Posture check: AWS Certificate Manager (ACM) has certificates expiring in 30 days or less
Query: ```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-acm-describe-certificate' AND json.rule = 'status equals ISSUED and (_DateTime.ageInDays($.notAfter) > -31)'```