APM on demand cert auth using attribute to map different resource group

Have a look to the APM operations guide, there is an example similar of what you need to do: https://support.f5.com/content/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide/_jcr_content/pdfAttach/download/file.res/f5-apm-operations-guide.pdf page 108.

You can extract the value of session.ssl.cert.cn and then apply the resources based on the logic you want.