&gt; make sure you&#x27;re locking S3 and your local backups with different credentials, and the credentials to read the backups can&#x27;t be gleaned from the credentials that write them<p>This is more or less an exact copy of how I would advise companies to set this up.