Posture check: AWS KMS customer managed external key expiring in 30 days or less
Query: ```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = 'keyMetadata.origin contains EXTERNAL and keyMetadata.keyManager contains CUSTOMER and keyMetadata.enabled is true and (_DateTime.ageInDays($.keyMetadata.validTo) > -30)'```