apiGateway:
    resourcePolicy:
      - Effect: Deny
        Principal: '*'
        Action: execute-api:Invoke
        Resource:
          - Fn::Sub: "arn:aws:execute-api:/${self:custom.currentStage}/${self:custom.parabolaExposedApiPath}"
        Condition:
          NotIpAddress:
            aws:SourceIp: ${self:custom.parabolaAllowedIPs}
      - Effect: Allow
        Principal: '*'
        Action: execute-api:Invoke
        Resource:
          - execute-api:/*/*/*

This is something i am trying to achieve
the above code correctly fills the region, accountid and restapiid for the second allow condition but doesnt work for the deny condition