Api gateway resource policy insights

I believe in the case:

• v1 and v2 endpoints are secured solely through a resource policy that enforces IP allow/deny restrictions.
• v3 is protected by both the same resource policy and a Lambda authorizer.
• When a Deny statement with a NotIpAddress condition is added to the resource policy, it applies uniformly across all resources—v1, v2, and v3.
• Because resource policies are evaluated before authorizers, any request denied at the policy level is never forwarded to the Lambda authorizer for further evaluation.

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-authorization-flow.html

Hey,

Hope you're keeping well.

In API Gateway, a resource policy is applied at the API level and affects all resources under that API before any authorizer logic runs. If you use a Deny with NotIpAddress, it will block requests to v1, v2, and v3 regardless of whether v3 has a Lambda authorizer. To scope IP restrictions differently, you can split v3 into its own API Gateway deployment with a separate resource policy, or remove the IP-based deny from the global policy and enforce it inside the Lambda authorizer for v3. This way v1 and v2 remain IP-restricted at the resource policy level, while v3 can apply its own logic after the authorizer runs.

Thanks and regards,
Taz