diff --git a/services/terraform/remote/main.tf b/services/terraform/remote/main.tf
--- a/services/terraform/remote/main.tf
+++ b/services/terraform/remote/main.tf
@@ -16,7 +16,9 @@
 
 locals {
   environment = terraform.workspace
-  secrets     = jsondecode(data.sops_file.secrets_json.raw)
+  is_staging  = local.environment == "staging"
+
+  secrets = jsondecode(data.sops_file.secrets_json.raw)
 
   target_account_id  = lookup(local.secrets.accountIDs, local.environment)
   terraform_role_arn = "arn:aws:iam::${local.target_account_id}:role/Terraform"
diff --git a/services/terraform/remote/service_blob.tf b/services/terraform/remote/service_blob.tf
--- a/services/terraform/remote/service_blob.tf
+++ b/services/terraform/remote/service_blob.tf
@@ -195,9 +195,12 @@
       }
 
       # Legacy EC2 Target
-      target_group {
-        arn    = data.aws_lb_target_group.blob_service_legacy_ec2.arn
-        weight = 0
+      dynamic "target_group" {
+        for_each = data.aws_lb_target_group.blob_service_legacy_ec2
+        content {
+          arn    = target_group.value["arn"]
+          weight = 0
+        }
       }
     }
   }
@@ -237,7 +240,9 @@
 
 # Legacy EC2 instance target
 data "aws_lb_target_group" "blob_service_legacy_ec2" {
-  name = "blob-service-http-tg"
+  # We don't have legacy EC2 services in staging
+  count = local.is_staging ? 0 : 1
+  name  = "blob-service-http-tg"
 }
 
 # Required for Route53 DNS record
diff --git a/services/terraform/remote/service_electron_update.tf b/services/terraform/remote/service_electron_update.tf
--- a/services/terraform/remote/service_electron_update.tf
+++ b/services/terraform/remote/service_electron_update.tf
@@ -165,9 +165,12 @@
       }
 
       # Legacy EC2 Target
-      target_group {
-        arn    = data.aws_lb_target_group.electron_update_legacy_ec2.arn
-        weight = 0
+      dynamic "target_group" {
+        for_each = data.aws_lb_target_group.electron_update_legacy_ec2
+        content {
+          arn    = target_group.value["arn"]
+          weight = 0
+        }
       }
     }
   }
@@ -186,7 +189,9 @@
 
 # Legacy EC2 instance target
 data "aws_lb_target_group" "electron_update_legacy_ec2" {
-  name = "electron-update-tg"
+  # We don't have legacy EC2 services in staging
+  count = local.is_staging ? 0 : 1
+  name  = "electron-update-tg"
 }
 
 # Required for Route53 DNS record
diff --git a/services/terraform/remote/service_feature_flags.tf b/services/terraform/remote/service_feature_flags.tf
--- a/services/terraform/remote/service_feature_flags.tf
+++ b/services/terraform/remote/service_feature_flags.tf
@@ -173,9 +173,12 @@
       }
 
       # Legacy EC2 Target
-      target_group {
-        arn    = data.aws_lb_target_group.feature_flags_legacy_ec2.arn
-        weight = 0
+      dynamic "target_group" {
+        for_each = data.aws_lb_target_group.feature_flags_legacy_ec2
+        content {
+          arn    = target_group.value["arn"]
+          weight = 0
+        }
       }
     }
   }
@@ -194,7 +197,9 @@
 
 # Legacy EC2 instance target
 data "aws_lb_target_group" "feature_flags_legacy_ec2" {
-  name = "feature-flags-service-tg"
+  # We don't have legacy EC2 services in staging
+  count = local.is_staging ? 0 : 1
+  name  = "feature-flags-service-tg"
 }
 
 # Required for Route53 DNS record
diff --git a/services/terraform/remote/service_identity.tf b/services/terraform/remote/service_identity.tf
--- a/services/terraform/remote/service_identity.tf
+++ b/services/terraform/remote/service_identity.tf
@@ -172,9 +172,12 @@
         weight = 1
       }
       # Legacy EC2 Target
-      target_group {
-        arn    = data.aws_lb_target_group.identity_service_legacy_ec2.arn
-        weight = 0
+      dynamic "target_group" {
+        for_each = data.aws_lb_target_group.identity_service_legacy_ec2
+        content {
+          arn    = target_group.value["arn"]
+          weight = 0
+        }
       }
     }
   }
@@ -196,7 +199,9 @@
 
 # Legacy EC2 instance target
 data "aws_lb_target_group" "identity_service_legacy_ec2" {
-  name = "identity-service-tg"
+  # We don't have legacy EC2 services in staging
+  count = local.is_staging ? 0 : 1
+  name  = "identity-service-tg"
 }
 
 # Required for Route53 DNS record