I am using API GW with two stages (staging and prod) and some resources paths that redirect to some services (in EKS).
For example:

myapi.com/status redirects to main service (in EKS) and status endpoint
myapi.com/service1/status redirects to service1 (in EKS) and status endpoint
myapi.com/service2/v1/special redirects to service2 (in EKS) and v1/special endpoint
myapi.com/service3/v1/list redirects to service3(in EKS) and v1/list endpoint

What I want to do is to allow ANY method (GET, PUT, HEAD, etc) to the resources (/, service1, service2, service3, etc) and ONLY to /status and /v1/* paths and block all the petitions that comes from internet to the API GW that are no to /status or /v1/*, like for example:

myapi.com/service3/robots.txt
myapi.com/service2/sitemap.xml
myapi.com/service1/whatever
myapi.com/.env
....

I have tried attaching the following resource policy to my API GW, but it is not working:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": [
               "execute-api:/staging/ANY/v1/*",
               "execute-api:/staging/ANY/status"
            ],
            "Condition" : {
                "IpAddress": {
                    "aws:SourceIp": ["0.0.0.0/0" ]
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": [
               "execute-api:/staging/ANY/*"
            ],
            "Condition" : {
                "IpAddress": {
                    "aws:SourceIp": ["0.0.0.0/0" ]
                }
            }
        }
    ]
}

Is there any way to do this?. I am not sure if I should use aws:SourceIp": ["0.0.0.0/0" ] as condition or VPC condition one and if exist the ANY method or in what way I can achieve what I want