Your master account (or superuser IAM account if you're paranoid) gives you read/write after 2FA login, but you could share your backup creds with the world and never have your backups pulled out or overwritten.
Use S3 lifecycle rules to expire backup objects after x days; data transfer in is free, the operation requests are pennies per thousand, only the bandwidth is expensive (10 cents/GB) to retrieve the backups when you need to perform a restore (even then, still very cheap).
Also, by storing in S3, you can backup and restore from anywhere.
My backup system involves my data storage system reaching out to each machine I want to backup and fetching the data locally.
All I need for that is to put my storage system's public key on the machines, and I'm fine with an attacker getting that.