Question: Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server?

I am storing encrypted information in a MySQL database and my cryptography key is stored in code. Data is encoded/decoded using this key when saving/retrieving from the database. Obviously, I do not want anyone to have access to this key. If the machine is compromised, so is the source (dang but that's life) and perhaps the MySql database too. Since the source is available, so is the key and the attacker can decrypt the data.

What is the best way to avoid storing the key on the server? I assume it would be storing it on a different server but that seems to pass the ball around a little and not solve the actual problem.

Another question could be 'should I even be using an AWS EC2 server' and how secure are one of these things if all patches are applied.

Does anyone have any insight on this sort of situation? I am a pretty good programmer but not the best versed in security.

Answer: 
I do not notice anywhere in your description that you are encrypting your traffic. Are you sending your hash in the clear?
If so, I am thinking, what would prevent an eavesdropper from intercepting the hash and reuse it?

Another question is, how do you attempt to keep your list of allowable passwords which "keep changing"?
First vulnerability is around using SHA1 hashes. SHA1 hash based collisions are relatively highly probable with modern compute power. See [SHA1-collisions](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)

What this means is the rogue party can capture those hashes on the wire and brute force them. Even worse, if the attacker gets into your server and obtains the *limited* set allowed, it narrows down the problem significantly.