Posture check: AWS RDS DB cluster is encrypted using default KMS key instead of CMK
Query: ```config from cloud.resource where api.name = 'aws-rds-db-cluster' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '($.X.storageEncrypted is true) and ($.X.kmsKeyId equals $.Y.key.keyArn) and ($.Y.keyMetadata.keyManager does not contain CUSTOMER)' ; show X;```