##### SUMMARY
If you pass aws_kms an existing key_id and no alias, it throws exceptions

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION
```
ansible 2.8.2
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION
```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
DEFAULT_VAULT_IDENTITY_LIST(/home/mchappel/.ansible.cfg) = [u'original@/home/mchappel/.ansible/secrets/original', u'ssl@/home/mchappel/.ansible/secrets/ssl', u'jenkins@/home/mchappel/.ansible/secrets/jenkins']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7

##### STEPS TO REPRODUCE
```
     - name: Update Policy on key to match AWS Console generate policy
       aws_kms:
        key_id: '{{ new_key["keys"][0]["key_id"] }}'
         policy: "{{ lookup('template', 'console-policy.j2') | to_json }}"
       register: kms_policy_changed
```

##### EXPECTED RESULTS
Key successfully updated


##### ACTUAL RESULTS
Exception.  (There's actually a couple of places that need updating)


##### ADDITIONAL DETAILS
@willthames 

https://github.com/tremble/ansible/tree/aws_kms_keyid_only contains updated tests and a fix.  I'll submit a PR once we know what order everything's likely to get merged in.  Side effect of the change, aws_kms is substantially faster, as a result I had to more the iam_role creation in the test suite.
- Manage role/user access to a KMS key. Not designed for encrypting/decrypting.
version_added: "2.3"
options:
  alias:
    description: An alias for a key. For safety, even though KMS does not require keys
      to have an alias, this module expects all new keys to be given an alias
      to make them easier to manage. Existing keys without an alias may be
      referred to by I(key_id). Use M(aws_kms_info) to find key ids. Required
      if I(key_id) is not given. Note that passing a I(key_id) and I(alias)
      will only cause a new alias to be added, an alias will never be renamed.
      The 'alias/' prefix is optional.
    required: false
    aliases:
      - key_alias
  key_id:
    description:
    - Key ID or ARN of the key. One of C(alias) or C(key_id) are required.
    required: false
    aliases:
      - key_arn
  policy_mode:
    description:
    - (deprecated) Grant or deny access.
    - Used for modifying the Key Policy rather than modifying a grant and only
      works on the default policy created through the AWS Console.
    - This option has been deprecated, and will be removed in 2.13. Use I(policy) instead.
    default: grant
    choices: [ grant, deny ]
    aliases:
    - mode