How to get AWS-managed key for encrpyting RDS database instance

How is CDK supposed to grab an AWS-managed key for an RDS database instance's StorageEncryptionKey property? I tried

var encryptionKey = Key.FromLookup(this, "aws/rds", new KeyLookupOptions { AliasName = "aws/rds" });
var encryptionKey = Key.FromKeyArn(this, "aws/rds", _wellKnownKmsKeyArn);

but both return null.