I have a S3 bucket that is public and has a webapp contained in it. I also have an api gateway that is stood up and currently public with no real restrictions. How do i prev