Any way to parse "${}" when doing document based security?

I’m trying to take a substring from the “${}” that arrives, and then inflict it on the index.
for example, my users are external, and are constructed through AWS (IAM):

this is the value that i get on the ${} field, but i want to parse it and actually take only the “admin” section, and then all my documents will have a relevant field, right now what i’m doing:

  "match": {
    "owned_by": "${}"

but of course i don’t want to put the entire ARN, maybe perform some kind of regex on that field?

Hi @fejo135 can you confirm if you are using SAML, OIDC etc. and also the version f odfe you are using.