Some ARN validation

[aidansteele]

E.g. We know that KMS keys should begin with aws:arn:kms:<region>:<accountid> where regions alway follow a certain format and account IDs are always numeric. Return a nice error message rather than:

2018/09/11 10:35:48 Encryption error: RequestError: send request failed
caused by: Post https://kms.us-east-1a.amazonaws.com/: dial tcp: lookup kms.us-east-1a.amazonaws.com on 10.224.50.10:53: no such host

Which is caused by an accidental us-east-1a as the region.