diff --git a/.gitignore b/.gitignore
index 8f7bddacd..7d3a7f3d2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@ dist/*
 .cache
 .tox
 .coverage
+coverage.xml
 cover/
 *.pyc
 *~
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8900250a5..03a4d1716 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,37 @@
 Moto Changelog
 ==============
 
+4.0.2
+-----
+Docker Digest for 4.0.2: <autopopulateddigest>
+
+    New Services:
+        * Amazon Managed Prometheus (AMP)
+            * create_rule_groups_namespace()
+            * create_workspace()
+            * delete_rule_groups_namespace()
+            * delete_workspace()
+            * describe_rule_groups_namespace()
+            * describe_workspace()
+            * list_rule_groups_namespaces()
+            * list_tags_for_resource()
+            * list_workspaces()
+            * put_rule_groups_namespace()
+            * tag_resource()
+            * untag_resource()
+            * update_workspace_alias()
+
+    Miscellaneous:
+        * APIGateway:put_method() now supports the requestParameters-parameter
+        * AutoScaling:create_auto_scaling_group() now supports the MixedInstancesPolicy-parameter
+        * CloudWatchLogs:filter_log_events() now supports the filterPattern-parameter
+        * DynamoDB:batch_put_item() now has validatior for empty keys
+        * Kinesis:create_stream() now supports stream-mode=OnDemand
+        * S3:head_object() now returns the PartsCount-header
+        * SNS:subscribe() now has increased support for the FilterPolicy-argument
+        * SSM now returns the /aws/service/ami-amazon-linux-latest-parameters as provided by AWS
+
+
 4.0.1
 -----
 Docker Digest for 4.0.1: _sha256:effbe303d0ac958569537b725e7632354deb6e9ce0a78ced1a2c6bdd4123831d_
diff --git a/IMPLEMENTATION_COVERAGE.md b/IMPLEMENTATION_COVERAGE.md
index fd1fc58d2..f2375f377 100644
--- a/IMPLEMENTATION_COVERAGE.md
+++ b/IMPLEMENTATION_COVERAGE.md
@@ -620,6 +620,7 @@
 - [X] create_invalidation
 - [ ] create_key_group
 - [ ] create_monitoring_subscription
+- [ ] create_origin_access_control
 - [ ] create_origin_request_policy
 - [ ] create_public_key
 - [ ] create_realtime_log_config
@@ -634,6 +635,7 @@
 - [ ] delete_function
 - [ ] delete_key_group
 - [ ] delete_monitoring_subscription
+- [ ] delete_origin_access_control
 - [ ] delete_origin_request_policy
 - [ ] delete_public_key
 - [ ] delete_realtime_log_config
@@ -655,6 +657,8 @@
 - [ ] get_key_group
 - [ ] get_key_group_config
 - [ ] get_monitoring_subscription
+- [ ] get_origin_access_control
+- [ ] get_origin_access_control_config
 - [ ] get_origin_request_policy
 - [ ] get_origin_request_policy_config
 - [ ] get_public_key
@@ -679,6 +683,7 @@
 - [ ] list_functions
 - [ ] list_invalidations
 - [ ] list_key_groups
+- [ ] list_origin_access_controls
 - [ ] list_origin_request_policies
 - [ ] list_public_keys
 - [ ] list_realtime_log_configs
@@ -696,6 +701,7 @@
 - [ ] update_field_level_encryption_profile
 - [ ] update_function
 - [ ] update_key_group
+- [ ] update_origin_access_control
 - [ ] update_origin_request_policy
 - [ ] update_public_key
 - [ ] update_realtime_log_config
@@ -6298,6 +6304,7 @@
 - connect-contact-lens
 - connectcampaigns
 - connectparticipant
+- controltower
 - cur
 - customer-profiles
 - dataexchange
diff --git a/docs/docs/services/cloudfront.rst b/docs/docs/services/cloudfront.rst
index 4be6f846b..e8a55a4f4 100644
--- a/docs/docs/services/cloudfront.rst
+++ b/docs/docs/services/cloudfront.rst
@@ -42,6 +42,7 @@ cloudfront
 - [X] create_invalidation
 - [ ] create_key_group
 - [ ] create_monitoring_subscription
+- [ ] create_origin_access_control
 - [ ] create_origin_request_policy
 - [ ] create_public_key
 - [ ] create_realtime_log_config
@@ -61,6 +62,7 @@ cloudfront
 - [ ] delete_function
 - [ ] delete_key_group
 - [ ] delete_monitoring_subscription
+- [ ] delete_origin_access_control
 - [ ] delete_origin_request_policy
 - [ ] delete_public_key
 - [ ] delete_realtime_log_config
@@ -82,6 +84,8 @@ cloudfront
 - [ ] get_key_group
 - [ ] get_key_group_config
 - [ ] get_monitoring_subscription
+- [ ] get_origin_access_control
+- [ ] get_origin_access_control_config
 - [ ] get_origin_request_policy
 - [ ] get_origin_request_policy_config
 - [ ] get_public_key
@@ -110,6 +114,7 @@ cloudfront
 - [ ] list_functions
 - [ ] list_invalidations
 - [ ] list_key_groups
+- [ ] list_origin_access_controls
 - [ ] list_origin_request_policies
 - [ ] list_public_keys
 - [ ] list_realtime_log_configs
@@ -132,6 +137,7 @@ cloudfront
 - [ ] update_field_level_encryption_profile
 - [ ] update_function
 - [ ] update_key_group
+- [ ] update_origin_access_control
 - [ ] update_origin_request_policy
 - [ ] update_public_key
 - [ ] update_realtime_log_config