* Remove dead code key_matches_filter/key_matches_filters * Fail more cleanly when we don't recognise the 'shape' of KMS policy * Refactor aws_kms to bring down the complexity * Minor docs tweaks * Changelog fragment * Fixups from review
