ACL for management access on AireOS and IOS

[eglinsky2012]

Our WLCs currently have management access (HTTP/S, SSH, SNMP, etc.) restricted to certain IPs/subnets via an ACL in the router upstream. Is there a way to accomplish this on the controllers themselves, both for AireOS (version 8.10) and IOS (version 17.9)? On AireOS, would an ACL need to be applied to each interface since AireOS has IP addresses in each VLAN?

[marce1000]

   - FYI : https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71978-acl-wlc.html
            You need to be careful with a controller that is in production , to avoid being locked out. 

  For IOS-XE  , you fall back to classic ACL's internally on the controller as discussed in :
           https://community.cisco.com/t5/wireless/restrict-management-access-to-gui-9800-40/td-p/4729193

 M.