##### SUMMARY
If you pass aws_kms an existing key_id from another account (for example so you can set up a grant) it uses key['key_id'] in update_policy which effectively strips the account part of the ARN and results in a DescribeKey operation being called against the current account rather than the 

```
NotFoundException: An error occurred (NotFoundException) when calling the DescribeKey operation: Key '...' does not exist
```

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
lib/ansible/modules/cloud/amazon/aws_kms.py

##### ANSIBLE VERSION
```
ansible 2.8.2
  config file = /home/mchappel/.ansible.cfg
  configured module search path = [u'/home/mchappel/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
```

##### CONFIGURATION
```
DEFAULT_CALLBACK_WHITELIST(/home/mchappel/.ansible.cfg) = [u'timer', u'profile_tasks']
DEFAULT_VAULT_IDENTITY_LIST(/home/mchappel/.ansible.cfg) = [u'original@/home/mchappel/.ansible/secrets/original', u'ssl@/home/mchappel/.ansible/secrets/ssl', u'jenkins@/home/mchappel/.ansible/secrets/jenkins']
HOST_KEY_CHECKING(/home/mchappel/.ansible.cfg) = False
RETRY_FILES_ENABLED(/home/mchappel/.ansible.cfg) = False
```

##### OS / ENVIRONMENT
RHEL7

##### STEPS TO REPRODUCE

- Create a CMK in Account 1 and *share* it with Account 2
- Grant user from Account 2 permissions to access the CMK in Account 1
- Using User from Account 2 attempt to access the CMK

```
      - aws_kms:
          key_id: 'arn:aws:kms:us-west-2:XXX-Account-1-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
```

##### EXPECTED RESULTS

```
TASK [aws_kms] *******************************************************************************************************************************************************************************************************************************
Monday 19 August 2019  11:35:36 +0200 (0:00:00.051)       0:00:01.490 ********* 
ok: [mchappel]
```


##### ACTUAL RESULTS

```
TASK [aws_kms] *******************************************************************************************************************************************************************************************************************************
Monday 19 August 2019  10:49:37 +0200 (0:00:00.025)       0:00:01.284 ********* 
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: NotFoundException: An error occurred (NotFoundException) when calling the DescribeKey operation: Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist
fatal: [mchappel]: FAILED! => {"boto3_version": "1.4.6", "botocore_version": "1.6.0", "changed": false, "error": {"code": "NotFoundException", "message": "Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist"}, "msg": "Failed to obtain key metadata: An error occurred (NotFoundException) when calling the DescribeKey operation: Key 'arn:aws:kms:us-west-2:XXX-Account-2-XXX:key/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not exist", "response_metadata": {"http_headers": {"cache-control": "no-cache, no-store, must-revalidate, private", "content-length": "139", "content-type": "application/x-amz-json-1.1", "date": "Mon, 19 Aug 2019 08:49:41 GMT", "expires": "0", "pragma": "no-cache", "x-amzn-requestid": "2c29ad8c-348c-4ef2-9260-8fb1f21407b1"}, "http_status_code": 400, "request_id": "2c29ad8c-348c-4ef2-9260-8fb1f21407b1", "retry_attempts": 0}}
```

##### ADDITIONAL DETAILS

@willthames 

Again I have a fix (unable to create a test because the integration tests all expect to work with a single account...) will submit a MR once we've got your test fixes in and start merging.

- Manage role/user access to a KMS key. Not designed for encrypting/decrypting.
version_added: "2.3"
options:
  alias:
    description: An alias for a key. For safety, even though KMS does not require keys
      to have an alias, this module expects all new keys to be given an alias
      to make them easier to manage. Existing keys without an alias may be
      referred to by I(key_id). Use M(aws_kms_info) to find key ids. Required
      if I(key_id) is not given. Note that passing a I(key_id) and I(alias)
      will only cause a new alias to be added, an alias will never be renamed.
      The 'alias/' prefix is optional.
    required: false
    aliases:
      - key_alias
  key_id:
    description:
    - Key ID or ARN of the key. One of C(alias) or C(key_id) are required.
    required: false
    aliases:
      - key_arn
  policy_mode:
    description:
    - (deprecated) Grant or deny access.
    - Used for modifying the Key Policy rather than modifying a grant and only
      works on the default policy created through the AWS Console.
    - This option has been deprecated, and will be removed in 2.13. Use I(policy) instead.
    default: grant
    choices: [ grant, deny ]
    aliases:
    - mode