diff --git a/.github/actions/combine-dependabot-prs/action.yaml b/.github/actions/combine-dependabot-prs/action.yaml
deleted file mode 100644
index 6029ec9c..00000000
--- a/.github/actions/combine-dependabot-prs/action.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: "Combine Dependabot PRs"
-description: "Combine open dependency PRs into a single branch and PR"
-inputs:
-  labels:
-    description: "Label used to select PRs"
-    required: false
-    default: "dependencies"
-  pr_title:
-    description: "Combined pull request title"
-    required: false
-    default: "CCM-9336: Combined Dependabot PRs"
-  combine_branch_name:
-    description: "Branch used for the combined pull request"
-    required: false
-    default: "dependabotCombined"
-  pr_body_header:
-    description: "Header text used at the top of the combined pull request body"
-    required: false
-    default: "CCM-9336: Combined Dependabot PRs"
-runs:
-  using: "composite"
-  steps:
-    - name: "Combine pull requests"
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        INPUT_LABEL: ${{ inputs.labels }}
-        INPUT_PR_TITLE: ${{ inputs.pr_title }}
-        INPUT_COMBINE_BRANCH: ${{ inputs.combine_branch_name }}
-        INPUT_PR_BODY_HEADER: ${{ inputs.pr_body_header }}
-      with:
-        script: |
-          const path = require("node:path");
-          const run = require(path.join(process.env.GITHUB_ACTION_PATH, "combine-dependabot-prs.js"));
-
-          await run({
-            github,
-            context,
-            core,
-            inputs: {
-              label: process.env.INPUT_LABEL,
-              prTitle: process.env.INPUT_PR_TITLE,
-              combineBranch: process.env.INPUT_COMBINE_BRANCH,
-              prBodyHeader: process.env.INPUT_PR_BODY_HEADER,
-            },
-          });
diff --git a/.github/actions/combine-dependabot-prs/combine-dependabot-prs.js b/.github/actions/combine-dependabot-prs/combine-dependabot-prs.js
deleted file mode 100644
index 60bb073a..00000000
--- a/.github/actions/combine-dependabot-prs/combine-dependabot-prs.js
+++ /dev/null
@@ -1,111 +0,0 @@
-module.exports = async ({ github, context, core, inputs }) => {
-  const owner = context.repo.owner;
-  const repo = context.repo.repo;
-  const baseBranch = "main";
-  const combineBranch = inputs.combineBranch;
-  const prTitle = inputs.prTitle;
-  const prBodyHeader = inputs.prBodyHeader;
-  const requiredLabel = (inputs.label || "dependencies").trim();
-
-  const allOpenPrs = await github.paginate(github.rest.pulls.list, {
-    owner,
-    repo,
-    state: "open",
-    per_page: 100,
-  });
-
-  const dependencyPrs = allOpenPrs
-    .filter((pr) => pr.labels.some((label) => label.name === requiredLabel))
-    .sort((a, b) => a.number - b.number);
-
-  if (dependencyPrs.length === 0) {
-    core.info("No open dependency PRs found; nothing to combine.");
-    return;
-  }
-
-  const { data: baseRef } = await github.rest.git.getRef({
-    owner,
-    repo,
-    ref: `heads/${baseBranch}`,
-  });
-
-  const baseSha = baseRef.object.sha;
-
-  try {
-    await github.rest.git.getRef({
-      owner,
-      repo,
-      ref: `heads/${combineBranch}`,
-    });
-
-    await github.rest.git.updateRef({
-      owner,
-      repo,
-      ref: `heads/${combineBranch}`,
-      sha: baseSha,
-      force: true,
-    });
-  } catch (error) {
-    if (error.status !== 404) {
-      throw error;
-    }
-
-    await github.rest.git.createRef({
-      owner,
-      repo,
-      ref: `refs/heads/${combineBranch}`,
-      sha: baseSha,
-    });
-  }
-
-  for (const pr of dependencyPrs) {
-    try {
-      await github.rest.repos.merge({
-        owner,
-        repo,
-        base: combineBranch,
-        head: pr.head.sha,
-        commit_message: `Merge #${pr.number} into ${combineBranch}`,
-      });
-      core.info(`Merged PR #${pr.number} (${pr.head.ref}) into ${combineBranch}`);
-    } catch (error) {
-      core.setFailed(
-        `Failed to merge PR #${pr.number} (${pr.head.ref}) into ${combineBranch}: ${error.message}`,
-      );
-      throw error;
-    }
-  }
-
-  const includedPrLines = dependencyPrs.map((pr) => `- #${pr.number}`).join("\n");
-  const prBody = `${prBodyHeader}\n\nIncluded PRs:\n${includedPrLines}`;
-
-  const existingCombinedPr = allOpenPrs.find(
-    (pr) =>
-      pr.base.ref === baseBranch &&
-      pr.head.ref === combineBranch &&
-      pr.user?.login !== "dependabot[bot]",
-  );
-
-  if (existingCombinedPr) {
-    await github.rest.pulls.update({
-      owner,
-      repo,
-      pull_number: existingCombinedPr.number,
-      title: prTitle,
-      body: prBody,
-    });
-    core.info(`Updated existing combined PR #${existingCombinedPr.number}`);
-    return;
-  }
-
-  const { data: newPr } = await github.rest.pulls.create({
-    owner,
-    repo,
-    title: prTitle,
-    head: combineBranch,
-    base: baseBranch,
-    body: prBody,
-  });
-
-  core.info(`Created combined PR #${newPr.number}`);
-};
diff --git a/infrastructure/terraform/modules/aws-backup-source/kms.tf b/infrastructure/terraform/modules/aws-backup-source/kms.tf
index a700ef20..dd5a5bf3 100644
--- a/infrastructure/terraform/modules/aws-backup-source/kms.tf
+++ b/infrastructure/terraform/modules/aws-backup-source/kms.tf
@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "backup_key_policy" {
     sid = "EnableIAMUserPermissions"
     principals {
       type        = "AWS"
-      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", data.aws_caller_identity.current.arn]
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", "arn:aws:sts::${data.aws_caller_identity.current.account_id}:assumed-role/GitHub_Deploy/*"]
     }
     actions   = ["kms:*"]
     resources = ["*"]
diff --git a/infrastructure/terraform/modules/s3bucket/locals.tf b/infrastructure/terraform/modules/s3bucket/locals.tf
index 40117994..373b8e33 100644
--- a/infrastructure/terraform/modules/s3bucket/locals.tf
+++ b/infrastructure/terraform/modules/s3bucket/locals.tf
@@ -39,8 +39,8 @@ locals {
   lifecycle_rules = [for lifecycle_rule in var.lifecycle_rules : merge(local.lifecycle_rule_defaults, lifecycle_rule)]
 
   notification_event_defaults = {
-    eventbridge = false
-
+    # Check for value of tag in lower case, compare to string "true" and if true, enable eventbridge notifications
+    eventbridge     = lower(lookup(var.default_tags, "NHSE-Enable-S3-Backup-Acct", "")) == "true"
     lambda_function = {}
     queue           = {}
     topic           = {}