Enhance macie-kms-todo.py to handle cross account keys

request is to enhance this script to identify cases when the a KMS key associated with a bucket is from a different account than the bucket. Currently when the script runs if the key attached to the bucket is from another account there is a misleading error message back of: NotFoundException: An error occurred (NotFoundException) when calling the GetKeyPolicy operation: Key
'arn:aws:kms:::key/' does not exist.

Ask is for the script to have the following extra checks so that this tool will work for the cross account key use case
If the account ID on the key is different from the account that the script is running in then no need to try and look at the policy as it will not work.
Write out a separate file of all the keys that are cross account keys which cannot be evaluated in the current account. File should be grouped by account in the case that keys from more than one account are in use. Allow the output of that script to be fed into the macie-kms-todo.py script as a parameter, so it can be run against the account where they keys are, and when this parameter is populated go right to evaluating the keys and their permissions, no need to check the buckets. Then output the script that will add the necessary grants to the key.