The details of what goes into a policy vary for each service, depending on what actions the service makes available, what types of resources it contains, and so on.
This means that some kinds of validation cannot be done on write. For example, I've been able to write Resource values that contain invalid characters.
For a non-proxy integration, you must set up at least one integration response, and make it the default response, to pass the result returned from the backend to the client. You can choose to pass through the result as-is or to transform the integration response data to the method response data if the two have different formats. For a proxy integration, API Gateway automatically passes the backend output to the client as an HTTP response. You do not set either an integration response or a method response.
integration vs method response
Set up method response status code The status code of a method response defines a type of response. For example, responses of 200, 400, and 500 indicate successful, client-side error and server-side error responses, respectively.
method response status code