Sync AWS snapshots to secondary account - supplier ask for "swap" - security theathre?

Question

I'm managing an AWS account for a specific purpose for a company of 120 people. Another supplier of this company of around 5 people also has an AWS account.

To protect resources in an AWS account from malicious deletion, it is recommended to synchronise disk snapshots to a secondary account.

The other supplier has approached us to do a swap for this purpose: In their mind we are to store their secondary snapshot copies in our AWS account and they will store our secondary snapshots in their AWS account.

Apart from the commercial considerations - this sounds like security theathre to me? Isn't it just as good to find a second person at each of our organisations who has the login to a separate AWS account and synchronise our snapshots to that. This also resolves issues such as

• if they are supposed to automatically have access to everything we do (or we cannot back it up to another account)
• what happens if their supplier relationship goes sour
• the complexity of contacting the right person, which seems naturally easier within the same company

Answer 1

This is a bad idea to trust the third party supplier if you don not have to.

Use the principal of least priviledge.

Create your secondary account yourself, and lock the account credentials away in your business safe/lawyers office (and not in your operational password safes).

This will give the same backup advantages without the downside of trusting a(nother) third party (other than Amazon).

In general I appreciate the approach you are taking and think it is a cheap backup to avoid an ugly and probably rare problem.