This is a best practice for disaster recovery. The most brilliant teams with IAM only do well to the account level granularity. A compromised AWS account that would allow a threat actor to delete data would also allow them to delete the backup data. Require replication to another account for DR.

When effective DR is required

S3

Medium

AWS

Will Bengtson