API Gateway Resource Policy for IP Restriction

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Create a resource policy for the API that denies access to any IP address that is not specifically allowed.

Question

A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network. Which solution will meet these requirements?
  1. Set up an API Gateway private integration to restrict access to a predefined set of IP addresses.
  2. Create a resource policy for the API that denies access to any IP address that is not specifically allowed. Correct Answer
  3. Directly deploy the API in a private subnet. Create a network ACL. Set up rules to allow the traffic from specific IP addresses.
  4. Modify the security group that is attached to API Gateway to allow inbound traffic from only the trusted IP addresses.

Key Takeaways

The question tests the ability to configure API Gateway access controls; the common trap is confusing resource policies with VPC security groups or private integrations, which do not serve this specific purpose.

This page explains how to restrict access to an Amazon API Gateway HTTP API using a resource policy based on the client's source IP address, ensuring only trusted internal networks can connect.

Common mistake: Candidates often choose Option D because they assume API Gateway behaves like an EC2 instance with Security Groups. However, API Gateway is a managed service and does not support Security Groups directly, making this option technically invalid.

Expert Analysis

Why the Answer Is Correct

Option B is correct because Amazon API Gateway supports Resource Policies that allow you to define JSON-based permissions. These policies can include conditions to deny requests from any IP address except those explicitly allowed in a CIDR block list. This is the standard mechanism for restricting public APIs to specific internal networks.

Why the Other Options Are Wrong

Option A describes a Private Integration, which is used to connect API Gateway to backend resources inside a VPC (like Lambda or EC2), not to restrict who can call the API. Option C suggests deploying API Gateway in a private subnet, but API Gateway is a global managed service and cannot be deployed into specific subnets. Option D is incorrect because API Gateway does not utilize Security Groups; it relies on IAM, Resource Policies, or WAF for access control.

Community Comment Notes

Community consensus strongly supports Option B, with many users noting that private integrations are for backends, not frontend restrictions. As user 'trinh_le' noted, "api gateway allows configure resource policy to restricted IP," highlighting the direct link between the feature and the requirement. Users also clarified that security groups do not apply to API Gateway, debunking the distractor in Option D.

Official Reference

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html#apigateway-resource-policies-source-ip-address-example

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between access controls for the API consumer (Resource Policies/WAF) and access controls for the backend integration (Private Links/Private Subnets). Remember that managed services like API Gateway do not have Security Groups.

Frequently Asked Questions

Can I use a Security Group to restrict API Gateway?

No, API Gateway is a managed service and does not support Security Groups. You must use Resource Policies or AWS WAF.

What is the difference between Private Integration and Resource Policy?

Private Integration restricts backend connectivity within a VPC, while a Resource Policy restricts who can call the API endpoint from the internet.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Jassn3 👍 23
    OMG finally I have reached here
  2. Bwhizzy 👍 13
    Finally made it. Congratulations to everyone who got here. I know the journey has been hard and long. best of luck
  3. Sergantus 👍 6
    Congrats to everyone who made it here. On to the next step, gents.
  4. whoeevd2eww3322d 👍 5
    🎉 I cleared the AWS Solutions Architect – Associate exam! For those on the same journey, many exam questions are from or related to these 1019 questions. Go through them twice for a solid prep. Also, check out Shaping Pixel's YouTube channel—focus only on the latest videos as most questions overlap. You've got this—good luck! 🚀
  5. Ben_88 👍 5
    And now it's time to start all over again to see if you can do better this time . good luck lads !
Show 8 more comments
  1. trinh_le 👍 4 Answered B
    B: api gateway allows configure resource policy to restricted IP A: private integration-> private api C: private subnet -> private api D: security group does not support api gateway
  2. LeonSauveterre 👍 3 Answered B
    A - A private integration is for connecting API Gateway to private resources within VPCs, such as EC2 instances or Lambda functions. It doesn't restrict access based on IP addresses. It controls how the API interacts with private resources. B - This is the most direct way to restrict access at the API Gateway level. C - Deploying the API in a private subnet would require users to connect to your VPC (e.g., via VPN or Direct Connect). This is not what the question implies (the API should be publicly accessible, but restricted by IP). D - API Gateway doesn't even use security groups because it's a regional managed service, not directly tied to VPCs like EC2 instances.
  3. JA2018 👍 2 Answered D
    yes, finally, the finishing point..... --- Why not D? By modifying the security group attached to API Gateway, you can explicitly define which IP addresses are allowed to access the API, effectively restricting access to only the trusted internal network IPs
  4. EllenLiu 👍 2 Answered B
    https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html#apigateway-resource-policies-source-ip-address-example
  5. jfedotov 👍 1 Answered B
    The correct answer should be B, but the question is misleading. This is because HTTP APIs do not support resource policies; only REST APIs do.
  6. Denise123 👍 1 Answered B
    I can't believe that I made it! Congrats everyone! Time to restart from the Q1 to polish, and good luck for the exam!
  7. techghost 👍 1 Answered B
    Got to the end, worth it and great contributions
  8. xekiva3329 👍 5 Answered B
    answer B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide