我应该在我的 api 网关资源策略中使用什么 cidr 范围来允许 lambda 调用我的端点？

Question

I have setup the follow resource policy in api gateway to restrict access to a source IP (x is just a placeholder). When I manually hit the api endpoint from postman the policy correctly restricts access only to the cidr range I specified in the resource policy below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:x:x/*/*/*”
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:x:x/*/*/*”,
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        “x.x.x.x/32"
                    ]
                },
                "StringNotEquals": {
                    "aws:sourceVpc": "vpc-x”
                }
            }
        }
    ]
}

However, I have a lambda function which also calls the same https api gateway endpoint. This function essentially just passes test data into my api at hourly intervals. But, the lambda function is unable to hit the endpoint and gets a 403 forbidden error. I tried adding the sourceVpc to the resource policy, but this did not seem to work. I also tried adding the vpc cidr range too, but again this did not work.

Do you know what cidr I should add to the resource policy to allow my lambda to call my api endpoint too?

Answer 1

I added to the resource policy "aws:SourceIp" the NAT gateway ip of the subnets associated with my lambda function. This allowed my lambda function to invoke the API Gateway successfully.