1st level of protection is by keeping your live production data & backup data in separate accounts. (If 1 account gets compromised the other is still available

1st level of protection is by keeping your live production data & backup data in separate accounts. (If 1 account gets compromised the other is still available) Perhaps 2nd level is by using cloud specific features - such as AWS S3 Object locks (even owner can't delete the object till the retention period). my 2cents