Every backup in one provider, and a plan that assumed the disaster would be local rather than at the provider.
the failure modes, ranked by likelihood:
1 a credential compromised and buckets emptied
2 a mistake — a lifecycle rule, a wrong prefix
3 a provider outage of hours
4 a provider ending the service
the existing arrangement survived none of 1 and 2, and
those are the likely ones.
the second copy: a different provider, credentials that
can PutObject and nothing else, object lock, and a key
held in neither.Ranking the failure modes is what makes this a design rather than a reflex — a second provider addresses the unlikely cases and the write-only credential with object lock addresses the likely ones, and only one of those requires a second provider at all. Doing both is defensible and it is worth knowing which half is doing the work.