The Security Configuration Audit Policy syntax used by the Policy Builder is as follows:

You start building the policy by selecting resource type. Resource type is a service provided by IaaS CSPs such as EC2, S3, or an Azure storage account. 

Policy Syntax : IF <policy_ruleset> THEN Severity is <severity>

• policy_ruleset. A set of one or multiple policy rules. The first policy rule always starts with IF statement.
• Policy Rule. A conditional statement that can start either with AND or OR. 
  For example, AND <resource_attribute> <operator> <resource_attribute_value(s)>.
• resource_attribute. Each resource type has specific attributes. Some attributes are simple and some are complex. Complex attributes are from the sub-resource type that are related to the parent resource type. For example, the attribute VPC is where the EC2 instance is located. Here EC2 is a resource type, VPC is a sub-resource type, and the complex resource attribute is VPC.VPCFlowLog.VPCFlowLogId.

• attribute group. A policy rule can also have an attribute group, which is a group of attributes. Attribute groups can't be given a value, but the content of the groups can be defined. If no attribute under an attribute group is set, then the group is considered NOT SET. Supported operators for attribute group are Count, Is set, and Is not set.
• resource_attribute_value. A value assigned to a resource attribute. Depending on the type of resource attribute, you can assign single or multiple values. The policy builder pre-populates sample attribute values wherever applicable.
• Severity. Defines the severity of the incident generated upon execution of the policy. Supported values are Critical, Major, Minor, Warning, and Info.