++ b/single-master/gerrit/Dockerfile
@@ -0,0 +1,28 @@
+FROM gerritcodereview/gerrit:latest
+
+USER root
+
+RUN yum install -y https://centos7.iuscommunity.org/ius-release.rpm \
+    && yum update -y \
+    && yum install -y python36u python36u-libs python36u-devel python36u-pip
+
+# Installing scripts to get SSH Keys from Secret Manager
+COPY --chown=gerrit:gerrit requirements.txt /tmp
+COPY --chown=gerrit:gerrit setup_gerrit.py /tmp
+RUN chmod +x /tmp/setup_gerrit.py \
+    && pip3 install -r /tmp/requirements.txt
+
+USER gerrit
+
+COPY --chown=gerrit:gerrit plugins /var/gerrit/plugins
+COPY --chown=gerrit:gerrit etc /var/gerrit/etc
+
+# Install AWS cli
+RUN pip3 install awscli --upgrade --user
+ENV PATH ${PATH}:/var/gerrit/.local/bin
+
+WORKDIR /var/gerrit
+
+COPY ./entrypoint.sh /bin
+
+ENTRYPOINT /bin/entrypoint.sh
diff --git a/single-master/gerrit/Makefile b/single-master/gerrit/Makefile
new file mode 100644
index 0000000..7f95951
--- /dev/null
+++ b/single-master/gerrit/Makefile
@@ -0,0 +1,12 @@
+include ../setup.env
+
+docker-registry-login:
+	aws ecr get-login-password --region $(AWS_REGION) \
+		| docker login --username AWS --password-stdin $(DOCKER_REGISTRY_URI)/aws-gerrit/gerrit
+
+gerrit-build:
+	docker build -t aws-gerrit/gerrit .
+	docker tag aws-gerrit/gerrit:latest $(DOCKER_REGISTRY_URI)/aws-gerrit/gerrit:latest
+
+gerrit-publish: docker-registry-login gerrit-build
+	docker push $(DOCKER_REGISTRY_URI)/aws-gerrit/gerrit:latest
diff --git a/single-master/gerrit/entrypoint.sh b/single-master/gerrit/entrypoint.sh
new file mode 100755
index 0000000..a442c20
--- /dev/null
+++ b/single-master/gerrit/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash -e
+
+if [ ! -d /var/gerrit/git/All-Projects.git ] || [ "$1" == "init" ]
+then
+  rm -fr /var/gerrit/plugins/*
+  echo "Initializing Gerrit site ..."
+  java -jar /var/gerrit/bin/gerrit.war init --batch --install-all-plugins -d /var/gerrit
+  java -jar /var/gerrit/bin/gerrit.war reindex -d /var/gerrit
+  git config -f /var/gerrit/etc/gerrit.config --add container.javaOptions "-Djava.security.egd=file:/dev/./urandom"
+fi
+
+git config -f /var/gerrit/etc/gerrit.config gerrit.canonicalWebUrl "${CANONICAL_WEB_URL:-http://$HOSTNAME}"
+git config -f /var/gerrit/etc/gerrit.config httpd.listenUrl "${HTTPD_LISTEN_URL:-http://*:8080/}"
+
+if [ "$1" != "init" ]
+then
+  /tmp/setup_gerrit.py
+  echo "Running Gerrit ..."
+  exec /var/gerrit/bin/gerrit.sh run
+fi
diff --git a/single-master/gerrit/etc/gerrit.config b/single-master/gerrit/etc/gerrit.config
new file mode 100644
index 0000000..23e4c2e
--- /dev/null
+++ b/single-master/gerrit/etc/gerrit.config
@@ -0,0 +1,32 @@
+[gerrit]
+	basePath = git
+	canonicalWebUrl = http://localhost
+	serverId = 0f56469f-dfe4-4f28-aca7-803eba7845e0
+[database]
+	type = h2
+	database = db/ReviewDB
+[index]
+	type = LUCENE
+[auth]
+	type = DEVELOPMENT_BECOME_ANY_ACCOUNT
+[sendemail]
+	smtpServer = localhost
+[sshd]
+	listenAddress = *:29418
+[httpd]
+	listenUrl = http://*:8080/
+	filterClass = com.googlesource.gerrit.plugins.ootb.FirstTimeRedirect
+	firstTimeRedirectUrl = /login/%23%2F?account_id=1000000
+[cache]
+	directory = cache
+[plugins]
+	allowRemoteAdmin = true
+[container]
+	javaOptions = "-Dflogger.backend_factory=com.google.common.flogger.backend.log4j.Log4jBackendFactory#getInstance"
+	javaOptions = "-Dflogger.logging_context=com.google.gerrit.server.logging.LoggingContext#getInstance"
+	user = gerrit
+	javaHome = /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.el7_7.x86_64/jre
+	javaOptions = -Djava.security.egd=file:/dev/./urandom
+	javaOptions = -Djava.security.egd=file:/dev/./urandom
+[receive]
+	enableSignedPush = false
diff --git a/single-master/gerrit/plugins/.empty b/single-master/gerrit/plugins/.empty
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/single-master/gerrit/plugins/.empty
diff --git a/single-master/gerrit/requirements.txt b/single-master/gerrit/requirements.txt
new file mode 100644
index 0000000..58ee30e
--- /dev/null
+++ b/single-master/gerrit/requirements.txt
@@ -0,0 +1,2 @@
+boto3
+jinja2==2.11.1
diff --git a/single-master/gerrit/setup_gerrit.py b/single-master/gerrit/setup_gerrit.py
new file mode 100755
index 0000000..0fc07e0
--- /dev/null
+++ b/single-master/gerrit/setup_gerrit.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+
+import boto3
+import base64
+import os
+from botocore.exceptions import ClientError
+from jinja2 import Environment, FileSystemLoader
+
+def get_secret(secret_name):
+
+    # Create a Secrets Manager client
+    session = boto3.session.Session()
+    client = session.client(
+        service_name='secretsmanager',
+        region_name=os.getenv('AWS_REGION')
+    )
+
+    try:
+        get_secret_value_response = client.get_secret_value(
+            SecretId=secret_name
+        )
+    except ClientError as e:
+        if e.response['Error']['Code'] == 'DecryptionFailureException':
+            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
+            # Deal with the exception here, and/or rethrow at your discretion.
+            raise e
+        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
+            # An error occurred on the server side.
+            # Deal with the exception here, and/or rethrow at your discretion.
+            raise e
+        elif e.response['Error']['Code'] == 'InvalidParameterException':
+            # You provided an invalid value for a parameter.
+            # Deal with the exception here, and/or rethrow at your discretion.
+            raise e
+        elif e.response['Error']['Code'] == 'InvalidRequestException':
+            # You provided a parameter value that is not valid for the current state of the resource.
+            # Deal with the exception here, and/or rethrow at your discretion.
+            raise e
+        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
+            # We can't find the resource that you asked for.
+            # Deal with the exception here, and/or rethrow at your discretion.
+            raise e
+    else:
+        # Decrypts secret using the associated KMS CMK.
+        # Depending on whether the secret is a string or binary, one of these fields will be populated.
+        if 'SecretString' in get_secret_value_response:
+            return get_secret_value_response['SecretString']
+        else:
+            return base64.b64decode(get_secret_value_response['SecretBinary'])
+
+secretIds = [
+    "ssh_host_ecdsa_384_key",
+    "ssh_host_ecdsa_384_key.pub",
+    "ssh_host_ecdsa_521_key",
+    "ssh_host_ecdsa_521_key.pub",
+    "ssh_host_ecdsa_key",
+    "ssh_host_ecdsa_key.pub",
+    "ssh_host_ed25519_key",
+    "ssh_host_ed25519_key.pub",
+    "ssh_host_rsa_key",
+    "ssh_host_rsa_key.pub"
+]
+
+GERRIT_KEY_PREFIX = "gerrit_secret_"
+GERRIT_SSH_SECRETS_DIRECTORY = "/var/gerrit/etc/"
+
+print("Installing SSH Keys from Secret Manager in directory: " + GERRIT_SSH_SECRETS_DIRECTORY)
+for secretId in secretIds:
+    print("* Installing SSH Key: " + secretId)
+    with open(GERRIT_SSH_SECRETS_DIRECTORY + secretId, 'w', encoding = 'utf-8') as f:
+        f.write(get_secret(GERRIT_KEY_PREFIX + secretId))
+
+print("Setting Register Email Private Key in '" + GERRIT_SSH_SECRETS_DIRECTORY + "secure.config'")
+file_loader = FileSystemLoader(GERRIT_SSH_SECRETS_DIRECTORY)
+env = Environment(loader=file_loader)
+template = env.get_template("secure.config.template")
+with open(GERRIT_SSH_SECRETS_DIRECTORY + "secure.config", 'w', encoding = 'utf-8') as f:
+    f.write(template.render(REGISTER_EMAIL_PRIVATE_KEY=get_secret(GERRIT_KEY_PREFIX + "registerEmailPrivateKey")))
diff --git a/single-master/setup.env.template b/single-master/setup.env.template
new file mode 100644
index 0000000..cb57a12
--- /dev/null
+++ b/single-master/setup.env.template
@@ -0,0 +1,7 @@
+CLUSTER_STACK_NAME:=gerrit-cluster
+SERVICE_STACK_NAME:=gerrit-service
+DNS_ROUTING_STACK_NAME:=gerrit-dns-routing
+HOSTED_ZONE_NAME:=mycompany.com
+SUBDOMAIN:=gerrit-master-demo
+AWS_REGION:=us-east-2
+DOCKER_REGISTRY_URI:=<your_aws_account_number>.dkr.ecr.us-east-2.amazonaws.com