diff --git a/docs/pages/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx b/docs/pages/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
index fa60093e599..0c82da06946 100644
--- a/docs/pages/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
+++ b/docs/pages/deploy-a-cluster/deployments/aws-ha-autoscale-cluster-terraform.mdx
@@ -350,6 +350,22 @@ This setting should always be used unless you have a specific need to use separa
 
 For the simplest, cheapest deployment, enable both ACM and TLS routing to funnel all traffic through a single Application Load Balancer with an AWS-managed certificate.
 
+### teleport_auth_type
+
+```code
+$ export TF_VAR_teleport_auth_type="local"
+```
+
+This value can be used to change the default authentication type used for the Teleport cluster. This is useful for persisting a
+default authentication type across AMI upgrades when you have a SAML, OIDC or GitHub connector configured in DynamoDB.
+The default is `local`.
+
+- Teleport Community Edition supports `local` or `github`
+- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml`
+- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml`
+
+See the [Teleport authentication reference](../../reference/authentication.mdx) for more information.
+
 ## Reference deployment defaults
 
 ### Instances
diff --git a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
index 05d02cd375a..297db08e246 100644
--- a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
+++ b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx
@@ -363,6 +363,21 @@ This setting should always be used unless you have a specific need to use separa
 
 When using this `starter-cluster` deployment, if ACM is enabled, TLS routing will automatically be enabled too.
 
+### teleport_auth_type
+
+```code
+$ export TF_VAR_teleport_auth_type="local"
+```
+
+This value can be used to change the default authentication type used for the Teleport cluster. This is useful for persisting a
+default authentication type across AMI upgrades when you have a SAML, OIDC or GitHub connector configured in DynamoDB.
+The default is `local`.
+
+- Teleport Community Edition supports `local` or `github`
+- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml`
+- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml`
+
+See the [Teleport authentication reference](../../reference/authentication.mdx) for more information.
 
 ## Reference deployment defaults
 
diff --git a/examples/aws/terraform/ha-autoscale-cluster/Makefile b/examples/aws/terraform/ha-autoscale-cluster/Makefile
index 0b07616e54c..b29688680ee 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/Makefile
+++ b/examples/aws/terraform/ha-autoscale-cluster/Makefile
@@ -64,6 +64,15 @@ TF_VAR_use_acm ?= false
 # - you must use `tsh proxy` commands for Kubernetes/database access
 TF_VAR_use_tls_routing ?= false
 
+# (optional) Change the default authentication type used for the Teleport cluster.
+# See https://goteleport.com/docs/reference/authentication for more information.
+# This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+# or GitHub connector configured in DynamoDB. The default if not set is "local".
+# Teleport Community Edition supports "local" or "github"
+# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+TF_VAR_teleport_auth_type ?= "local"
+
 export
 
 # Plan launches terraform plan
diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md
index 83d98918349..3b7bc39fa1b 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/README.md
+++ b/examples/aws/terraform/ha-autoscale-cluster/README.md
@@ -107,6 +107,15 @@ export TF_VAR_email="support@example.com"
 # Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install
 export TF_VAR_grafana_pass="CHANGE_THIS_VALUE"
 
+# This value can be used to change the default authentication type used for the Teleport cluster.
+# See https://goteleport.com/docs/reference/authentication for more information.
+# This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+# or GitHub connector configured in DynamoDB. The default is "local".
+# Teleport Community Edition supports "local" or "github"
+# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+export TF_VAR_teleport_auth_type="local"
+
 # plan
 make plan
 ```
diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl
index 3c1c82003ca..107966e6f97 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl
+++ b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl
@@ -3,6 +3,7 @@ cat >/etc/teleport.d/conf <<EOF
 TELEPORT_ROLE=auth
 EC2_REGION=${region}
 TELEPORT_AUTH_SERVER_LB=${auth_server_addr}
+TELEPORT_AUTH_TYPE=${teleport_auth_type}
 TELEPORT_CLUSTER_NAME=${cluster_name}
 TELEPORT_DOMAIN_ADMIN_EMAIL=${email}
 TELEPORT_DOMAIN_NAME=${domain_name}
diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf
index 6a3df77d8af..b12f9540697 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf
+++ b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf
@@ -57,6 +57,7 @@ resource "aws_launch_template" "auth" {
       region                   = var.region
       locks_table_name         = aws_dynamodb_table.locks.name
       auth_server_addr         = aws_lb.auth.dns_name
+      teleport_auth_type       = var.teleport_auth_type
       cluster_name             = var.cluster_name
       dynamo_table_name        = aws_dynamodb_table.teleport.name
       dynamo_events_table_name = aws_dynamodb_table.teleport_events.name
diff --git a/examples/aws/terraform/ha-autoscale-cluster/vars.tf b/examples/aws/terraform/ha-autoscale-cluster/vars.tf
index 35622a476b6..1dcf5785461 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/vars.tf
+++ b/examples/aws/terraform/ha-autoscale-cluster/vars.tf
@@ -268,3 +268,15 @@ variable "route53_domain_acm_nlb_alias" {
   type    = string
   default = ""
 }
+
+// (optional) Change the default authentication type used for the Teleport cluster.
+// See https://goteleport.com/docs/reference/authentication for more information.
+// This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+// or GitHub connector configured in DynamoDB. The default if not set is "local".
+// Teleport Community Edition supports "local" or "github"
+// Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+variable "teleport_auth_type" {
+  type    = string
+  default = "local"
+}
diff --git a/examples/aws/terraform/starter-cluster/Makefile b/examples/aws/terraform/starter-cluster/Makefile
index dc78ffbc346..78cc6f8d7aa 100644
--- a/examples/aws/terraform/starter-cluster/Makefile
+++ b/examples/aws/terraform/starter-cluster/Makefile
@@ -71,6 +71,15 @@ TF_VAR_use_acm ?= false
 # and will be ignored.
 TF_VAR_use_tls_routing ?= true
 
+# (optional) Change the default authentication type used for the Teleport cluster.
+# See https://goteleport.com/docs/reference/authentication for more information.
+# This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+# or GitHub connector configured in DynamoDB. The default if not set is "local".
+# Teleport Community Edition supports "local" or "github"
+# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+TF_VAR_teleport_auth_type ?= "local"
+
 export
 
 # Plan launches terraform plan
diff --git a/examples/aws/terraform/starter-cluster/README.md b/examples/aws/terraform/starter-cluster/README.md
index b2b9add7c60..a391829aca4 100644
--- a/examples/aws/terraform/starter-cluster/README.md
+++ b/examples/aws/terraform/starter-cluster/README.md
@@ -150,6 +150,15 @@ export TF_VAR_use_acm="false"
 # and will be ignored.
 export TF_VAR_use_tls_routing="true"
 
+# This value can be used to change the default authentication type used for the Teleport cluster.
+# See https://goteleport.com/docs/reference/authentication for more information.
+# This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+# or GitHub connector configured in DynamoDB. The default is "local".
+# Teleport Community Edition supports "local" or "github"
+# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+export TF_VAR_teleport_auth_type="local"
+
 # plan
 make plan
 ```
diff --git a/examples/aws/terraform/starter-cluster/cluster.tf b/examples/aws/terraform/starter-cluster/cluster.tf
index b2b507c9fa4..a54fb635104 100644
--- a/examples/aws/terraform/starter-cluster/cluster.tf
+++ b/examples/aws/terraform/starter-cluster/cluster.tf
@@ -12,6 +12,7 @@ resource "aws_instance" "cluster" {
     "data.tpl",
     {
       region                   = var.region
+      teleport_auth_type       = var.teleport_auth_type
       cluster_name             = var.cluster_name
       email                    = var.email
       domain_name              = var.route53_domain
diff --git a/examples/aws/terraform/starter-cluster/data.tpl b/examples/aws/terraform/starter-cluster/data.tpl
index 39352ffe2e7..d5577b67b4d 100644
--- a/examples/aws/terraform/starter-cluster/data.tpl
+++ b/examples/aws/terraform/starter-cluster/data.tpl
@@ -3,6 +3,7 @@ cat >/etc/teleport.d/conf <<EOF
 TELEPORT_ROLE=auth,node,proxy
 EC2_REGION=${region}
 TELEPORT_AUTH_SERVER_LB=localhost
+TELEPORT_AUTH_TYPE=${teleport_auth_type}
 TELEPORT_CLUSTER_NAME=${cluster_name}
 TELEPORT_DOMAIN_ADMIN_EMAIL=${email}
 TELEPORT_DOMAIN_NAME=${domain_name}
diff --git a/examples/aws/terraform/starter-cluster/vars.tf b/examples/aws/terraform/starter-cluster/vars.tf
index 2a6bd4613cc..40df9a5504a 100644
--- a/examples/aws/terraform/starter-cluster/vars.tf
+++ b/examples/aws/terraform/starter-cluster/vars.tf
@@ -121,3 +121,15 @@ variable "kms_alias_name" {
 variable "cluster_instance_type" {
   type = string
 }
+
+// (optional) Change the default authentication type used for the Teleport cluster.
+// See https://goteleport.com/docs/reference/authentication for more information.
+// This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC
+// or GitHub connector configured in DynamoDB. The default if not set is "local".
+// Teleport Community Edition supports "local" or "github"
+// Teleport Enterprise Edition supports "local", "github", "oidc" or "saml"
+// Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml"
+variable "teleport_auth_type" {
+  type    = string
+  default = "local"
+}