1

In the AWS Macie documentation, it shows an example of adding a basic alert.

The example query to add is s3_world_readability:"true"

Where do we find a list of valid fields that we can query on?

The docs refer to Constructing Queries in Macie, but nowhere do I see any listing of what fields I can query.

I'm trying to figure out whether I can create Macie alert if a Bucket doesn't have a bucket policy that enforces Server Side Encryption

Am I missing something obvious?

Update

Found out you can get some suggestions from the Macie console in the Research tab. enter image description here

Using this pattern when selecting S3 bucket properties, I'm able to drill down into the bucket policy.

My Bucket policy is

{
    "Version": "2008-10-17",
    "Id": "Policy123456789",
    "Statement": [
        {
            "Sid": "DenyIncorrectEncryptionHeader",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "AES256"
                }
            }
        },
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "Null": {
                    "s3:x-amz-server-side-encryption": "true"
                }
            }
        }
    ]
}

I can use the following query in Macie and it will return the bucket with this policy

policy.Policy.Statement.Action:"s3:PutObject"

So if want to query bucket policies that match the Conditions forcing SSE, I try:

policy.Policy.Statement.Condition.StringNotEquals.s3\:x\-amz\-server\-side\-encryption:"AES256"

But I get nothing back. Is there a better way for me to query these properties?

maafk
  • 6,176
  • 5
  • 35
  • 58

0 Answers0