Permissions for restic commands - user that cannot forget/purge

[nunop]

Just linking this with some related concerns

Any way to get Restic to work with S3 Object Locking or a Read Only key?

Hello! Sorry for reviving a post that’s probably already old. I’m looking to improve security/protection of my restic buckets in AWS S3, in the event of a server being hacked and the hacker getting access to the IAM credentials (and destroying the backups with it). As mentioned above, be aware that s3:PutObject normally also allows to overwrite objects with whatever you like (garbage, empty objects) so this policy alone won’t be an effective ransomware protection - _IAM_USER_ID_ won’t be abl…