##### SUMMARY

If you attempt to modify the policy on an existing KMS CMK using aws_kms's "policy" option this doesn't appear to get updated.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION

```
ansible 2.8.1
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION

```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7 + AWS


##### STEPS TO REPRODUCE

- Create KMS CMK
- Attempt to update policy using the 'policy' option on aws_kms

```
    - name: 'Update policy on KMS Keys'
      aws_kms:
        key_id: '{{ kms_key.id }}'
        alias: '{{ kms_key.alias | default(omit) }}'
        policy: ' {{ kms_current_policy | to_json }}'
```

##### EXPECTED RESULTS
KMS Policy is updated

##### ACTUAL RESULTS
KMS Policy stays the same
if to_remove:
        for grant in to_remove:
            try:
                connection.retire_grant(KeyId=key['key_arn'], GrantId=grant['grant_id'])
                changed = True
            except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
                module.fail_json_aws(e, msg="Unable to retire grant")
    if to_add:
        for grant in to_add:
            grant_params = convert_grant_params(grant, key)
            try:
                connection.create_grant(**grant_params)
                changed = True
            except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
                module.fail_json_aws(e, msg="Unable to create grant")
    
    result = get_key_details(connection, module, key['key_id'])
    module.exit_json(changed=changed, **result)
def create_key(connection, module):
    params = dict(BypassPolicyLockoutSafetyCheck=False,
                  Tags=ansible_dict_to_boto3_tag_list(module.params['tags'], tag_name_key_name='TagKey', tag_value_key_name='TagValue'),
                  KeyUsage='ENCRYPT_DECRYPT',
                  Origin='AWS_KMS')
    if module.params.get('description'):
        params['Description'] = module.params['description']
    if module.params.get('policy'):
        params['Policy'] = module.params['policy']
    try:
        result = connection.create_key(**params)['KeyMetadata']
    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e: