Ryan McDonald

@tomerd yes, this is the feature. Decoding might not be straight forward though. It seems when you generate an IAM policy you set a principalId which seems to always be...

imo the critical piece of information is the principalId. This is what should identify the user that made the authenticated call. I think it would make sense to ensure that...