##### SUMMARY
If you pass aws_kms an existing key_id from another account (for example so you can set up a grant) it uses key['key_id'] in update_policy which effectively strips the account part of the ARN and results in a DescribeKey operation being called against the current account rather than the 

```
NotFoundException: An error occurred (NotFoundException) when calling the DescribeKey operation: Key '...' does not exist
```

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION
```
ansible 2.8.2
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION
```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
DEFAULT_VAULT_IDENTITY_LIST(/home/mchappel/.ansible.cfg) = [u'original@/home/mchappel/.ansible/secrets/original', u'ssl@/home/mchappel/.ansible/secrets/ssl', u'jenkins@/home/mchappel/.ansible/secrets/jenkins']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7

##### STEPS TO REPRODUCE

- Create a CMK in Account 1 and *share* it with Account 2
- Grant user from Account 2 permissions to access the CMK in Account 1
- Using User from Account 2 attempt to access the CMK

```
      - aws_kms:
          key_id: 'arn:aws:kms:us-west-2:XXX-Account-1-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
```

##### EXPECTED RESULTS

```
TASK [aws_kms] *******************************************************************************************************************************************************************************************************************************
Monday 19 August 2019  11:35:36 +0200 (0:00:00.051)       0:00:01.490 ********* 
ok: [mchappel]
```


##### ACTUAL RESULTS

```
TASK [aws_kms] *******************************************************************************************************************************************************************************************************************************
Monday 19 August 2019  10:49:37 +0200 (0:00:00.025)       0:00:01.284 ********* 
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: NotFoundException: An error occurred (NotFoundException) when calling the DescribeKey operation: Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist
fatal: [mchappel]: FAILED! => {"boto3_version": "1.4.6", "botocore_version": "1.6.0", "changed": false, "error": {"code": "NotFoundException", "message": "Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist"}, "msg": "Failed to obtain key metadata: An error occurred (NotFoundException) when calling the DescribeKey operation: Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist", "response_metadata": {"http_headers": {"cache-control": "no-cache, no-store, must-revalidate, private", "content-length": "139", "content-type": "application/x-amz-json-1.1", "date": "Mon, 19 Aug 2019 08:49:41 GMT", "expires": "0", "pragma": "no-cache", "x-amzn-requestid": "2c29ad8c-348c-4ef2-9260-8fb1f21407b1"}, "http_status_code": 400, "request_id": "2c29ad8c-348c-4ef2-9260-8fb1f21407b1", "retry_attempts": 0}}
```

##### ADDITIONAL DETAILS

@willthames 

Again I have a fix (unable to create a test because the integration tests all expect to work with a single account...) will submit a MR once we've got your test fixes in and start merging.

try:
        result = get_kms_metadata_with_backoff(connection, key_id)['KeyMetadata']
    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
        module.fail_json_aws(e, msg="Failed to obtain key metadata")
    result['KeyArn'] = result.pop('Arn')
    try:
        aliases = get_kms_aliases_lookup(connection)
    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
        module.fail_json_aws(e, msg="Failed to obtain aliases")
    result['aliases'] = aliases.get(result['KeyId'], [])
    result = camel_dict_to_snake_dict(result)
    
    try:
        result['grants'] = [camel_to_snake_grant(grant) for grant in
                            get_kms_grants_with_backoff(connection, key_id)['Grants']]
    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
        module.fail_json_aws(e, msg="Failed to obtain key grants")
    tags = get_kms_tags(connection, module, key_id)
    result['tags'] = boto3_tag_list_to_ansible_dict(tags, 'TagKey', 'TagValue')
    result['policies'] = get_kms_policies(connection, module, key_id)
    return result
def get_kms_facts(connection, module):
    try:
        keys = get_kms_keys_with_backoff(connection)['Keys']
    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
        module.fail_json_aws(e, msg="Failed to obtain keys")
    return [get_key_details(connection, module, key['KeyId']) for key in keys]
def convert_grant_params(grant, key):