title: REST API only allow connections from static domain
body: <p>I would like to know if it is possible to lock down a list of REST services to a static domain name; </p>
  
  <p>My end goal would be to have my list of public services accessible ONLY from our AWS API Gateway domain address, nothing else.</p>
  
  <p>We currently have a list of public facing endpoints;</p>
  
  <ul>
  <li><a href="https://serviceaddress/api/v1/getSomething" rel="nofollow noreferrer">https://serviceaddress/api/v1/getSomething</a></li>
  <li><a href="https://serviceaddress/api/v1/postSomething" rel="nofollow noreferrer">https://serviceaddress/api/v1/postSomething</a></li>
  <li><a href="https://serviceaddress/api/v1/deleteSomething" rel="nofollow noreferrer">https://serviceaddress/api/v1/deleteSomething</a></li>
  </ul>
  
  <p>I would like to lock all services down to a specific domain address:</p>
  
  <ul>
  <li><a href="https://mydomain/api/v1/service" rel="nofollow noreferrer">https://mydomain/api/v1/service</a></li>
  </ul>
  
  <p>This cannot be done via the backend service code and should be more from an infrastructure point of view (eg: blacklisting all except this domain on a NAT / ec2 instance).</p>
  
  <p>Things I have tried and know would do the job but don't help:</p>
  
  <ul>
  <li>Using SSL certificates</li>
  <li>Using custom headers</li>
  <li>Use a Lambda via VPC (no point as these are already external endpoints)</li>
  </ul>
  
  <p>Each of these would require code changes to the existing services. </p>
  
  <p>I thought this would be a simple case of locking down any calls coming to an endpoint (the service being called) to a domain or set of whitelisted IP address. </p>
  
  <p>I'm just not sure where to start? </p>