GUARDRAIL "[CIS - AWS] 3.6 Ensure rotation for customer-created symmetric CMKs is enabled"
  WHEN aws_kms_key.customer_master_key_spec NOT EXISTS OR aws_kms_key.customer_master_key_spec = "SYMMETRIC_DEFAULT"
    REQUIRE enable_key_rotation = true
  OVERRIDE WITH APPROVAL @security