> what happens if your primary gets pwned and the access is used to encrypt or delete the backup? Append-only permissions. We do this in S3 for that specific r

> what happens if your primary gets pwned and the access is used to encrypt or delete the backup? Append-only permissions. We do this in S3 for that specific reason. S3 lifecycle rules take care of pruning old backups. You can also build a pull-based system where auth resides on the backup system, not the production system.