I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an encryption key which is stored in the Secret Manager on AWS. This implies that I use the Secret ARN to get the key. I have implemented a PHP script which uses this ARN as a secret name.
This way I do not need pure credentials for accessing the password and the encryption key.
The problem I thought about is the following scenario: Attacker A gets access to the webserver. As I have to use the hard coded ARN from Secret Manager as a Secret name, the attacker might change the PHP script and print out the resulting password and encryption key from AWS. Is there any way to stop this or should the security design be different for getting a key? I do not see a solution how I might prevent an attacker to get the password if he has access to the server.