title: Limiting public api gateway to specific IP
body: <p>I have an api gateway that is going to be accessed by a front end javascript application. With that in mind we can't feasibly limit access to an api key (I don't think?), so I'd really like to limit it by IP address...but I can't find a way to do that. Is that even possible as it's not actually coming from a server?</p>
  
  <p>So the site is hosted on S3 with Cloudfront in Front. The API gateway accepts couple of keys and that hits a lambda script and gets saved to dynamodb. If someone wanted to they could just spam the hell out of it with values. I only want the web app to be able to talk to it. I'm still learning a lot of AWS! I hoped I could use Shield or WAF but it seems a no go. Any suggestions?</p>