So I was working on project with someone else. I was just using .env file to store secrets but then he told me that it's not the secure way to store secrets. So after digging around the internet I found AWS KMS and used to to encrypt the secret but now I'm in the same situation since I ended up with apiKeyId and apiSecretAccessKey. Now how to I store those even if I encrypt these keys two but then I will again end with some encryption key and so on.
So can anyone help me understand how to go around about it.

And Also If some attacker breached my server what could be some step which could be taken to prevent or at least minimize that