Posture check: AWS Glue Data Catalog not encrypted by Customer Managed Key (CMK)
Query: ```config from cloud.resource where api.name = 'aws-glue-datacatalog' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '($.X.DataCatalogEncryptionSettings.EncryptionAtRest.CatalogEncryptionMode equals "DISABLED" or $.X.ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted equals "false") or ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId equals $.Y.keyMetadata.arn or $.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId starts with "alias/aws/")) or ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId equals $.Y.keyMetadata.arn or  $.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId starts with "alias/aws/"))' ; show X;```