##### SUMMARY

If you attempt to modify the policy on an existing KMS CMK using aws_kms's "policy" option this doesn't appear to get updated.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION

```
ansible 2.8.1
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION

```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7 + AWS


##### STEPS TO REPRODUCE

- Create KMS CMK
- Attempt to update policy using the 'policy' option on aws_kms

```
    - name: 'Update policy on KMS Keys'
      aws_kms:
        key_id: '{{ kms_key.id }}'
        alias: '{{ kms_key.alias | default(omit) }}'
        policy: ' {{ kms_current_policy | to_json }}'
```

##### EXPECTED RESULTS
KMS Policy is updated

##### ACTUAL RESULTS
KMS Policy stays the same
state=dict(default='present', choices=['present', 'absent']),
        )
    )
    module = AnsibleAWSModule(
        supports_check_mode=True,
        argument_spec=argument_spec,
        required_one_of=[['alias', 'key_id']],
    )
    result = {}
    mode = module.params['policy_mode']
    kms = module.client('kms')
    iam = module.client('iam')
    all_keys = get_kms_facts(kms, module)
    key_id = module.params.get('key_id')
    alias = module.params.get('alias')
    if alias.startswith('alias/'):
        alias = alias[6:]
    if key_id:
        filtr = ('key-id', key_id)
    elif module.params.get('alias'):
        filtr = ('alias', alias)
    candidate_keys = [key for key in all_keys if key_matches_filter(key, filtr)]
    if module.params.get('policy_grant_types') or mode == 'deny':
        module.deprecate('Managing the KMS IAM Policy via policy_mode and policy_grant_types is fragile'
                         ' and has been deprecated in favour of the policy option.', version='2.13')
        if module.params.get('policy_role_name') and not module.params.get('policy_role_arn'):
            module.params['policy_role_arn'] = get_arn_from_role_name(iam, module.params['policy_role_name'])
        if not module.params.get('policy_role_arn'):
            module.fail_json(msg='policy_role_arn or policy_role_name is required to {0}'.format(module.params['policy_mode']))