##### SUMMARY

If you attempt to modify the policy on an existing KMS CMK using aws_kms's "policy" option this doesn't appear to get updated.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION

```
ansible 2.8.1
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION

```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7 + AWS


##### STEPS TO REPRODUCE

- Create KMS CMK
- Attempt to update policy using the 'policy' option on aws_kms

```
    - name: 'Update policy on KMS Keys'
      aws_kms:
        key_id: '{{ kms_key.id }}'
        alias: '{{ kms_key.alias | default(omit) }}'
        policy: ' {{ kms_current_policy | to_json }}'
```

##### EXPECTED RESULTS
KMS Policy is updated

##### ACTUAL RESULTS
KMS Policy stays the same
- Manage role/user access to a KMS key. Not designed for encrypting/decrypting.
version_added: "2.3"
options:
  alias:
    description: An alias for a key. For safety, even though KMS does not require keys
      to have an alias, this module expects all new keys to be given an alias
      to make them easier to manage. Existing keys without an alias may be
      referred to by I(key_id). Use M(aws_kms_info) to find key ids. Required
      if I(key_id) is not given. Note that passing a I(key_id) and I(alias)
      will only cause a new alias to be added, an alias will never be renamed.
      The 'alias/' prefix is optional.
    required: false
    aliases:
      - key_alias
  key_id:
    description:
    - Key ID or ARN of the key. One of C(alias) or C(key_id) are required.
    required: false
    aliases:
      - key_arn
  policy_mode:
    description:
    - (deprecated) Grant or deny access.
    - Used for modifying the Key Policy rather than modifying a grant and only
      works on the default policy created through the AWS Console.
    - This option has been deprecated, and will be removed in 2.13. Use I(policy) instead.
    default: grant
    choices: [ grant, deny ]
    aliases:
    - mode