title: AWS Macie - list of query fields
body: <p>In the AWS Macie documentation, it shows an <a href="http://docs.aws.amazon.com/macie/latest/userguide/macie-alerts.html#macie-alert-working-edit-add-basic" rel="nofollow noreferrer">example</a> of adding a basic alert.</p>
  
  <p>The example query to add is <code>s3_world_readability:"true"</code></p>
  
  <p>Where do we find a list of valid fields that we can query on?</p>
  
  <p>The docs refer to <a href="http://docs.aws.amazon.com/macie/latest/userguide/macie-research.html#macie-query" rel="nofollow noreferrer"> Constructing Queries in Macie</a>, but nowhere do I see any listing of what fields I can query.</p>
  
  <p>I'm trying to figure out whether I can create Macie alert if a Bucket doesn't have a bucket policy that enforces <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html" rel="nofollow noreferrer">Server Side Encryption</a></p>
  
  <p>Am I missing something obvious?</p>
  
  <h3>Update</h3>
  
  <p>Found out you can get some suggestions from the Macie console in the Research tab.
  <a href="https://i.stack.imgur.com/EHTAm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EHTAm.png" alt="enter image description here"></a></p>
  
  <p>Using this pattern when selecting S3 bucket properties, I'm able to drill down into the bucket policy.</p>
  
  <p>My Bucket policy is</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "Policy123456789",
      "Statement": [
          {
              "Sid": "DenyIncorrectEncryptionHeader",
              "Effect": "Deny",
              "Principal": {
                  "AWS": "*"
              },
              "Action": "s3:PutObject",
              "Resource": "arn:aws:s3:::my-bucket/*",
              "Condition": {
                  "StringNotEquals": {
                      "s3:x-amz-server-side-encryption": "AES256"
                  }
              }
          },
          {
              "Sid": "DenyUnEncryptedObjectUploads",
              "Effect": "Deny",
              "Principal": {
                  "AWS": "*"
              },
              "Action": "s3:PutObject",
              "Resource": "arn:aws:s3:::my-bucket/*",
              "Condition": {
                  "Null": {
                      "s3:x-amz-server-side-encryption": "true"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>I can use the following query in Macie and it will return the bucket with this policy</p>
  
  <pre><code>policy.Policy.Statement.Action:"s3:PutObject"
  </code></pre>
  
  <p>So if want to query bucket policies that match the Conditions forcing SSE, I try:</p>
  
  <pre><code>policy.Policy.Statement.Condition.StringNotEquals.s3\:x\-amz\-server\-side\-encryption:"AES256"
  </code></pre>
  
  <p>But I get nothing back. Is there a better way for me to query these properties?</p>