diff --git a/build-support-windows/Dockerfile-consul-local-windows b/build-support-windows/Dockerfile-consul-local-windows
new file mode 100644
index 000000000000..7d7d6847217c
--- /dev/null
+++ b/build-support-windows/Dockerfile-consul-local-windows
@@ -0,0 +1,45 @@
+ARG ENVOY_VERSION=v1.23.0
+ARG CONSUL_IMAGE_VERSION=latest
+
+FROM envoyproxy/envoy-windows:${ENVOY_VERSION} as envoy
+FROM windows/consul:${CONSUL_IMAGE_VERSION}
+COPY dist/ C:\\consul
+
+# Fortio binary downloaded
+RUN mkdir fortio
+ENV FORTIO_URL=https://github.com/fortio/fortio/releases/download/v1.33.0/fortio_win_1.33.0.zip
+RUN curl %FORTIO_URL% -L -o fortio.zip
+RUN tar -xf fortio.zip -C fortio
+
+# Copy envoy.exe from FROM envoyproxy/envoy-windows:${ENVOY_VERSION}
+COPY --from=envoy ["C:/Program Files/envoy/", "C:/envoy/"]
+
+RUN choco install openssl -yf
+RUN choco install jq -yf
+
+# Install Bats
+ENV BATS_URL=https://github.com/bats-core/bats-core/archive/refs/tags/v1.7.0.zip
+RUN curl %BATS_URL% -L -o bats.zip
+RUN mkdir bats-core
+RUN tar -xf bats.zip -C bats-core --strip-components=1
+RUN cd "C:\\Program Files\\Git\\bin" && bash.exe -c "/c/bats-core/install.sh /c/bats"
+
+# Install Jaeger
+ENV JAEGER_URL=https://github.com/jaegertracing/jaeger/releases/download/v1.11.0/jaeger-1.11.0-windows-amd64.tar.gz
+RUN curl %JAEGER_URL% -L -o jaeger.tar.gz
+RUN mkdir jaeger
+RUN tar -xf jaeger.tar.gz -C jaeger --strip-components=1
+
+# Copy test-sds-server binary and certs
+COPY --from=test-sds-server ["C:/go/src/", "C:/test-sds-server/"]
+
+EXPOSE 8300
+EXPOSE 8301 8301/udp 8302 8302/udp
+EXPOSE 8500 8600 8600/udp
+EXPOSE 8502 
+
+EXPOSE 19000 19001 19002 19003 19004
+EXPOSE 21000 21001 21002 21003 21004
+EXPOSE 5000 1234 2345
+
+RUN SETX /M path "%PATH%;C:\consul;C:\envoy;C:\fortio;C:\jaeger;C:\Program Files\Git\bin;C:\Program Files\OpenSSL-Win64\bin;C:\bats\bin\bats;C:\ProgramData\chocolatey\lib\jq\tools;"
diff --git a/build-support-windows/Dockerfile-consul-local-windows.sh b/build-support-windows/Dockerfile-consul-local-windows.sh
new file mode 100644
index 000000000000..6e26b7d078a5
--- /dev/null
+++ b/build-support-windows/Dockerfile-consul-local-windows.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+cd ../
+rm -rf dist
+
+export GOOS=windows GOARCH=amd64
+CONSUL_VERSION=1.12.0
+CONSUL_BUILDDATE=$(date +"%Y-%m-%dT%H:%M:%SZ")
+GIT_IMPORT=github.com/hashicorp/consul/version
+GOLDFLAGS=" -X $GIT_IMPORT.Version=$CONSUL_VERSION -X $GIT_IMPORT.VersionPrerelease=local -X $GIT_IMPORT.BuildDate=$CONSUL_BUILDDATE "
+
+go build -ldflags "$GOLDFLAGS" -o ./dist/ .
+
+docker build -t windows/consul:local -f ./build-support-windows/Dockerfile-consul-local-windows .
diff --git a/execute_windows_tests.sh b/execute_windows_tests.sh
new file mode 100644
index 000000000000..c47f554f0816
--- /dev/null
+++ b/execute_windows_tests.sh
@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+
+echo "Started tests from Set $1"
+
+mkdir output -p
+
+if [ $1 == 0 ]
+then
+
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-badauthz" -win=true > output/case-badauthz.txt
+    echo "Completed  33%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-basic" -win=true > output/case-basic.txt
+    echo "Completed  66%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-centralconf" -win=true > output/case-centralconf.txt
+    echo "Completed  100%"
+
+elif [ $1 == 1 ]
+then
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-consul-exec" -win=true > output/case-consul-exec.txt
+    echo "Completed  20%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-expose-checks" -win=true > output/case-expose-checks.txt
+    echo "Completed  40%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-I7-intentions" -win=true > output/case-I7-intentions.txt
+    echo "Completed  60%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-prometheus" -win=true > output/case-prometheus.txt
+    echo "Completed  80%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-upstream-config" -win=true > output/case-upstream-config.txt
+    echo "Completed  100%"
+
+elif [ $1 == 2 ]
+then
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-zipkin" -win=true > output/case-zipkin.txt
+    echo "Completed  10%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-defaultsubset" -win=true > output/case-cfg-resolver-defaultsubset.txt
+    echo "Completed  20%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-features" -win=true > output/case-cfg-resolver-features.txt
+    echo "Completed  30%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-subset-onlypassing" -win=true > output/case-cfg-resolver-subset-onlypassing.txt
+    echo "Completed  40%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-subset-redirect" -win=true > output/case-cfg-resolver-subset-redirect.txt
+    echo "Completed  50%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-failover" -win=true > output/case-cfg-resolver-svc-failover.txt
+    echo "Completed  60%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-redirect-http" -win=true > output/case-cfg-resolver-svc-redirect-http.txt
+    echo "Completed  70%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-redirect-tcp" -win=true > output/case-cfg-resolver-svc-redirect-tcp.txt
+    echo "Completed  80%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-router-features" -win=true > output/case-cfg-router-features.txt
+    echo "Completed  90%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-splitter-features" -win=true > output/case-cfg-splitter-features.txt
+    echo "Completed  100%"
+
+elif [ $1 == 3 ]
+then
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-grpc" -win=true > output/case-ingress-gateway-grpc.txt
+    echo "Completed  16%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-http" -win=true > output/case-ingress-gateway-http.txt
+    echo "Completed  32%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-multiple-services" -win=true > output/case-ingress-gateway-multiple-services.txt
+    echo "Completed  48%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-sds" -win=true > output/case-ingress-gateway-sds.txt
+    echo "Completed  66%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-simple" -win=true > output/case-ingress-gateway-simple.txt
+    echo "Completed  83%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-tls" -win=true > output/case-ingress-gateway-tls.txt
+    echo "Completed  100%"
+
+elif [ $1 == 4 ]
+then
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-gateway-without-services" -win=true > output/case-gateway-without-services.txt
+    echo "Completed  20%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-hostnames" -win=true > output/case-terminating-gateway-hostnames.txt
+    echo "Completed  40%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-simple" -win=true > output/case-terminating-gateway-simple.txt
+    echo "Completed  60%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-subsets" -win=true > output/case-terminating-gateway-subsets.txt
+    echo "Completed  80%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-without-services" -win=true > output/case-terminating-gateway-without-services.txt
+    echo "Completed  100%"
+
+elif [ $1 == 5 ]
+then
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-dogstatsd-udp" -win=true > output/case-dogstatsd-udp.txt
+    echo "Completed  16%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-grpc" -win=true > output/case-grpc.txt
+    echo "Completed  32%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-http" -win=true > output/case-http.txt
+    echo "Completed  48%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-http-badauthz" -win=true > output/case-http-badauthz.txt
+    echo "Completed  66%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-statsd-udp" -win=true > output/case-statsd-udp.txt
+    echo "Completed  83%"
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-stats-proxy" -win=true > output/case-stats-proxy.txt
+    echo "Completed  100%"
+else
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-badauthz" -win=true > output/case-badauthz.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-basic" -win=true > output/case-basic.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-centralconf" -win=true > output/case-centralconf.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-consul-exec" -win=true > output/case-consul-exec.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-expose-checks" -win=true > output/case-expose-checks.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-l7-intentions" -win=true > output/case-l7-intentions.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-prometheus" -win=true > output/case-prometheus.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-upstream-config" -win=true > output/case-upstream-config.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-zipkin" -win=true > output/case-zipkin.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-defaultsubset" -win=true > output/case-cfg-resolver-defaultsubset.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-features" -win=true > output/case-cfg-resolver-features.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-subset-onlypassing" -win=true > output/case-cfg-resolver-subset-onlypassing.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-subset-redirect" -win=true > output/case-cfg-resolver-subset-redirect.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-failover" -win=true > output/case-cfg-resolver-svc-failover.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-redirect-http" -win=true > output/case-cfg-resolver-svc-redirect-http.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-resolver-svc-redirect-tcp" -win=true > output/case-cfg-resolver-svc-redirect-tcp.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-router-features" -win=true > output/case-cfg-router-features.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-cfg-splitter-features" -win=true > output/case-cfg-splitter-features.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-grpc" -win=true > output/case-ingress-gateway-grpc.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-http" -win=true > output/case-ingress-gateway-http.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-multiple-services" -win=true > output/case-ingress-gateway-multiple-services.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-sds" -win=true > output/case-ingress-gateway-sds.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-simple" -win=true > output/case-ingress-gateway-simple.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-ingress-gateway-tls" -win=true > output/case-ingress-gateway-tls.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-gateway-without-services" -win=true > output/case-gateway-without-services.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-hostnames" -win=true > output/case-terminating-gateway-hostnames.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-simple" -win=true > output/case-terminating-gateway-simple.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-subsets" -win=true > output/case-terminating-gateway-subsets.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-terminating-gateway-without-services" -win=true > output/case-terminating-gateway-without-services.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-dogstatsd-udp" -win=true > output/case-dogstatsd-udp.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-grpc" -win=true > output/case-grpc.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-http" -win=true > output/case-http.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-http-badauthz" -win=true > output/case-http-badauthz.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-statsd-udp" -win=true > output/case-statsd-udp.txt
+    go test -v -timeout=30m -tags integration ./test/integration/connect/envoy -run="TestEnvoy/case-stats-proxy" -win=true > output/case-stats-proxy.txt
+    echo "Completed  100%"
+fi
+
+echo "Completed tests from Set $1"
diff --git a/test/integration/connect/envoy/helpers.windows.bash b/test/integration/connect/envoy/helpers.windows.bash
index 847b9c81395a..edb4aec08834 100644
--- a/test/integration/connect/envoy/helpers.windows.bash
+++ b/test/integration/connect/envoy/helpers.windows.bash
@@ -1,4 +1,5 @@
 #!/bin/bash
+
 # retry based on
 # https://github.com/fernandoacorreia/azure-docker-registry/blob/master/tools/scripts/create-registry-server
 # under MIT license.
@@ -109,7 +110,7 @@ function get_cert {
   if [ -n "$SERVER_NAME" ]; then
     SNI_FLAG="-servername $SERVER_NAME"
   fi
-  CERT=$(openssl s_client -connect $HOSTPORT $SNI_FLAG -showcerts </dev/null)  
+  CERT=$(openssl s_client -connect $HOSTPORT $SNI_FLAG -showcerts </dev/null)
   openssl x509 -noout -text <<< "$CERT"
 }
 
@@ -119,6 +120,7 @@ function assert_proxy_presents_cert_uri {
   local DC=${3:-primary}
   local NS=${4:-default}
   local PARTITION=${5:default}
+
   CERT=$(retry_default get_cert $HOSTPORT)
 
   echo "WANT SERVICE: ${PARTITION}/${NS}/${SERVICENAME}"
@@ -167,8 +169,7 @@ function assert_cert_signed_by_ca {
 
 function assert_envoy_version {
   local ADMINPORT=$1
-  local HOSTPORT="localhost:$ADMINPORT"    
-  run retry_default curl -f -s $HOSTPORT/server_info
+  run retry_default curl -f -s localhost:$ADMINPORT/server_info
   [ "$status" -eq 0 ]
   # Envoy 1.8.0 returns a plain text line like
   # envoy 5d25f466c3410c0dfa735d7d4358beb76b2da507/1.8.0/Clean/DEBUG live 3 3 0
@@ -198,7 +199,6 @@ function assert_envoy_version {
 }
 
 function assert_envoy_expose_checks_listener_count {
-  check_hostport $1
   local HOSTPORT=$1
   local EXPECT_PATH=$2
 
@@ -568,13 +568,14 @@ function assert_intention_denied {
 function docker_consul {
   local DC=$1
   shift 1
-  docker.exe run -i --rm --network envoy-tests windows/consul-dev "$@"
+  docker.exe run -i --rm --network envoy-tests windows/consul:local "$@"
 }
 
 function docker_consul_for_proxy_bootstrap {
   local DC=$1
   shift 1
-  docker.exe run -i --rm --network envoy-tests windows/consul-dev "$@"
+
+  docker.exe run -i --rm --network envoy-tests windows/consul:local "$@"
 }
 
 function docker_wget {
@@ -586,7 +587,7 @@ function docker_wget {
 function docker_curl {
   local DC=$1
   shift 1
-  docker.exe run --rm --network envoy-tests --entrypoint curl.exe windows/consul-dev "$@"
+  docker.exe run --rm --network envoy-tests --entrypoint curl.exe windows/consul:local "$@"
 }
 
 function docker_exec {
@@ -654,8 +655,7 @@ function must_match_in_stats_proxy_response {
 # Envoy rather than a connection-level error.
 function must_fail_tcp_connection {
   # Attempt to curl through upstream
-  local HOSTPORT=$1
-  run curl --no-keepalive -s -v -f -d hello $HOSTPORT
+  run curl --no-keepalive -s -v -f -d hello $1
 
   echo "OUTPUT $output"
 
@@ -678,9 +678,8 @@ function must_pass_tcp_connection {
 # must_fail_http_connection see must_fail_tcp_connection but this expects Envoy
 # to generate a 503 response since the upstreams have refused connection.
 function must_fail_http_connection {
-  local HOSTPORT=$1
   # Attempt to curl through upstream
-  run curl --no-keepalive -s -i -d hello "$HOSTPORT"
+  run curl --no-keepalive -s -i -d hello "$1"
 
   echo "OUTPUT $output"
 
@@ -778,7 +777,6 @@ function gen_envoy_bootstrap {
     -grpc-addr envoy_consul-${DC}_1:8502 \
     -admin-access-log-path="C:/envoy/envoy.log" \
     -admin-bind 127.0.0.1:$ADMIN_PORT ${EXTRA_ENVOY_BS_ARGS}); then
-    
     # All OK, write config to file
     echo "$output" > workdir/${DC}/envoy/$SERVICE-bootstrap.json
   else
@@ -794,6 +792,7 @@ function read_config_entry {
   local KIND=$1
   local NAME=$2
   local DC=${3:-primary}
+
   docker_consul "$DC" config read -kind $KIND -name $NAME -http-addr="consul-$DC:8500"
 }
 
@@ -815,9 +814,16 @@ function delete_config_entry {
 
 function register_services {
   local DC=${1:-primary}
+  wait_for_leader "$DC"
   docker_consul_exec ${DC} bash -c "consul services register workdir/${DC}/register/service_*.hcl"
 }
 
+# wait_for_leader waits until a leader is elected.
+# Its first argument must be the datacenter name.
+function wait_for_leader {
+  retry_default docker_consul_exec "$1" sh -c '[[ $(curl --fail -sS http://consul-primary:8500/v1/status/leader) ]]'
+}
+
 function setup_upsert_l4_intention {
   local SOURCE=$1
   local DESTINATION=$2
@@ -975,3 +981,55 @@ function create_peering {
   # echo "$output" >&3
   [ "$status" == 0 ]
 }
+
+function get_lambda_envoy_http_filter {
+  local HOSTPORT=$1
+  local NAME_PREFIX=$2
+  run retry_default curl -s -f $HOSTPORT/config_dump
+  [ "$status" -eq 0 ]
+  # get the full http filter object so the individual fields can be validated.
+  echo "$output" | jq --raw-output ".configs[2].dynamic_listeners[] | .active_state.listener.filter_chains[].filters[] | select(.name == \"envoy.filters.network.http_connection_manager\") | .typed_config.http_filters[] | select(.name == \"envoy.filters.http.aws_lambda\") | .typed_config"
+}
+
+function register_lambdas {
+  local DC=${1:-primary}
+  # register lambdas to the catalog
+  for f in $(find workdir/${DC}/register -type f -name 'lambda_*.json'); do
+    retry_default curl -sL -XPUT -d @${f} "http://localhost:8500/v1/catalog/register" >/dev/null && \
+      echo "Registered Lambda: $(jq -r .Service.Service $f)"
+  done
+  # write service-defaults config entries for lambdas
+  for f in $(find workdir/${DC}/register -type f -name 'service_defaults_*.json'); do
+    varsub ${f} AWS_LAMBDA_REGION AWS_LAMBDA_ARN
+    retry_default curl -sL -XPUT -d @${f} "http://localhost:8500/v1/config" >/dev/null && \
+      echo "Wrote config: $(jq -r '.Kind + " / " + .Name' $f)"
+  done
+}
+
+function assert_lambda_envoy_dynamic_cluster_exists {
+  local HOSTPORT=$1
+  local NAME_PREFIX=$2
+
+  local BODY=$(get_envoy_dynamic_cluster_once $HOSTPORT $NAME_PREFIX)
+  [ -n "$BODY" ]
+
+  [ "$(echo $BODY | jq -r '.cluster.transport_socket.typed_config.sni')" == '*.amazonaws.com' ]
+}
+
+function assert_lambda_envoy_dynamic_http_filter_exists {
+  local HOSTPORT=$1
+  local NAME_PREFIX=$2
+  local ARN=$3
+
+  local FILTER=$(get_lambda_envoy_http_filter $HOSTPORT $NAME_PREFIX)
+  [ -n "$FILTER" ]
+
+  [ "$(echo $FILTER | jq -r '.arn')" == "$ARN" ]
+}
+
+function varsub {
+  local file=$1 ; shift
+  for v in "$@"; do
+    sed -i "s/\${$v}/${!v}/g" $file
+  done
+}
diff --git a/test/integration/connect/envoy/run-tests.windows.sh b/test/integration/connect/envoy/run-tests.windows.sh
index c7f5739f8f8f..004d8d365c19 100644
--- a/test/integration/connect/envoy/run-tests.windows.sh
+++ b/test/integration/connect/envoy/run-tests.windows.sh
@@ -17,7 +17,7 @@ DEBUG=${DEBUG:-}
 XDS_TARGET=${XDS_TARGET:-server}
 
 # ENVOY_VERSION to run each test against
-ENVOY_VERSION=${ENVOY_VERSION:-"1.22.1"}
+ENVOY_VERSION=${ENVOY_VERSION:-"1.23.0"}
 export ENVOY_VERSION
 
 export DOCKER_BUILDKIT=0
@@ -48,6 +48,23 @@ function network_snippet {
     echo "--net=envoy-tests"
 }
 
+function aws_snippet {
+  LAMBDA_TESTS_ENABLED=${LAMBDA_TESTS_ENABLED:-false}
+  if [ "$LAMBDA_TESTS_ENABLED" != false ]; then
+    local snippet=""
+
+    # The Lambda integration cases assume that a Lambda function exists in $AWS_REGION with an ARN of $AWS_LAMBDA_ARN.
+    # The AWS credentials must have permission to invoke the Lambda function.
+    [ -n "$(set | grep '^AWS_ACCESS_KEY_ID=')" ] && snippet="${snippet} -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID"
+    [ -n "$(set | grep '^AWS_SECRET_ACCESS_KEY=')" ] && snippet="${snippet} -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY"
+    [ -n "$(set | grep '^AWS_SESSION_TOKEN=')" ] && snippet="${snippet} -e AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN"
+    [ -n "$(set | grep '^AWS_LAMBDA_REGION=')" ] && snippet="${snippet} -e AWS_LAMBDA_REGION=$AWS_LAMBDA_REGION"
+    [ -n "$(set | grep '^AWS_LAMBDA_ARN=')" ] && snippet="${snippet} -e AWS_LAMBDA_ARN=$AWS_LAMBDA_ARN"
+
+    echo "$snippet"
+  fi
+}
+
 function init_workdir {
   local CLUSTER="$1"
 
@@ -213,11 +230,11 @@ function start_consul {
       --hostname "consul-${DC}-server" \
       --network-alias "consul-${DC}-server" \
       -e "CONSUL_LICENSE=$license" \
-      windows/consul-dev \
+      windows/consul:local \
       agent -dev -datacenter "${DC}" \
       -config-dir "C:\\workdir\\${DC}\\consul" \
       -config-dir "C:\\workdir\\${DC}\\consul-server" \
-      -grpc-port -1 \
+      -grpc-port $server_grpc_port \
       -client "0.0.0.0" \
       -bind "0.0.0.0" >/dev/null
 
@@ -228,7 +245,7 @@ function start_consul {
       --network-alias "consul-${DC}-client" \
       -e "CONSUL_LICENSE=$license" \
       ${ports[@]} \
-      windows/consul-dev \
+      windows/consul:local \
       agent -datacenter "${DC}" \
       -config-dir "C:\\workdir\\${DC}\\consul" \
       -data-dir "/tmp/consul" \
@@ -242,12 +259,14 @@ function start_consul {
     docker.exe run -d --name envoy_consul-${DC}_1 \
       --net=envoy-tests \
       $WORKDIR_SNIPPET \
+      --memory 4096m \
+      --cpus 2 \
       --hostname "consul-${DC}" \
       --network-alias "consul-${DC}-client" \
       --network-alias "consul-${DC}-server" \
       -e "CONSUL_LICENSE=$license" \
       ${ports[@]} \
-      windows/consul-dev \
+      windows/consul:local \
       agent -dev -datacenter "${DC}" \
       -config-dir "C:\\workdir\\${DC}\\consul" \
       -config-dir "C:\\workdir\\${DC}\\consul-server" \
@@ -281,7 +300,7 @@ function start_partitioned_client {
     --hostname "consul-${PARTITION}-client" \
     --network-alias "consul-${PARTITION}-client" \
     -e "CONSUL_LICENSE=$license" \
-    windows/consul-dev agent \
+    windows/consul:local agent \
     -datacenter "primary" \
     -retry-join "consul-primary-server" \
     -grpc-port 8502 \
@@ -292,6 +311,7 @@ function start_partitioned_client {
 
 function pre_service_setup {
   local CLUSTER=${1:-primary}
+
   # Run test case setup (e.g. generating Envoy bootstrap, starting containers)
   if [ -f "${CASE_DIR}/${CLUSTER}/setup.sh" ]
   then
@@ -543,10 +563,9 @@ function workdir_cleanup {
 function suite_setup {
     # Cleanup from any previous unclean runs.
     suite_teardown
-    # docker.exe network create -d transparent envoy-tests
-    # docker.exe network create -d transparent --subnet=10.244.0.0/24 -o com.docker.network.windowsshim.interface="Ethernet" envoy-tests
-    # docker.exe network create -d "nat" --subnet "10.244.0.0/24" envoy-tests &>/dev/null
+
     docker.exe network create -d "nat" envoy-tests &>/dev/null
+
     # Start the volume container
     #
     # This is a dummy container that we use to create volume and keep it
@@ -557,6 +576,7 @@ function suite_setup {
         --net=none \
         "${HASHICORP_DOCKER_PROXY}/windows/kubernetes/pause" &>/dev/null
     # TODO(rb): switch back to "${HASHICORP_DOCKER_PROXY}/google/pause" once that is cached
+
 }
 
 function suite_teardown {
@@ -669,11 +689,6 @@ function common_run_container_sidecar_proxy {
   local service="$1"
   local CLUSTER="$2"
   local CONTAINER_NAME="$SINGLE_CONTAINER_BASE_NAME"-"$CLUSTER"_1
-  # if [ $1=="s1" ] ; then
-  #   IPSERV=10.244.0.170
-  # else
-  #   IPSERV=10.244.0.180
-  # fi
 
   # Hot restart breaks since both envoys seem to interact with each other
   # despite separate containers that don't share IPC namespace. Not quite