diff --git a/terraform/asg.tf b/terraform/asg.tf
index 08f98ec..ffe6b29 100644
--- a/terraform/asg.tf
+++ b/terraform/asg.tf
@@ -16,6 +16,11 @@ output "ecs_ami_name" {
   value       = local.ecs_ami["image_name"]
 }
 
+output "admin_ssh_cidr" {
+  description = "CIDR allowed to SSH to the ECS instances"
+  value       = var.admin_ssh_cidr
+}
+
 # https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/latest
 module "autoscaling" {
   source  = "terraform-aws-modules/autoscaling/aws"
@@ -150,7 +155,7 @@ module "autoscaling_sg" {
   ingress_with_cidr_blocks = [
     {
       rule        = "ssh-tcp"
-      cidr_blocks = "71.237.173.68/32"
+      cidr_blocks = var.admin_ssh_cidr
     }
   ]
 
diff --git a/terraform/variables.tf b/terraform/variables.tf
index e69de29..c50e99d 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -0,0 +1,9 @@
+variable "admin_ssh_cidr" {
+  description = "CIDR allowed to SSH to the ECS instances. Set in terraform.tfvars, which git ignores."
+  type        = string
+
+  validation {
+    condition     = can(cidrhost(var.admin_ssh_cidr, 0)) && endswith(var.admin_ssh_cidr, "/32")
+    error_message = "admin_ssh_cidr must be a single IPv4 address in CIDR form, such as 203.0.113.10/32."
+  }
+}