diff --git a/playbooks/roles/os_heat/defaults/main.yml b/playbooks/roles/os_heat/defaults/main.yml
index 81f72dc08d..128f81e42d 100644
--- a/playbooks/roles/os_heat/defaults/main.yml
+++ b/playbooks/roles/os_heat/defaults/main.yml
@@ -169,3 +169,11 @@ heat_service_names:
   - heat-api-cfn
   - heat-api-cloudwatch
   - heat-engine
+
+## Tunable overrides
+heat_heat_conf_overrides: {}
+heat_api_paste_ini_overrides: {}
+heat_default_yaml_overrides: {}
+heat_aws_cloudwatch_alarm_yaml_overrides: {}
+heat_aws_rds_dbinstance_yaml_overrides: {}
+heat_policy_overrides: {}
diff --git a/playbooks/roles/os_heat/tasks/heat_post_install.yml b/playbooks/roles/os_heat/tasks/heat_post_install.yml
index 7a9986a462..f6a80a3e6b 100644
--- a/playbooks/roles/os_heat/tasks/heat_post_install.yml
+++ b/playbooks/roles/os_heat/tasks/heat_post_install.yml
@@ -13,44 +13,40 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Generate heat Config
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: "{{ heat_system_user_name }}"
-    group: "{{ heat_system_group_name }}"
-  with_items:
-    - { src: "heat.conf.j2", dest: "/etc/heat/heat.conf" }
-    - { src: "api-paste.ini.j2", dest: "/etc/heat/api-paste.ini" }
-  notify:
-    - Restart heat services
-  tags:
-    - heat-config
-
-- name: Drop heat Configs
-  copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: "{{ heat_system_user_name }}"
-    group: "{{ heat_system_group_name }}"
-  with_items:
-    - { src: "environment.d/default.yaml", dest: "/etc/heat/environment.d/default.yaml" }
-    - { src: "templates/AWS_CloudWatch_Alarm.yaml", dest: "/etc/heat/templates/AWS_CloudWatch_Alarm.yaml" }
-    - { src: "templates/AWS_RDS_DBInstance.yaml", dest: "/etc/heat/templates/AWS_RDS_DBInstance.yaml" }
-  notify:
-    - Restart heat services
-  tags:
-    - heat-config
-
-- name: Apply updates to Policy file
+- name: Drop heat Config(s)
   config_template:
-    src: "policy.json"
-    dest: "/etc/heat/policy.json"
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
     owner: "{{ heat_system_user_name }}"
     group: "{{ heat_system_group_name }}"
     mode: "0644"
-    config_overrides: "{{ heat_policy_overrides|default({}) }}"
-    config_type: "json"
+    config_overrides: "{{ item.config_overrides }}"
+    config_type: "{{ item.config_type }}"
+  with_items:
+    - src: "heat.conf.j2"
+      dest: "/etc/heat/heat.conf"
+      config_overrides: "{{ heat_heat_conf_overrides }}"
+      config_type: "ini"
+    - src: "api-paste.ini.j2"
+      dest: "/etc/heat/api-paste.ini"
+      config_overrides: "{{ heat_api_paste_ini_overrides }}"
+      config_type: "ini"
+    - src: "environment.d/default.yaml.j2"
+      dest: "/etc/heat/environment.d/default.yaml"
+      config_overrides: "{{ heat_default_yaml_overrides }}"
+      config_type: "yaml"
+    - src: "templates/AWS_CloudWatch_Alarm.yaml.j2"
+      dest: "/etc/heat/templates/AWS_CloudWatch_Alarm.yaml"
+      config_overrides: "{{ heat_aws_cloudwatch_alarm_yaml_overrides }}"
+      config_type: "yaml"
+    - src: "templates/AWS_RDS_DBInstance.yaml.j2"
+      dest: "/etc/heat/templates/AWS_RDS_DBInstance.yaml"
+      config_overrides: "{{ heat_aws_rds_dbinstance_yaml_overrides }}"
+      config_type: "yaml"
+    - src: "policy.json.j2"
+      dest: "/etc/heat/policy.json"
+      config_overrides: "{{ heat_policy_overrides }}"
+      config_type: "json"
   notify:
     - Restart heat services
   tags:
diff --git a/playbooks/roles/os_heat/files/environment.d/default.yaml b/playbooks/roles/os_heat/templates/environment.d/default.yaml.j2
similarity index 100%
rename from playbooks/roles/os_heat/files/environment.d/default.yaml
rename to playbooks/roles/os_heat/templates/environment.d/default.yaml.j2
diff --git a/playbooks/roles/os_heat/templates/policy.json b/playbooks/roles/os_heat/templates/policy.json.j2
similarity index 100%
rename from playbooks/roles/os_heat/templates/policy.json
rename to playbooks/roles/os_heat/templates/policy.json.j2
diff --git a/playbooks/roles/os_heat/files/templates/AWS_CloudWatch_Alarm.yaml b/playbooks/roles/os_heat/templates/templates/AWS_CloudWatch_Alarm.yaml.j2
similarity index 100%
rename from playbooks/roles/os_heat/files/templates/AWS_CloudWatch_Alarm.yaml
rename to playbooks/roles/os_heat/templates/templates/AWS_CloudWatch_Alarm.yaml.j2
diff --git a/playbooks/roles/os_heat/files/templates/AWS_RDS_DBInstance.yaml b/playbooks/roles/os_heat/templates/templates/AWS_RDS_DBInstance.yaml.j2
similarity index 100%
rename from playbooks/roles/os_heat/files/templates/AWS_RDS_DBInstance.yaml
rename to playbooks/roles/os_heat/templates/templates/AWS_RDS_DBInstance.yaml.j2