Building custom ACL based on the content inside the jwt token

I am building a solution to read JWT token in ALB logs then it should block the request through WAF rules. the main point is i want to decode the JWT token in WAF at the time request hit in WAF and based on some conditon after decoding the JWT , WAF will allow or block the request, Some how i am not able to find the place where should i write this logic. i tried to modify "aws-waf-security-automations" but not get success. if anybody has idea...