What cidr range should I use in my api gateway resource policy to allow lambda to call my endpoint?

Question

I have setup the follow resource policy in api gateway to restrict access to a source IP (x is just a placeholder). When I manually hit the api endpoint from postman the policy correctly restricts access only to the cidr range I specified in the resource policy below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:x:x/*/*/*”
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:x:x/*/*/*”,
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        “x.x.x.x/32"
                    ]
                },
                "StringNotEquals": {
                    "aws:sourceVpc": "vpc-x”
                }
            }
        }
    ]
}

However, I have a lambda function which also calls the same https api gateway endpoint. This function essentially just passes test data into my api at hourly intervals. But, the lambda function is unable to hit the endpoint and gets a 403 forbidden error. I tried adding the sourceVpc to the resource policy, but this did not seem to work. I also tried adding the vpc cidr range too, but again this did not work.

Do you know what cidr I should add to the resource policy to allow my lambda to call my api endpoint too?

Answer 1

I added to the resource policy "aws:SourceIp" the NAT gateway ip of the subnets associated with my lambda function. This allowed my lambda function to invoke the API Gateway successfully.