From ffff5c0869cdc4a43a291b5769c314081b0b6346 Mon Sep 17 00:00:00 2001
From: Anup Raj Gopinathan <anupraj.gopinathan@adidas.com>
Date: Wed, 25 Jun 2025 15:03:42 +0200
Subject: [PATCH] Update the API Gateway Resource Policy

---
 infra/bin/apiStack.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/infra/bin/apiStack.ts b/infra/bin/apiStack.ts
index 86be04c..879efb0 100644
--- a/infra/bin/apiStack.ts
+++ b/infra/bin/apiStack.ts
@@ -93,12 +93,22 @@ export class MccAPIInfraStack extends Stack {
                         effect: Effect.ALLOW,
                         principals: [new AnyPrincipal()],
                         actions: ['execute-api:Invoke'],
-                        resources: ['execute-api:/*'],
+                        resources: ['execute-api:/*/*/*'],
                         // Optionally, restrict by source VPC or VPC endpoint
                         conditions: {
                              StringEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
                          }
                     }),
+                    new PolicyStatement({
+                        effect: Effect.DENY,
+                        principals: [new AnyPrincipal()],
+                        actions: ['execute-api:Invoke'],
+                        resources: ['execute-api:/*/*/*'],
+                        // Optionally, restrict by source VPC or VPC endpoint
+                        conditions: {
+                             StringNotEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
+                         }
+                    }),
                 ],
             }),
         });