My understanding is that controlling IP address access to AWS api-gateway is via Resource policies.
This does not sound ideal as it would involve deploying the API each time new access was required (change control issues). Can this access not be decoupled from the API element and added to the VPC access list policy?
In summary, is there a way to control API Gateway access via Network access lists in a VPC?