# Ensure API Gateway Restricted to Source IPs

- Source: https://support.icompaas.com/support/solutions/articles/62000223589-ensure-api-gateway-restricted-to-source-ips
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description :**

Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. API developers can create APIs that access AWS or other web services, as well as data stored in the AWS Cloud. As an API Gateway API developer, you can create APIs for use in your own client applications. This policy checks that non-private API GW have a resource-based policy that limits their usage based on IP source

  

## **Rationale :**

API Gateway if restricted to a particular set of IP addresses helps to control access and reduces the chance of any security risks caused by any party which is not accessing from the set of whitelisted IP addresses.

  

## **Impact:**  

 Users who call the API from specified IP addresses (allowed users) can access the API. Calls from any other IP addresses are denied access and receive an HTTP 403 **Forbidden** error.

  

## **Default Value:**

By default, the API Gateway is not restricted.

  

####  **Pre-Requisites:**

-   IAM user with required permissions.
    

  

## **Remediation:**

  

**Test Plan:** 

1.  Login to AWS management console
    
2.  Go to API Gateway at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway") 
    
3.  Click on APIs in the left navigation pane ![](https://support.icompaas.com/assets/kb/ed56c4f8658be557.png) 
    
4.  Select the API you want to examine.
5.  In the left panel Click on the **Resource policy** option.![](https://support.icompaas.com/assets/kb/4c44d841c087a82b.png)
6.  In the Resource policy check if any source-IPs is/are mentioned, if it is not mentioned then the API Gateway is not restricted to Source IPs. 

  

  

## **Implementation steps:**

1.  Login to AWS management console
    
2.  Go to API Gateway at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  Click on APIs in the left navigation pane
    
4.  Select the REST API you want to examine.
5.  Click on the Resource Policy under the API you opened.
6.  In the **Resource policy** add the following command:

  

"Condition": {
        "NotIpAddress": {
          "aws:SourceIp": \["sourceIpOrCIDRBlock1", "sourceIpOrCIDRBlock2"\]
        }

7\.  For **aws: SourceIp**, replace the **sourceIpOrCIDRBlock** value with the specific IP addresses that you want to grant access to. You can also specify a range of IP addresses using CIDR notation.

## **Backout Plan:**

1.  Login to AWS management console
    
2.  Go to API Gateway at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  Click on APIs in the left navigation pane.
    
4.  Select the REST API you want to examine.
    
5.  Click on the Resource Policy under the API you opened.
    
6.  In the Resource, policy remove the **sourceIp** clause.
    

  

### **Note:**

The aws:SourceIp condition value works only for public IP address ranges. To allow access to private IP address ranges, use the condition value **aws:VpcSourceIp** instead.

## **References :**

[https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-resource-policy-access/](https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-resource-policy-access/ "https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-resource-policy-access/").

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.