data "aws_iam_policy_document" "test" {

  statement {
    actions = ["execute-api:Invoke"]

    condition {
      test = "IpAddress"
      values = ["123.123.123.123/32"]
      variable = "aws:SourceIp"
    }
    effect = "Allow"

    principals {
      identifiers = [*]
      type = "AWS"
    }
    resources = [aws_api_gateway_rest_api.test.execution_arn]
  }
}

resource "aws_api_gateway_rest_api" "test" {
  name = "example-rest-api"
}

resource "aws_api_gateway_rest_api_policy" "test" {
  policy = data.aws_iam_policy_document.test.json
  rest_api_id = aws_api_gateway_rest_api.test.id
}