Object lock, and a deletion that could not happen

A second backup copy that survives a compromised credential, which requires the storage to refuse deletion rather than the credential to lack permission.

aws s3api put-object-lock-configuration 
  --bucket turkerdev-backups-offsite 
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {"DefaultRetention": {"Mode": "COMPLIANCE", "Days": 35}}
  }'

# COMPLIANCE mode: not even the account root can delete
# an object before the retention expires.

A write-only credential protects against a compromised backup process and not against a compromised account, which is the failure mode that actually destroys backups. Compliance mode means the objects cannot be deleted by anybody for thirty-five days including us — the storage cost is bounded and the mistake it makes irreversible is deliberate.