clunky
policies will work for a time and then not work. Ambiguous reasons why something failed show up in the log about not being able to locate a key even though 5 other db's in the same policy copied fine using the same key reference when copying to Cross Account/Cross Region. Cleanup is a nightmare if you're trying to copy Cross Account/Cross Region.