checkout https://github.com/restic/restic you can automate taking incremental backups and shipping them to another location (e.g S3 bucket) which are encrypted by restic so not even AWS can decode them.

You could setup some lifecycles in the bucket as well to prefer deep glacier storage for the cheapest storage tier