diff --git a/Makefile b/Makefile
index d0a559275..6884c678b 100644
--- a/Makefile
+++ b/Makefile
@@ -70,9 +70,17 @@ build-codedeploy-artifact: ## Build the deploy artifact for CodeDeploy
 	mkdir -p target
 	zip -r -x@deploy-exclude.lst target/notifications-api.zip *
 
+	rm -rf build/db-migration-codedeploy
+	mkdir -p build/db-migration-codedeploy
+	unzip target/notifications-api.zip -d build/db-migration-codedeploy
+	cd build/db-migration-codedeploy && \
+		mv -f appspec-db-migration.yml appspec.yml && \
+		zip -r -x@deploy-exclude.lst ../../target/notifications-api-db-migration.zip *
+
 .PHONY: upload-codedeploy-artifact ## Upload the deploy artifact for CodeDeploy
 upload-codedeploy-artifact: check-env-vars
 	aws s3 cp --region eu-west-1 target/notifications-api.zip s3://${DNS_NAME}-codedeploy/notifications-api-${DEPLOY_BUILD_NUMBER}.zip
+	aws s3 cp --region eu-west-1 target/notifications-api-db-migration.zip s3://${DNS_NAME}-codedeploy/notifications-api-db-migration-${DEPLOY_BUILD_NUMBER}.zip
 
 .PHONY: test
 test: venv generate-version-file ## Run tests
@@ -82,6 +90,10 @@ test: venv generate-version-file ## Run tests
 deploy-api: check-env-vars ## Trigger CodeDeploy for the api
 	aws deploy create-deployment --application-name notify-api --deployment-config-name CodeDeployDefault.OneAtATime --deployment-group-name notify-api --s3-location bucket=${DNS_NAME}-codedeploy,key=notifications-api-${DEPLOY_BUILD_NUMBER}.zip,bundleType=zip --region eu-west-1
 
+.PHONY: deploy-api
+deploy-api-db-migration: check-env-vars ## Trigger CodeDeploy for the api db migration
+	aws deploy create-deployment --application-name notify-api-db-migration --deployment-config-name CodeDeployDefault.OneAtATime --deployment-group-name notify-api-db-migration --s3-location bucket=${DNS_NAME}-codedeploy,key=notifications-api-db-migration-${DEPLOY_BUILD_NUMBER}.zip,bundleType=zip --region eu-west-1
+
 .PHONY: deploy-admin-api
 deploy-admin-api: check-env-vars ## Trigger CodeDeploy for the admin api
 	aws deploy create-deployment --application-name notify-admin-api --deployment-config-name CodeDeployDefault.OneAtATime --deployment-group-name notify-admin-api --s3-location bucket=${DNS_NAME}-codedeploy,key=notifications-api-${DEPLOY_BUILD_NUMBER}.zip,bundleType=zip --region eu-west-1
@@ -155,4 +167,4 @@ clean-docker-containers: ## Clean up any remaining docker containers
 	docker rm -f $(shell docker ps -q -f "name=${DOCKER_CONTAINER_PREFIX}") 2> /dev/null || true
 
 clean:
-	rm -rf node_modules cache target venv .coverage
+	rm -rf node_modules cache target venv .coverage build tests/.cache
diff --git a/appspec-db-migration.yml b/appspec-db-migration.yml
new file mode 100644
index 000000000..b840f4432
--- /dev/null
+++ b/appspec-db-migration.yml
@@ -0,0 +1,18 @@
+---
+os: linux
+version: 0.0
+files:
+  - destination: /home/notify-app/notifications-api
+    source: /
+hooks:
+  AfterInstall:
+    - location: scripts/aws_install_dependencies.sh
+      runas: root
+      timeout: 1000
+    - location: scripts/aws_change_ownership.sh
+      runas: root
+      timeout: 300
+  ApplicationStart:
+    - location: scripts/aws_run_db_migrations.sh
+      runas: root
+      timeout: 300
diff --git a/appspec.yml b/appspec.yml
index 77f7ed385..a6455d55c 100644
--- a/appspec.yml
+++ b/appspec.yml
@@ -1,35 +1,28 @@
 ---
+os: linux
+version: 0.0
 files:
-  -
-    destination: /home/notify-app/notifications-api
+  - destination: /home/notify-app/notifications-api
     source: /
 hooks:
   AfterInstall:
-    -
-      location: scripts/aws_install_dependencies.sh
+    - location: scripts/aws_install_dependencies.sh
       runas: root
       timeout: 1000
-    -
-      location: scripts/aws_change_ownership.sh
+    - location: scripts/aws_change_ownership.sh
       runas: root
       timeout: 300
   ApplicationStart:
-    -
-      location: scripts/aws_start_app.sh
+    - location: scripts/aws_start_app.sh
       runas: root
       timeout: 300
-    -
-      location: scripts/register_with_elb.sh
+    - location: scripts/register_with_elb.sh
       runas: ubuntu
       timeout: 300
   ApplicationStop:
-    -
-      location: scripts/deregister_from_elb.sh
+    - location: scripts/deregister_from_elb.sh
       runas: ubuntu
       timeout: 300
-    -
-      location: scripts/aws_stop_app.sh
+    - location: scripts/aws_stop_app.sh
       runas: root
       timeout: 300
-os: linux
-version: 0.0
diff --git a/deploy-exclude.lst b/deploy-exclude.lst
index 5eaf61748..aea0bc983 100644
--- a/deploy-exclude.lst
+++ b/deploy-exclude.lst
@@ -7,3 +7,6 @@
 *node_modules*
 *target*
 *venv*
+*build*
+*.envrc*
+*tests/.cache*
diff --git a/notifications-api.zip b/notifications-api.zip
deleted file mode 100644
index 83298c812..000000000
Binary files a/notifications-api.zip and /dev/null differ
diff --git a/scripts/aws_change_ownership.sh b/scripts/aws_change_ownership.sh
index 09d3d80cf..ad0d438a7 100755
--- a/scripts/aws_change_ownership.sh
+++ b/scripts/aws_change_ownership.sh
@@ -1,13 +1,8 @@
 #!/bin/bash
 
+set -eo pipefail
 
-if [ -e "/home/notify-app" ]
-then
- 	echo "Chown application to be owned by notify-app"
-	cd /home/notify-app/;
-	chown -R notify-app:govuk-notify-applications notifications-api
-else
-	echo "Chown application to be owned by ubuntu"
-	cd /home/ubuntu/;
-	chown -R ubuntu:ubuntu notifications-api
-fi
\ No newline at end of file
+echo "Chown application to be owned by notify-app"
+
+cd /home/notify-app/;
+chown -R notify-app:govuk-notify-applications notifications-api
diff --git a/scripts/aws_install_dependencies.sh b/scripts/aws_install_dependencies.sh
index f7cb975f6..b82881d45 100755
--- a/scripts/aws_install_dependencies.sh
+++ b/scripts/aws_install_dependencies.sh
@@ -1,15 +1,8 @@
+#!/bin/bash
+
+set -eo pipefail
+
 echo "Install dependencies"
 
-
-if [ -e "/home/notify-app" ]
-then
- 	echo "Depenencies for notify-app"
-	cd /home/notify-app/notifications-api;
-	pip3 install -r /home/notify-app/notifications-api/requirements.txt
-	python3 db.py db upgrade
-else
- 	echo "Depenencies for ubuntu"
-	cd /home/ubuntu/notifications-api;
-	pip3 install -r /home/ubuntu/notifications-api/requirements.txt
-	python3 db.py db upgrade
-fi
\ No newline at end of file
+cd /home/notify-app/notifications-api;
+pip3 install -r /home/notify-app/notifications-api/requirements.txt
diff --git a/scripts/aws_run_db_migrations.sh b/scripts/aws_run_db_migrations.sh
new file mode 100755
index 000000000..9667839d5
--- /dev/null
+++ b/scripts/aws_run_db_migrations.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+echo "Run database migrations"
+
+cd /home/notify-app/notifications-api;
+python3 db.py db upgrade
diff --git a/scripts/aws_start_app.sh b/scripts/aws_start_app.sh
index 47f7103ba..9e871ebc2 100755
--- a/scripts/aws_start_app.sh
+++ b/scripts/aws_start_app.sh
@@ -1,31 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-if [ -e "/etc/init/notifications-api.conf" ]
-then
-  echo "Starting api"
-  sudo service notifications-api start
-fi
+set -eo pipefail
 
-if [ -e "/etc/init/notifications-api-celery-worker.conf" ]
-then
-  echo "Starting celery worker"
-  sudo service notifications-api-celery-worker start
-fi
+function start
+{
+  service=$1
+  if [ -e "/etc/init/${service}.conf" ]
+  then
+    echo "Starting ${service}"
+    service ${service} start
+  fi
+}
 
-if [ -e "/etc/init/notifications-api-celery-worker-sender.conf" ]
-then
-  echo "Starting celery worker"
-  sudo service notifications-api-celery-worker-sender start
-fi
-
-if [ -e "/etc/init/notifications-api-celery-worker-db.conf" ]
-then
-  echo "Starting celery worker"
-  sudo service notifications-api-celery-worker-db start
-fi
-
-if [ -e "/etc/init/notifications-api-celery-beat.conf" ]
-then
-  echo "Starting celery beat"
-  sudo service notifications-api-celery-beat start
-fi
+start "notifications-api"
+start "notifications-api-celery-worker"
+start "notifications-api-celery-worker-sender"
+start "notifications-api-celery-worker-db"
+start "notifications-api-celery-beat"
diff --git a/scripts/aws_stop_app.sh b/scripts/aws_stop_app.sh
index 3f9735d4b..f3c3a441a 100755
--- a/scripts/aws_stop_app.sh
+++ b/scripts/aws_stop_app.sh
@@ -1,53 +1,22 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
+set -eo pipefail
 
-function error_exit
+function stop
 {
-	echo "$1" 1>&2
-	exit 0
+  service=$1
+  if [ -e "/etc/init/${service}.conf" ]; then
+    echo "stopping ${service}"
+    if service ${service} stop; then
+      echo "${service} stopped"
+    else
+      >&2 echo "Could not stop ${service}"
+    fi
+  fi
 }
 
-if [ -e "/etc/init/notifications-api.conf" ]; then
-    echo "stopping notifications-api"
-    if sudo service notifications-api stop; then
-        echo "notifications-api stopped"
-    else
-        error_exit "Could not stop notifications-api"
-    fi
-fi
-
-if [ -e "/etc/init/notifications-api-celery-beat.conf" ]; then
-    echo "stopping notifications-api-celery-beat"
-    if sudo service notifications-api-celery-beat stop; then
-        echo "notifications-api beat stopped"
-    else
-        error_exit "Could not stop notifications-celery-beat"
-    fi
-fi
-
-if [ -e "/etc/init/notifications-api-celery-worker.conf" ]; then
-    echo "stopping notifications-api-celery-worker"
-    if sudo service notifications-api-celery-worker stop; then
-        echo "notifications-api worker stopped"
-    else
-        error_exit "Could not stop notifications-celery-worker"
-    fi
-fi
-
-if [ -e "/etc/init/notifications-api-celery-worker-sender.conf" ]; then
-    echo "stopping notifications-api-celery-worker-sender"
-    if sudo service notifications-api-celery-worker-sender stop; then
-        echo "notifications-api sender worker stopped"
-    else
-        error_exit "Could not stop notifications-celery-worker-sender"
-    fi
-fi
-
-if [ -e "/etc/init/notifications-api-celery-worker-db.conf" ]; then
-    echo "stopping notifications-api-celery-worker-db"
-    if sudo service notifications-api-celery-worker-db stop; then
-        echo "notifications-api db worker stopped"
-    else
-        error_exit "Could not stop notifications-celery-worker-db"
-    fi
-fi
+stop "notifications-api"
+stop "notifications-api-celery-beat"
+stop "notifications-api-celery-worker"
+stop "notifications-api-celery-worker-sender"
+stop "notifications-api-celery-worker-db"