What I want is to restrict lambda access to API gateways of a known account. I tried that adding following block to the lambda policies. Am I correct? Conditions: { "ArnLike": { "AWS:SourceArn": "arn:aws:execute-api: 'lambda-region':'account-id':*" } }