diff --git a/.github/workflows/aws-create.yml b/.github/workflows/aws-create.yml
index 373d7d1..50981d2 100644
--- a/.github/workflows/aws-create.yml
+++ b/.github/workflows/aws-create.yml
@@ -62,11 +62,19 @@ jobs:
         run: |
           aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com
 
-      - name: Create S3 bucket for terraform.tfstate
+      - name: Create S3 bucket for terraform.tfstate (if not exists)
         run: |
           BUCKET_NAME=ranky-bot-s3
-          FILE_PATH=terraform/terraform.tfstate
-          aws s3api create-bucket --bucket $BUCKET_NAME --region eu-west-2 --create-bucket-configuration LocationConstraint=eu-west-2
+          
+          if aws s3api head-bucket --bucket "$BUCKET_NAME" 2>/dev/null; then
+            echo "El bucket $BUCKET_NAME ya existe y eres el propietario. Skipeando creación..."
+          else
+            echo "El bucket no existe o no tienes acceso. Intentando crearlo..."
+            aws s3api create-bucket \
+              --bucket "$BUCKET_NAME" \
+              --region eu-west-2 \
+              --create-bucket-configuration LocationConstraint=eu-west-2
+          fi
 
       - name: Terraform Init
         run: terraform init
diff --git a/terraform/ec2.tf b/terraform/ec2.tf
index 1228e2c..5818f27 100644
--- a/terraform/ec2.tf
+++ b/terraform/ec2.tf
@@ -6,22 +6,64 @@ resource "aws_instance" "ranky-ec2" {
   key_name      = aws_key_pair.ranky-ec2-keypair.key_name
 
   user_data = <<-EOF
-              #!/bin/bash
-              sudo yum update -y
-              sudo yum install docker -y
-              sudo systemctl start docker
-              sudo systemctl enable docker
+  #!/bin/bash
+  set -e
 
-              # Autenticarse con ECR
-              aws ecr get-login-password --region eu-west-2 | sudo docker login --username AWS --password-stdin ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo
+  yum update -y
 
+  # Docker
+  yum install -y docker
+  systemctl enable docker
+  systemctl start docker
 
-              # Tirar la imagen desde ECR
-              sudo docker pull ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest
+  sleep 5
 
-              # Ejecutar la imagen
-              sudo docker run -d -p 8080:8080 --name ranky-app ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest
-              EOF
+  # AWS CLI
+  yum install -y awscli
+
+  # NGINX
+  yum install -y nginx
+  systemctl enable nginx
+  systemctl start nginx
+
+  # Certbot
+  sleep 20
+  yum install -y certbot python3-certbot-nginx
+
+  # ECR login
+  aws ecr get-login-password --region eu-west-2 \
+  | docker login --username AWS --password-stdin ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo
+
+  # Pull image
+  docker pull ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest
+
+  # Run container SOLO LOCAL
+  docker run -d \
+    --name ranky-app \
+    -p 127.0.0.1:8080:8080 \
+    --restart always \
+    ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest
+
+  # NGINX reverse proxy (Cambiado a EON para evitar conflictos)
+  cat > /etc/nginx/conf.d/ranky.conf <<'EON'
+  server {
+      listen 80;
+      server_name api.ranky.top;
+
+      location / {
+          proxy_pass http://127.0.0.1:8080;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      }
+  }
+  EON
+
+  nginx -t && systemctl restart nginx
+
+  # Certbot (HTTPS)
+  certbot --nginx -d api.ranky.top --non-interactive --agree-tos -m mikel.garin@ranky.top
+  EOF
 
   iam_instance_profile = aws_iam_instance_profile.ranky-ec2-profile.name
 
diff --git a/terraform/networking.tf b/terraform/networking.tf
index a9d82d2..f106ca1 100644
--- a/terraform/networking.tf
+++ b/terraform/networking.tf
@@ -63,28 +63,32 @@ resource "aws_security_group" "ranky-sg-ec2" {
   name        = "ranky-sg"
   description = "Security group for ranky ec2"
 
-  vpc_id = aws_vpc.ranky-vpc.id 
+  vpc_id = aws_vpc.ranky-vpc.id
 
+  # SSH
   ingress {
-    from_port = 22
-    to_port = 22
-    protocol = "tcp"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
+  # HTTP (certbot)
   ingress {
     from_port   = 80
     to_port     = 80
     protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
+  # HTTPS (Nginx + certbot final)
   ingress {
-    from_port   = 8080
-    to_port     = 8080
+    from_port   = 443
+    to_port     = 443
     protocol    = "tcp"
     cidr_blocks = ["0.0.0.0/0"]
   }
 
-
   egress {
     from_port   = 0
     to_port     = 0
@@ -92,7 +96,11 @@ resource "aws_security_group" "ranky-sg-ec2" {
     cidr_blocks = ["0.0.0.0/0"]
   }
 
-  depends_on = [ 
+  tags = {
+    Name = "ranky-sg-ec2"
+  }
+
+  depends_on = [
     aws_vpc.ranky-vpc
   ]
-}
+}
\ No newline at end of file