In one of my mysql slave servers I have written a daily run script, which 1) stops slave, 2) takes a db dump, 3) starts slave again, 4) encrypts it, 5) copies it to my s3-bucket.
I am using aws-cli to copy the dump to s3-bucket. The issue here is that in case someone gets access to the server he can delete the dumps from the bucket as well, because the aws-cli grants update/delete access for a bucket.
How do I copy the dump to some place (preferably s3) from where if someone gets access to the db server can-not delete the dumps.
When thinking about it what I can come up is, I need a service on a different server which accepts the dump as input and then in turn saves it to s3. This service does not accept any other type of requests. This way I add an extra layer of security to the db backups. The problem is I dont know any such system.
More general question, how do people usually secure their data. If someone gets access to my master database, even by sql injection, he can cause all replications to truncate or delete. There needs to be some sort of regular backup to go back to, in any such case. In case of injection the backups are safe, but in case of access to server its not.