code: def lambda_handler(event, context):
      print("Client token: " + event['authorizationToken'])
      print("Method ARN: " + event['methodArn'])
      
      """and produce the principal user identifier associated with the token"""
  
      """this could be accomplished in a number of ways:"""
      """1. Call out to OAuth provider"""
      """2. Decode a JWT token inline"""
      """3. Lookup in a self-managed DB"""
      principalId = "user|a1b2c3d4"
  
      """you can send a 401 Unauthorized response to the client by failing like so:"""
      """raise Exception('Unauthorized')"""
  
      """if the token is valid, a policy must be generated which will allow or deny access to the client"""
  
      """if access is denied, the client will receive a 403 Access Denied response"""
      """if access is allowed, API Gateway will proceed with the backend integration configured on the method that was called"""
  
      """this function must generate a policy that is associated with the recognized principal user identifier."""
      """depending on your use case, you might store policies in a DB, or generate them on the fly"""
  
      """keep in mind, the policy is cached for 5 minutes by default (TTL is configurable in the authorizer)"""
      """and will apply to subsequent calls to any method/resource in the RestApi"""
      """made with the same token"""
  
      """the example policy below denies access to all resources in the RestApi"""
      tmp = event['methodArn'].split(':')
      apiGatewayArnTmp = tmp[5].split('/')
      awsAccountId = tmp[4]
  
      policy = AuthPolicy(principalId, awsAccountId)
      policy.restApiId = apiGatewayArnTmp[0]
      policy.region = tmp[3]
      policy.stage = apiGatewayArnTmp[1]
  
      # Blueprint denies all methods by default
      # policy.denyAllMethods()
  
      # Example allows all methods
      policy.allowAllMethods()
  
      """policy.allowMethod(HttpVerb.GET, "/pets/*")"""
  
      """finally, build the policy and exit the function using return"""
      return policy.build()
docs: validate the incoming token