Api gateway resource policy with lambda authorizer enabled

You are right. In API Gateway, resource policies are evaluated before Lambda authorizers. However, the authorization workflow looks for a explicit Deny to block the request. It is described in detail here: Lambda authorizer and resource policy.

I would do it the othe way around: add an explicit "Deny" statement that blocks all IPs outside your allowed range.

The resource policy with an "Allow" statement does not block requests from non-allowed IPs; it simply doesn’t grant them permission. Since there’s no explicit "Deny" for those IPs, the request is not blocked at the resource policy level and proceeds to the Lambda authorizer. The Lambda authorizer then evaluates the request and can deny it based on your custom logic.

To ensure that requests from non-allowed IPs are blocked before reaching the Lambda authorizer, you should include a "Deny" statement in your resource policy for those IPs. Here’s an example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IPRestrictedExecuteAPIGateway",
      "Effect": "Allow",
      "Principal": {
        "AWS": ""
      },
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:eu-central-1:<acc_no>:<api_id>/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "<allowed_ip_1>",
            "<allowed_ip_2>"
          ]
        }
      }
    },
    {
      "Sid": "DenyAllOtherIPs",
      "Effect": "Deny",
      "Principal": {
        "AWS": ""
      },
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:eu-central-1:<acc_no>:<api_id>/*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "<allowed_ip_1>",
            "<allowed_ip_2>"
          ]
        }
      }
    }
  ]
}

This configuration explicitly denies requests from IPs that are not in the allowed list, preventing them from reaching the Lambda authorizer.