diff --git a/services/terraform/remote/service_tunnelbroker.tf b/services/terraform/remote/service_tunnelbroker.tf
index eb660e58c..a74cd4ffb 100644
--- a/services/terraform/remote/service_tunnelbroker.tf
+++ b/services/terraform/remote/service_tunnelbroker.tf
@@ -1,302 +1,311 @@
 locals {
   tunnelbroker_config = {
     docker_image = "commapp/tunnelbroker"
     docker_tag   = local.is_staging ? "0.10-staging" : "0.9"
 
     grpc_port      = 50051
     websocket_port = 51001
     container_name = "tunnelbroker-server"
     domain_name    = "tunnelbroker.${local.root_domain}"
 
     local_dns_name = "tunnelbroker"
     grpc_port_name = "tunnelbroker_grpc"
   }
 
   # Used for other services to connect to Tunnelbroker gRPC endpoint
   tunnelbroker_local_grpc_url = "http://${local.tunnelbroker_config.local_dns_name}:${local.tunnelbroker_config.grpc_port}"
 
   # utility locals
   tunnelbroker_docker_image = "${local.tunnelbroker_config.docker_image}:${local.tunnelbroker_config.docker_tag}"
   rabbitmq_password         = local.secrets.amqpPassword[local.environment]
 
   apns_config_secret_name = "tunnelbroker/APNsConfig"
+  fcm_config_secret_name  = "tunnelbroker/FCMConfig"
 }
 
 data "aws_secretsmanager_secret" "tunnelbroker_apns" {
   name = local.apns_config_secret_name
 }
 
+data "aws_secretsmanager_secret" "tunnelbroker_fcm" {
+  name = local.fcm_config_secret_name
+}
+
 # RabbitMQ
 resource "aws_mq_broker" "tunnelbroker_rabbitmq" {
   broker_name = "tunnelbroker-rabbitmq"
 
   # Keep RabbitMQ version in sync with docker-compose.yml
   engine_type        = "RabbitMQ"
   engine_version     = "3.11.16"
   host_instance_type = local.is_staging ? "mq.t3.micro" : "mq.m5.large"
   apply_immediately  = local.is_staging
   deployment_mode    = "SINGLE_INSTANCE"
   # Access from outside VPC - this allows to access the RabbitMQ console from browser
   publicly_accessible = true
 
   user {
     username = "comm"
     password = local.rabbitmq_password
   }
 }
 locals {
   amqp_endpoint = aws_mq_broker.tunnelbroker_rabbitmq.instances[0].endpoints[0]
 }
 
 # Task definition - defines container resources, ports,
 # environment variables, docker image etc.
 resource "aws_ecs_task_definition" "tunnelbroker" {
   family = "tunnelbroker-task-def"
   container_definitions = jsonencode([
     {
       name      = local.tunnelbroker_config.container_name
       image     = local.tunnelbroker_docker_image
       essential = true
       portMappings = [
         {
           name          = "tunnelbroker_ws"
           containerPort = local.tunnelbroker_config.websocket_port
           protocol      = "tcp"
           appProtocol   = "http"
         },
         {
           name          = local.tunnelbroker_config.grpc_port_name
           containerPort = local.tunnelbroker_config.grpc_port
           protocol      = "tcp"
           appProtocol   = "grpc"
         }
       ]
       environment = [
         {
           name  = "RUST_LOG"
           value = local.is_staging ? "info,tunnelbroker=debug,comm_lib=debug" : "info"
         },
         {
           name  = "AMQP_URI",
           value = local.amqp_endpoint
         },
         {
           name  = "AMQP_USERNAME"
           value = "comm"
         },
         {
           name  = "AMQP_PASSWORD"
           value = nonsensitive(local.rabbitmq_password)
         },
         {
           name  = "COMM_TUNNELBROKER_IDENTITY_ENDPOINT",
           value = local.identity_local_url
         }
       ]
       secrets = [
         {
           name      = "APNS_CONFIG"
           valueFrom = data.aws_secretsmanager_secret.tunnelbroker_apns.arn
+        },
+        {
+          name      = "FCM_CONFIG"
+          valueFrom = data.aws_secretsmanager_secret.tunnelbroker_fcm.arn
         }
       ]
       logConfiguration = {
         "logDriver" = "awslogs"
         "options" = {
           "awslogs-create-group"  = "true"
           "awslogs-group"         = "/ecs/tunnelbroker-task-def"
           "awslogs-region"        = "us-east-2"
           "awslogs-stream-prefix" = "ecs"
         }
       }
     }
   ])
   task_role_arn            = aws_iam_role.services_ddb_full_access.arn
   execution_role_arn       = aws_iam_role.ecs_task_execution.arn
   network_mode             = "bridge"
   cpu                      = "256"
   memory                   = "256"
   requires_compatibilities = ["EC2"]
 
   # Set this to true if you want to keep old revisions
   # when this definition is changed
   skip_destroy = true
 }
 
 # ECS Service - defines task scaling, load balancer connection,
 # network configuration etc.
 resource "aws_ecs_service" "tunnelbroker" {
   name        = "tunnelbroker"
   cluster     = aws_ecs_cluster.comm_services.id
   launch_type = "EC2"
 
   task_definition      = aws_ecs_task_definition.tunnelbroker.arn
   force_new_deployment = true
 
   desired_count = 1
   # Allow external changes without Terraform plan difference
   # We can freely specify replica count in AWS Console
   lifecycle {
     ignore_changes = [desired_count]
   }
 
   service_connect_configuration {
     enabled = true
     service {
       discovery_name = local.tunnelbroker_config.local_dns_name
       port_name      = local.tunnelbroker_config.grpc_port_name
       client_alias {
         port     = local.tunnelbroker_config.grpc_port
         dns_name = local.tunnelbroker_config.local_dns_name
       }
     }
   }
 
   # Websocket
   load_balancer {
     target_group_arn = aws_lb_target_group.tunnelbroker_ws.arn
     container_name   = local.tunnelbroker_config.container_name
     container_port   = local.tunnelbroker_config.websocket_port
   }
 
   # gRPC
   load_balancer {
     target_group_arn = aws_lb_target_group.tunnelbroker_grpc.arn
     container_name   = local.tunnelbroker_config.container_name
     container_port   = local.tunnelbroker_config.grpc_port
   }
 
   deployment_circuit_breaker {
     enable   = true
     rollback = true
   }
 }
 
 # Security group to configure access to the service
 resource "aws_security_group" "tunnelbroker" {
   name   = "tunnelbroker-sg"
   vpc_id = aws_vpc.default.id
 
   # Websocket
   ingress {
     from_port   = local.tunnelbroker_config.websocket_port
     to_port     = local.tunnelbroker_config.websocket_port
     protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
     description = "Websocket port"
   }
 
   # gRPC
   ingress {
     from_port   = local.tunnelbroker_config.grpc_port
     to_port     = local.tunnelbroker_config.grpc_port
     protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
     description = "gRPC port"
   }
 
   # Allow all outbound traffic
   egress {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
 
   lifecycle {
     create_before_destroy = true
   }
 }
 
 # Running service instances are registered here
 # to be accessed by the load balancer
 resource "aws_lb_target_group" "tunnelbroker_ws" {
   name             = "tunnelbroker-ws-tg"
   port             = local.tunnelbroker_config.websocket_port
   protocol         = "HTTP"
   protocol_version = "HTTP1"
   vpc_id           = aws_vpc.default.id
   target_type      = "instance"
 
   health_check {
     enabled             = true
     healthy_threshold   = 2
     unhealthy_threshold = 3
 
     protocol = "HTTP"
     path     = "/health"
     matcher  = "200"
 
   }
 }
 resource "aws_lb_target_group" "tunnelbroker_grpc" {
   name             = "tunnelbroker-grpc-tg"
   port             = local.tunnelbroker_config.grpc_port
   protocol         = "HTTP"
   protocol_version = "GRPC"
   vpc_id           = aws_vpc.default.id
   target_type      = "instance"
 
   health_check {
     enabled             = true
     healthy_threshold   = 2
     unhealthy_threshold = 3
   }
 }
 
 # Load Balancer
 resource "aws_lb" "tunnelbroker" {
   load_balancer_type = "application"
   name               = "tunnelbroker-lb"
   internal           = false
   subnets = [
     aws_subnet.public_a.id,
     aws_subnet.public_b.id,
     aws_subnet.public_c.id,
   ]
 }
 
 resource "aws_lb_listener" "tunnelbroker_ws" {
   load_balancer_arn = aws_lb.tunnelbroker.arn
   port              = local.tunnelbroker_config.websocket_port
   protocol          = "HTTPS"
   ssl_policy        = "ELBSecurityPolicy-2016-08"
   certificate_arn   = data.aws_acm_certificate.tunnelbroker.arn
 
   default_action {
     type             = "forward"
     target_group_arn = aws_lb_target_group.tunnelbroker_ws.arn
   }
 
   lifecycle {
     ignore_changes       = [default_action[0].forward[0].stickiness[0].duration]
     replace_triggered_by = [aws_lb_target_group.tunnelbroker_ws]
   }
 }
 
 resource "aws_lb_listener" "tunnelbroker_grpc" {
   load_balancer_arn = aws_lb.tunnelbroker.arn
   port              = local.tunnelbroker_config.grpc_port
   protocol          = "HTTPS"
   ssl_policy        = "ELBSecurityPolicy-2016-08"
   certificate_arn   = data.aws_acm_certificate.tunnelbroker.arn
 
   default_action {
     type             = "forward"
     target_group_arn = aws_lb_target_group.tunnelbroker_grpc.arn
   }
 
   lifecycle {
     ignore_changes       = [default_action[0].forward[0].stickiness[0].duration]
     replace_triggered_by = [aws_lb_target_group.tunnelbroker_grpc]
   }
 }
 
 # SSL Certificate
 data "aws_acm_certificate" "tunnelbroker" {
   domain   = local.tunnelbroker_config.domain_name
   statuses = ["ISSUED"]
 }
 
 output "rabbitmq_console_url" {
   value = aws_mq_broker.tunnelbroker_rabbitmq.instances[0].console_url
 }
diff --git a/services/tunnelbroker/src/constants.rs b/services/tunnelbroker/src/constants.rs
index 3ef744b61..146f572bf 100644
--- a/services/tunnelbroker/src/constants.rs
+++ b/services/tunnelbroker/src/constants.rs
@@ -1,52 +1,53 @@
 use tokio::time::Duration;
 
 pub const GRPC_TX_QUEUE_SIZE: usize = 32;
 pub const GRPC_SERVER_PORT: u16 = 50051;
 pub const GRPC_KEEP_ALIVE_PING_INTERVAL: Duration = Duration::from_secs(3);
 pub const GRPC_KEEP_ALIVE_PING_TIMEOUT: Duration = Duration::from_secs(10);
 
 pub const SOCKET_HEARTBEAT_TIMEOUT: Duration = Duration::from_secs(3);
 
 pub const MAX_RMQ_MSG_PRIORITY: u8 = 10;
 pub const DDB_RMQ_MSG_PRIORITY: u8 = 10;
 pub const CLIENT_RMQ_MSG_PRIORITY: u8 = 1;
 pub const RMQ_CONSUMER_TAG: &str = "tunnelbroker";
 pub const ENV_APNS_CONFIG: &str = "APNS_CONFIG";
+pub const ENV_FCM_CONFIG: &str = "FCM_CONFIG";
 pub const LOG_LEVEL_ENV_VAR: &str =
   tracing_subscriber::filter::EnvFilter::DEFAULT_ENV;
 
 pub mod dynamodb {
   // This table holds messages which could not be immediately delivered to
   // a device.
   //
   // - (primary key) = (deviceID: Partition Key, createdAt: Sort Key)
   // - deviceID: The public key of a device's olm identity key
   // - payload: Message to be delivered. See shared/tunnelbroker_messages.
   // - messageID = [createdAt]#[clientMessageID]
   //    - createdAd:  UNIX timestamp of when the item was inserted.
   //      Timestamp is needed to order the messages correctly to the device.
   //      Timestamp format is ISO 8601 to handle lexicographical sorting.
   //    - clientMessageID: Message ID generated on client using UUID Version 4.
   pub mod undelivered_messages {
     pub const TABLE_NAME: &str = "tunnelbroker-undelivered-messages";
     pub const PARTITION_KEY: &str = "deviceID";
     pub const DEVICE_ID: &str = "deviceID";
     pub const PAYLOAD: &str = "payload";
     pub const MESSAGE_ID: &str = "messageID";
     pub const SORT_KEY: &str = "messageID";
   }
 
   // This table holds a device token associated with a device.
   //
   // - (primary key) = (deviceID: Partition Key)
   // - deviceID: The public key of a device's olm identity key
   // - deviceToken: Token to push services uploaded by device.
   pub mod device_tokens {
     pub const TABLE_NAME: &str = "tunnelbroker-device-tokens";
     pub const PARTITION_KEY: &str = "deviceID";
     pub const DEVICE_ID: &str = "deviceID";
     pub const DEVICE_TOKEN: &str = "deviceToken";
 
     pub const DEVICE_TOKEN_INDEX_NAME: &str = "deviceToken-index";
   }
 }