AWS Glue Data Catalog not encrypted by Customer Managed Key (CMK)
This policy identifies AWS Glue Data Catalog that is encrypted using the default KMS key instead of CMK (Customer Managed Key) or using the CMK that is disabled.

AWS Glue Data Catalog is a managed metadata repository centralizing schema information for AWS Glue resources, facilitating data discovery and management. To protect sensitive data from unauthorized access, users can specify CMK to get enhanced security, and control over the encryption key and comply with any regulatory requirements.

It is recommended to use a CMK to encrypt the AWS Glue Data Catalog as it provides complete control over the encrypted data.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To enable the encryption for Glue data catalog
1. Sign in to the AWS Management Console, Go to the AWS Management Console at https://console.aws.amazon.com/.
2. Navigate to the reported resource region by selecting the region from the dropdown in the top right corner.
3. Navigate to AWS Glue: In the 'Find Services' search box, type 'Glue' and select 'AWS Glue' from the search results.
4. Choose the 'Data Catalog' dropdown in the navigation pane and select 'Catalog settings'.
5. On the 'Data catalog settings' page, select the 'Metadata encryption' check box, and choose an AWS KMS CMK key that you are managing according to your business requirements.
Note: When you use a customer managed key to encrypt your Data Catalog, the Data Catalog provides an option to register an IAM role to encrypt and decrypt resources. You need to grant your IAM role permissions that AWS Glue can assume on your behalf. This includes AWS KMS permissions to encrypt and decrypt data.
6. To enable an IAM role that AWS Glue can assume to encrypt and decrypt data on your behalf, select the 'Delegate KMS operations to an IAM role' option.
7. Select an IAM role equipped with the necessary permissions to conduct the required KMS operations for AWS Glue to assume.
8. To Encrypt connection passwords, select 'Encrypt connection passwords', and choose an AWS KMS CMK key that you are managing according to your business requirements.
9. And click 'save'..

Query:
```config from cloud.resource where api.name = 'aws-glue-datacatalog' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '($.X.DataCatalogEncryptionSettings.EncryptionAtRest.CatalogEncryptionMode equals "DISABLED" or $.X.ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted equals "false") or ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId equals $.Y.keyMetadata.arn or $.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId starts with "alias/aws/")) or ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId equals $.Y.keyMetadata.arn or  $.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId starts with "alias/aws/"))' ; show X;```