at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the message with the encrypted data key, IV, tag etc. The client then calls AWS KMS to decrypt the data key to decrypt the message. I have implemented this looking at the AWS docs. I am caching the data key for a while for reuse before generating a new one.
One colleague, that is better at cryptography than me, thinks this is unsafe due to sending the key with the message, that this might lead to figuring out the master key? He recommends ECDH which has better key distribution, using a shared secret with private/public keys to generate the AES key. The problem with this I feel is that I need to store public/private key pair somewhere, and both of these methods needs access to a secret (KMS key or private key).
I am looking for other opinions on how secure these different methods are. What are the difference really in vulnerability?
Edit: Clarification: The master key is a specific key created only for encrypting data keys for these messages to one specific client, nothing else. Docs from AWS that I used: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#enveloping