You can also enable versioning and deny all s3:DeleteObject actions via the bucket policy. It won’t stop a root account compromise unless you’ve got a multi-ac

You can also enable versioning and deny all s3:DeleteObject actions via the bucket policy. It won’t stop a root account compromise unless you’ve got a multi-account setup going (as they could edit the bucket policy). But if you’ve not got any monitoring, they could also just remove the lock on the objects without you noticing and wait for the timeout themselves.