> make sure you're locking S3 and your local backups with different credentials, and the credentials to read the backups can't be gleaned from the credentials that write them

This is more or less an exact copy of how I would advise companies to set this up.