##### SUMMARY
The documentation states the following:

```
encryption_key_id

KMS master key ID to use for the default encryption. This parameter is allowed if encryption is aws:kms. If not specified then it will default to the AWS provided KMS key.
```

However, omitting the variable yields the following:

```{"changed": false, "msg": "encryption is aws:kms but all of the following are missing: encryption_key_id"}```

due to these lines: https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/cloud/amazon/s3_bucket.py#L703-L704 .

Alternatively, specifying an empty string as key yields the following botocore exception:

```    "error": {
        "code": "InvalidArgument",
        "message": "if the default sse algorithm is aws:kms and a KMSMasterKeyID is specified, it must be non-empty",
        "argument_name": "ApplyServerSideEncryptionByDefault"
    },```

Specifying any other value will attempt to set the name of the key to that value.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME

s3_bucket

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below

```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
ansible 2.10.0.dev0
  config file = /deploy-data/ansible-deploy/ansible.cfg
  configured module search path = ['/deploy-data/ansible-deploy/library']
  ansible python module location = /var/lib/awx/venv/ansible/lib/python3.6/site-packages/ansible
  executable location = /var/lib/awx/venv/ansible/bin/ansible
  python version = 3.6.8 (default, Jan 14 2019, 11:02:34) [GCC 8.0.1 20180414 (experimental) [trunk revision 259383]]
```
This also applies to 2.9.0.dev0

##### OS / ENVIRONMENT

N/A

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
-  s3_bucket: This errors out because empty strings cannot be used
    name: "{{ bucket_name }}"
    region: "{{ region }}"
    encryption: "aws:kms"
    encryption_key_id: ""
-  s3_bucket: This errors out due to the key not being set
    name: "{{ bucket_name }}"
    region: "{{ region }}"
    encryption: "aws:kms"
-  name: This sets the key used to one named 'False'
    s3_bucket:
    name: "{{ bucket_name }}"
    region: "{{ region }}"
    encryption: "aws:kms"
    encryption_key_id: False
```

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->

As per the documented changes, it would be expected that the default S3 KMS would be applied to the bucket.

##### ACTUAL RESULTS

See above.
s3_url = module.params.get('s3_url')
    ceph = module.params.get('ceph')
    
    if not s3_url and 'S3_URL' in os.environ:
        s3_url = os.environ['S3_URL']
    if ceph and not s3_url:
        module.fail_json(msg='ceph flavour requires s3_url')
    
    
    if s3_url:
        for key in ['validate_certs', 'security_token', 'profile_name']:
            aws_connect_kwargs.pop(key, None)
    s3_client = get_s3_client(module, aws_connect_kwargs, location, ceph, s3_url)
    if s3_client is None:  
        module.fail_json(msg='Unknown error, failed to create s3 connection, no information from boto.')
    state = module.params.get("state")
    encryption = module.params.get("encryption")
    encryption_key_id = module.params.get("encryption_key_id")
    
    if encryption_key_id is not None and encryption is None:
        module.fail_json(msg="You must specify encryption parameter along with encryption_key_id.")
    elif encryption_key_id is not None and encryption != 'aws:kms':
        module.fail_json(msg="Only 'aws:kms' is a valid option for encryption parameter when you specify encryption_key_id.")
    if state == 'present':
        create_or_update_bucket(s3_client, module, location)
    elif state == 'absent':
        destroy_bucket(s3_client, module)
if __name__ == '__main__':
    main()