List-type sub-items in policies don't happen to be order-sensitive, but
    compare operations will render them unequal, leading to non-idempotent
    state runs.  We'll sort any list-type subitems before comparison to reduce
    the likelihood of false negatives.

def _sort_policy(doc):
    '''
    List-type sub-items in policies don't happen to be order-sensitive, but
    compare operations will render them unequal, leading to non-idempotent
    state runs.  We'll sort any list-type subitems before comparison to reduce
    the likelihood of false negatives.
    '''
    if isinstance(doc, list):
        return sorted([_sort_policy(i) for i in doc])
    elif isinstance(doc, (dict, OrderedDict)):
        return dict([(k, _sort_policy(v)) for k, v in six.iteritems(doc)])
    return doc