Thanks to Joe from Vapor team.
I'm afraid that's not possible natively. You'd need to look into adding IP restrictions via WAF or using Laravel to implement basic auth. Please note, due to limitations with AWS, basic auth is only available when using a load balancer. You can read more about it here: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html
I followed this tutorial this get it done: https://repost.aws/knowledge-center/waf-allow-my-ip-block-other-ip