diff --git a/infra/bin/apiStack.ts b/infra/bin/apiStack.ts
index 86be04c..879efb0 100644
--- a/infra/bin/apiStack.ts
+++ b/infra/bin/apiStack.ts
@@ -93,12 +93,22 @@ export class MccAPIInfraStack extends Stack {
                         effect: Effect.ALLOW,
                         principals: [new AnyPrincipal()],
                         actions: ['execute-api:Invoke'],
-                        resources: ['execute-api:/*'],
+                        resources: ['execute-api:/*/*/*'],
                         // Optionally, restrict by source VPC or VPC endpoint
                         conditions: {
                              StringEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
                          }
                     }),
+                    new PolicyStatement({
+                        effect: Effect.DENY,
+                        principals: [new AnyPrincipal()],
+                        actions: ['execute-api:Invoke'],
+                        resources: ['execute-api:/*/*/*'],
+                        // Optionally, restrict by source VPC or VPC endpoint
+                        conditions: {
+                             StringNotEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
+                         }
+                    }),
                 ],
             }),
         });