I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just one) and have a database to store key - credentials pairs. User's credentials will be encrypted with the key from the database and the key stored in the database (different for each credentials) will be encrypted using KMS master key. AES encryption algorithms will be used for both: encrypting user's credentials and encrypting the key used to encrypt the credentials. Would it be secure enough to store encrypted key along with credentials or is there a better approach?
The real question to ask is "what is your threat model?" What sort of attack are you trying to prevent? Are you creating a digital lock on a diary to keep it safe from your sister's prying eyes, or are you Edward Snowden, on the run from several three letter agencies with billions of dollars of funding? AES-256 is currently labeled as sufficient to use in the US government for the transmission of TOP SECRET/SCI information. That's pretty much the highest classification level they could clear it for, so the US government is pretty darn confident that nobody can break AES-256 on the timescales required to protect our nation's greatest secrets. (Well, almost. What it really says is that they are confident that nobody outside of the US government can break AES-256. What you believe that that says about whether the US government, themselves, can break it depends on your threat model... and whether you engage in discussions of whether heavy-duty tin foil makes better hats or not)
AES key encryption is secure enough for keeping the data safe. In my opinion if the master key M is compromised, it can lead to decrypting all the key X. If you use a public key encryption to encrypt key X, only a partial of the data would be compromised. Say for example, there are two users U1 and U2, and there public keys be PubU1 and PubU2, private key be PriU1 and PriU2.
When U1 want to share his credentials with U2, the application uses PubU2 to encrypt the key X, so that when U2 want to access the data he will first decrypt using PriU2 and then uses key X to decrypt the data.