This is very common in ransomware now. In that “explore” phase, the attackers are mapping out where you’ve backed up to. Because they know if you have backups, you’re not going to pay. So in using AWS, a whole separate account that is write-only from your main account is key. Again, accounts are free. So you’re not going to be paying more. But as a new account, you get a nice hard boundary where you can lock all the permission down and create one role that allows new backups to be created and nothing else. This way you keep everything completely separate.