aws cli update kms key policy