Have you tried AWS Secrets Manager (or Parameter Store). It's built for exactly this purpose.
Create a separate IAM Role for the backup process, and grant the required EC2 instance that IAM role. Then modify your script to call Secrets Manager to obtain the credentials and and don't store those credentials anyway except in the memory of the running process. (i.e. purge it once the process is one).
In the background, the EC2 instance will have a metadata instance that issues tokens that the script can use to call Secrets Manager. Once it's able to call secrets manager, it can get the actual db credentials to call your DB. Even deeper, the meta-data service issues only temporary tokens for the IAM role, which makes this approach even better.
A more old-skool method, would be to generate the API Keys for the IAM role, and hard-code those credentials onto the ~/.aws/credentials location of your EC2. Then your AWS SDK will use it to call AWS Secrets Manager with the same concept.
Ultimately, the concept is the same, use an API key to call an API that returns the actual credentials used. That API call is logged (cloudtrail) and returns only those credentials necessary to the call.