Multiple IP's in Access Control Policy

[DhanshriI]

As a part of new requirement we want to whitelist multiple IP's in Apigee. I got two approach: 

1] Retrieve IP's list from KVM, assign every IP to new variable and then whitelist each IP one by one in Access control policy. 

2] Retrieve IP's list from KVM, and then use Javascript to check if IP is allowed or not.

My question is which approach is more accurate according to apigee, as apigee suggest if policy is available we should not use coding logic to do same.

[dchiesa1 · Accepted solution]

If you have a fixed number of IPs or a fixed set of ranges, then you can use the AccessControl policy. Even if the data changes, as long as it's the same number of IPs that you're restricting, the policy will work nicely. 

If you have a dynamic list of IPs - the number of IPs or the number of ranges changes - then you cannot use the AccessControl policy and you should use JS for that.