title: Issue with AWS CLI commands / JMESPATH query
body: <p>Can anyone of you please help me in identifying the issue with the CLI commands /JMESPATH queries in the Section  - "What's Not Working? below</p>
  
  <p>P.S. JSON output given below is valid and you can use the output to test the JMESPATH query part of it out on JMESPATH.org</p>
  
  <h2>What Works?</h2>
  
  <p>1) <code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[]</code><br>
  2) <code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[].FromPort</code><br>
  3) <code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[].IpProtocol</code></p>
  
  <h2>What's Not Working?</h2>
  
  <p>1) <code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[?IpProtocol=='tcp'].IpProtocol</code><br>
  2) <code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[?FromPort=='22'].FromPort</code></p>
  
  <h2>JSON OUTPUT</h2>
  
  <pre><code>{
      "SecurityGroups": [
          {
              "Description": "default VPC security group",
              "GroupName": "default",
              "IpPermissions": [
                  {
                      "IpProtocol": "-1",
                      "IpRanges": [],
                      "Ipv6Ranges": [],
                      "PrefixListIds": [],
                      "UserIdGroupPairs": [
                          {
                              "GroupId": "sg-06d7c8d3300000000",
                              "UserId": "400000000000"
                          }
                      ]
                  }
              ],
              "OwnerId": "400000000000",
              "GroupId": "sg-06d7c000000000000",
              "IpPermissionsEgress": [
                  {
                      "IpProtocol": "-1",
                      "IpRanges": [
                          {
                              "CidrIp": "0.0.0.0/0"
                          }
                      ],
                      "Ipv6Ranges": [],
                      "PrefixListIds": [],
                      "UserIdGroupPairs": []
                  }
              ],
              "VpcId": "vpc-0d26c7ba200000000"
          },
          {
              "Description": "BastionSG",
              "GroupName": "BastionSG",
              "IpPermissions": [
                  {
                      "FromPort": 22,
                      "IpProtocol": "tcp",
                      "IpRanges": [
                          {
                              "CidrIp": "0.0.0.0/0"
                          }
                      ],
                      "Ipv6Ranges": [],
                      "PrefixListIds": [],
                      "ToPort": 22,
                      "UserIdGroupPairs": []
                  }
              ],
              "OwnerId": "400000000000",
              "GroupId": "sg-0a26abc0a00000000",
              "IpPermissionsEgress": [
                  {
                      "IpProtocol": "-1",
   "IpRanges": [
                          {
                              "CidrIp": "0.0.0.0/0"
                          }
                      ],
                      "Ipv6Ranges": [],
                      "PrefixListIds": [],
                      "UserIdGroupPairs": []
                  }
              ],
              "VpcId": "vpc-0d26c7ba200000000"
          }
      ]
  }
  </code></pre>
  
  <h2>Expected/Actual Results</h2>
  
  <p><code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[?IpProtocol=='tcp'].IpProtocol</code></p>
  
  <h2>Result</h2>
  
  <p>Expected - tcp, Actual - Returns no result</p>
  
  <p><code>aws ec2 describe-security-groups --query SecurityGroups[?GroupId=='sg-0a26abc0a00000000'].IpPermissions[?FromPort=='22'].FromPort</code></p>
  
  <h2>Result</h2>
  
  <p>Expected - 22, Actual - Returns no result</p>