Resource policies

Whereas IAM policies are attached to a specific identity, resource-based policies are attached to resources. In this case, the resource is the API itself, allowing you to specify the principal that has been granted or denied access to invoke the associated API. Using resource policies, you can define how your API can be invoked, for example, from the following:

• Specific IP CIDR blocks/ranges/addresses
• Defined VPCs or VPC endpoints from any AWS account
• IAM users from a particular AWS account