Proper handling of KMS keys.

This never worked according to AWS spec / docs.
Configuring the KMS keys must be done in ARN format, requests with SDK
or CLI are done with the KMS-key-ID only.

Fixes #702