Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server?
I am storing encrypted information in a MySQL database and my cryptography key is stored in code. Data is encoded/decoded using this key when saving/retrieving from the database. Obviously, I do not want anyone to have access to this key. If the machine is compromised, so is the source (dang but that's life) and perhaps the MySql database too. Since the source is available, so is the key and the attacker can decrypt the data.
What is the best way to avoid storing the key on the server? I assume it would be storing it on a different server but that seems to pass the ball around a little and not solve the actual problem.
Another question could be 'should I even be using an AWS EC2 server' and how secure are one of these things if all patches are applied.
Does anyone have any insight on this sort of situation? I am a pretty good programmer but not the best versed in security.