[aws-sns] SNS encryption should support KMS keys cross acount

[relm923]

The current aws-sns module supports enabling encryption with KMS CMKs but only works when the key and the topic reside in the same account because CDK is using the KMS KeyId link instead of the KMS KeyArn

Reproduction Steps

// Creating Stack in account 222222222222

const myKeyImported = kms.Key.fromKeyArn(this, 'MyImportedKey', 'arn:aws:kms:us-east-1:111111111111:key/1234abcd-12ab-34cd-56ef-1234567890ab');

const topic = new Topic(this, 'MyEncryptedTopic', { masterKey: myKeyImported });

// Resulting CF template has:
KmsMasterKeyId: "1234abcd-12ab-34cd-56ef-1234567890ab"

What did you expect to happen?

The topic should be configured with the KMS keyArn so the account information is retained correctly

What actually happened?

This topic will be unusable because SNS/KMS cannot locate the specified key it in account 222222222222

Environment

• **CLI Version : ** 1.61.1
• **Framework Version: ** 1.61.1
• Node.js Version: 12.18.3
• OS : MacOS
• Language (Version): TypeScript (3.8.3)

Other

AWS Docs

Cross-account use: Yes. To perform this operation with a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter.

---

This is 🐛 Bug Report