You're right master access to S3 should never be on your servers. Permission to deleting object versions from your backup bucket should be reserved for the high

You're right master access to S3 should never be on your servers. Permission to deleting object versions from your backup bucket should be reserved for the highest level of trust in your organization. These permissions shouldn't be accessible via a key sitting around on a computer, but should only be accessible to a person logging in with MFA. With such access only accessible to a person with MFA, it should be pretty hard to accidentally leak the secret (MFA-authenticated sessions have tokens that are time-limited). If even those AWS permissions are compromised, yes, you could lose your backups, but I hope you don't use S3 as your sole backup storage. I keep backups on both a local backup server and also in S3. If my AWS credentials are compromised, there should be no access to the local server. If someone accesses my local server, the access it has won't allow deleting S3 backups. Since my backups are encrypted, the attacker would have to also have the key to the backups to read the content.