Private API Gateway with Serverless Framework

Question

I have my internal network in AWS VPC(10.0.0.0/16) and I want to create AWS API Gateway within this private network, thus no public hostnames/ips.

Here is what I tried

service: apollo-lambda1
provider:
  name: aws
  runtime: nodejs8.10
  role: arn:aws:iam::xxx:role/admin-api-lambda-role
  region: ap-southeast-1
  private: true
  vpc:
    securityGroupIds:
      - sg-xxxxx
    subnetIds:
      - subnet-xxx

sg-xxxxx is a security group that allows only ips from 10.0.0.0/16 .It doesn't help.

I also tried adding, but it sill exposes a public IP to the world...

resourcePolicy:
    - Effect: Allow
      Principal: "*"
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            - "10.0.0.0/16"

UPD: Tried this combination, didn't work out. Now dns name cannot be resolved

endpointType: PRIVATE
  resourcePolicy:
    - Effect: Allow
      Principal: '*'
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            - some ip here

Answer 1

I know that has been a while since this question was asked, but I wanted anyway to write an answer.

1. The security group will never help you to block the outside access of the API.
2. If you want to block outside access, you could block by ip the resouce policy, or create a WAF on top of API GW.
3. You also could use a PRIVATE endpoint with the restriction and a vpc endpoint.

Using the resource policy :

provider:
  name: aws
  runtime: nodejs12.x
  region: us-west-2
  stage: dev
  resourcePolicy:
    - Effect: Allow
      Principal: "*"
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            - "10.0.0.0/16"

Using a private endpoint with a resource policy and a VPC Endpoint

provider:
  name: aws
  runtime: nodejs12.x
  region: us-west-2
  stage: dev
  endpointType: PRIVATE
  vpcEndpointIds:
    - vpce-XXXXX
  resourcePolicy:
    - Effect: Allow
      Principal: "*"
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            - "10.0.0.0/16"

At the moment of writting this solution, I am using the first example with extra IP Addresses because is the solution that I have in order to test with out QA Team the endoints from a fixed IP address. I hope that this solution helped someone.