diff --git a/terraform/main.tf b/terraform/main.tf
index 3017782..4ba021b 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -121,7 +121,7 @@ resource "aws_security_group" "ec2_api" {
     from_port   = 22
     to_port     = 22
     protocol    = "tcp"
-    cidr_blocks = ["10.0.0.0/8"] # Ajustar a IP/VPN real del pipeline
+    cidr_blocks = ["0.0.0.0/0"] # SSH desde cualquier IP (pipeline Bitbucket + administración)
   }
 
   ingress {