diff --git a/services/terraform/self-host/aws_db.tf b/services/terraform/self-host/aws_db.tf
index d599073bf..f6aad2f49 100644
--- a/services/terraform/self-host/aws_db.tf
+++ b/services/terraform/self-host/aws_db.tf
@@ -1,120 +1,120 @@
 locals {
   mariadb_database_name = local.local_with_default_environment_vars.COMM_DATABASE_DATABASE
   mariadb_username      = local.local_with_default_environment_vars.COMM_DATABASE_USER
   mariadb_password      = local.local_with_default_environment_vars.COMM_DATABASE_PASSWORD
   mariadb_port          = jsondecode(local.local_with_default_environment_vars.COMM_DATABASE_PORT)
 }
 
 # MariaDB Security Group
 resource "aws_security_group" "keyserver_mariadb_security_group" {
   name        = "keyserver-mariadb-sg"
   description = "Allow inbound traffic on port 3307 and all outbound traffic"
   vpc_id      = local.vpc_id
 
   # Inbound rules
   ingress {
     from_port       = local.mariadb_port
     to_port         = local.mariadb_port
     protocol        = "tcp"
     security_groups = [aws_security_group.keyserver_service.id]
   }
 
   ingress {
     from_port   = local.mariadb_port
     to_port     = local.mariadb_port
     protocol    = "tcp"
-    cidr_blocks = ["${var.allowed_ip}/32"]
+    cidr_blocks = [for ip in var.allowed_ips : "${ip}/32"]
   }
 
   # Outbound rules
   egress {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
 }
 
 # MariaDB RDS Instance
 resource "aws_db_instance" "mariadb" {
   allocated_storage      = 100
   max_allocated_storage  = 3000
   storage_type           = "gp3"
   db_name                = "mariadb"
   identifier             = "mariadb-instance"
   engine                 = "mariadb"
   engine_version         = "10.11"
   instance_class         = "db.m6g.large"
   db_subnet_group_name   = aws_db_subnet_group.public_db_subnet_group.name
   vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]
   username               = local.mariadb_username
   password               = local.mariadb_password
   parameter_group_name   = aws_db_parameter_group.mariadb_parameter_group.name
   storage_encrypted      = true
   publicly_accessible    = true
   port                   = local.mariadb_port
   skip_final_snapshot    = true
 }
 
 # MariaDB Parameter Group
 resource "aws_db_parameter_group" "mariadb_parameter_group" {
   name   = "mariadb-parameter-group"
   family = "mariadb10.11"
 
   parameter {
     apply_method = "pending-reboot"
     name         = "performance_schema"
     value        = "1"
   }
 
   parameter {
     apply_method = "immediate"
     name         = "max_allowed_packet"
     # 256 MiB: (1024 * 1024 * 256)
     value = "268435456"
   }
 
   parameter {
     apply_method = "immediate"
     name         = "local_infile"
     value        = "0"
   }
 
   parameter {
     apply_method = "immediate"
     name         = "sql_mode"
     value        = "STRICT_ALL_TABLES"
   }
 
   parameter {
     apply_method = "pending-reboot"
     name         = "innodb_buffer_pool_size"
     value        = "{DBInstanceClassMemory*3/4}"
   }
 
   parameter {
     apply_method = "pending-reboot"
     name         = "innodb_ft_min_token_size"
     value        = "1"
   }
 
   parameter {
     apply_method = "immediate"
     name         = "innodb_ft_enable_stopword"
     value        = "0"
   }
 }
 
 resource "null_resource" "create_comm_database" {
   depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]
 
   provisioner "local-exec" {
     command = <<EOT
     mysql --user=${local.mariadb_username} \
           --port=${local.mariadb_port} \
           --host=${aws_db_instance.mariadb.address} \
           --execute="CREATE DATABASE IF NOT EXISTS ${local.mariadb_database_name};" \
           --password=${local.mariadb_password}
     EOT
   }
 }
diff --git a/services/terraform/self-host/aws_lb.tf b/services/terraform/self-host/aws_lb.tf
index 74218ee21..ef00df3e9 100644
--- a/services/terraform/self-host/aws_lb.tf
+++ b/services/terraform/self-host/aws_lb.tf
@@ -1,89 +1,89 @@
 resource "aws_security_group" "lb_sg" {
   name        = "lb-sg"
   description = "Security group for keyserver load balancer"
   vpc_id      = local.vpc_id
 
   ingress {
     from_port   = 443
     to_port     = 443
     protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
   }
 
   ingress {
     from_port   = 443
     to_port     = 443
     protocol    = "tcp"
-    cidr_blocks = ["${var.allowed_ip}/32"]
+    cidr_blocks = [for ip in var.allowed_ips : "${ip}/32"]
   }
 
   egress {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
 }
 
 resource "aws_lb_target_group" "keyserver_service" {
   name     = "keyserver-service-ecs-tg"
   port     = 3000
   protocol = "HTTP"
   vpc_id   = local.vpc_id
 
   # "awsvpc" network mode requires target type set to ip
   target_type = "ip"
 
   stickiness {
     type            = "lb_cookie"
     cookie_duration = 86500
     enabled         = true
   }
 
   health_check {
     enabled             = true
     healthy_threshold   = 2
     unhealthy_threshold = 3
 
     protocol = "HTTP"
     path     = "/health"
     matcher  = "200-299"
   }
 }
 
 resource "aws_lb" "keyserver_service" {
   load_balancer_type = "application"
   name               = "keyserver-service-lb"
   security_groups    = [aws_security_group.lb_sg.id]
 
   internal = false
   subnets  = local.vpc_subnets
 }
 
 resource "aws_lb_listener" "keyserver_service" {
   load_balancer_arn = aws_lb.keyserver_service.arn
   port              = "443"
   protocol          = "HTTPS"
   ssl_policy        = "ELBSecurityPolicy-2016-08"
   certificate_arn   = data.aws_acm_certificate.keyserver_service.arn
 
   default_action {
     type             = "forward"
     target_group_arn = aws_lb_target_group.keyserver_service.arn
   }
 
   lifecycle {
     ignore_changes       = [default_action[0].forward[0].stickiness[0].duration]
     replace_triggered_by = [aws_lb_target_group.keyserver_service]
   }
 }
 
 
 data "aws_acm_certificate" "keyserver_service" {
   domain   = var.keyserver_domain_name
   statuses = ["ISSUED"]
 }
 
 output "keyserver_service_load_balancer_dns_name" {
   value = aws_lb.keyserver_service.dns_name
 }
diff --git a/services/terraform/self-host/variables.tf b/services/terraform/self-host/variables.tf
index 2ac93901c..7205e9f26 100644
--- a/services/terraform/self-host/variables.tf
+++ b/services/terraform/self-host/variables.tf
@@ -1,53 +1,53 @@
 variable "keyserver_domain_name" {
   description = "Domain name for your keyserver"
   type        = string
 }
 
 variable "landing_domain_name" {
   description = "Domain name for your landing page"
   type        = string
 }
 
 variable "webapp_domain_name" {
   description = "Domain name for your web app"
   type        = string
 }
 
 variable "region" {
   description = "The AWS region to deploy your keyserver in"
   type        = string
   default     = "us-west-1"
 }
 
-variable "allowed_ip" {
-  description = "IP address"
-  type        = string
+variable "allowed_ips" {
+  description = "List of allowed ipv4 addresses"
+  type        = list(string)
 }
 
 variable "user_created_vpc" {
   description = "Use non-default vpc and subnets"
 }
 
 variable "availability_zone_1" {
   description = "First availability zone for vpc subnet if user created vpc"
   type        = string
   default     = "us-west-1b"
 }
 
 variable "availability_zone_2" {
   description = "Second availability zone for vpc subnet if user created vpc"
   type        = string
   default     = "us-west-1c"
 }
 
 variable "db_instance_class" {
   description = "The instance class for the MariaDB RDS instance"
   type        = string
   default     = "db.t4g.medium"
 }
 
 variable "desired_secondary_nodes" {
   description = "Desired number of secondary nodes"
   type        = number
   default     = 1
 }