Posture check: AWS KMS Key policy overly permissive
Query: ```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and policies.default.Statement[?any(Principal.AWS contains * and Effect equal ignore case allow and Condition does not exist)] exists```