AWS RDS DB cluster encryption is disabled
This policy identifies RDS DB clusters for which encryption is disabled. Amazon Aurora encrypted DB clusters provide an additional layer of data protection by securing your data from unauthorized access to the underlying storage. You can use Amazon Aurora encryption to increase data protection of your applications deployed in the cloud, and to fulfill compliance requirements for data-at-rest encryption.
NOTE: This policy is applicable only for Aurora DB clusters.
https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-clusters.html
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: AWS DB clusters can be encrypted only while creating the database cluster. You can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted Aurora DB cluster snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS encryption key when you restore from the unencrypted DB cluster snapshot.

For AWS RDS,
1. To create a 'Snapshot' of the unencrypted DB cluster, follow the instruction mentioned in below link:
RDS Link: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_CreateSnapshotCluster.html

NOTE: As you can't restore from a DB cluster snapshot to an existing DB cluster; a new DB cluster is created when you restore. Once the Snapshot status is 'Available', delete the unencrypted DB cluster before restoring from the DB cluster Snapshot by following below steps for AWS RDS,
a. Sign to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/
b. In the navigation pane, choose 'Databases'.
c. In the list of DB instances, choose a writer instance for the DB cluster.
d. Choose 'Actions', and then choose 'Delete'.

2. To restoring the Cluster from a DB Cluster Snapshot, follow the instruction mentioned in below link:
RDS Link: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_RestoreFromSnapshot.html

For AWS Document DB,
1. To create a 'Snapshot' of the unencrypted DB cluster, follow the instruction mentioned in below link:
Document DB Link: https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-create_manual_cluster_snapshot.html

NOTE: As you can't restore from a DB cluster snapshot to an existing DB cluster; a new DB cluster is created when you restore. Once the Snapshot status is 'Available', delete the unencrypted DB cluster before restoring from the DB cluster Snapshot by following below steps for AWS Document DB, 
  a. Sign to the AWS Management Console and open the Amazon DocumentDB console at https://console.aws.amazon.com/docdb/
  b. In the navigation pane, choose 'Clusters'.
  c. Select the cluster from the list which needs to be deleted
  d. Choose 'Actions', and then choose 'Delete'.

2. To restoring the Cluster from a DB Cluster Snapshot, follow the instruction mentioned in below link:
Document DB Link: https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-restore_from_snapshot.html.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-db-cluster' AND json.rule =  'storageEncrypted is false'```