As the other commenter noted, this is why you’d give the backup keys the ability to upload data but not delete data. Combine that w/ S3 Object Versioning and y

As the other commenter noted, this is why you’d give the backup keys the ability to upload data but not delete data. Combine that w/ S3 Object Versioning and you’ve got a pretty solid approach.