S3 content protection and deletion methods

Hi there,

I'm looking to compile a complete list of ways to protect data in S3 from accidental or malicious deletion. Assuming that Object locking is not in play, and that we can't rely on cross-region replication for a redundant copy, are there any other ways to completely destroy data aside from the following:

1. DeleteObject API Call from an authenticated IAM principal (be that a role or a user)
2. PutObject API Call over an existing object without object versioning in play.
3. A lifecycle policy that deletes objects.
4. The Root user issues a DeleteObject Call

Note that in certain infrequent administrative circumstances, I will need to still be able to delete an object (So object locking with compliance mode is not usable here)

In short, It appears that data can be protected from Administrators (: permissions on *) by doing the following (please confirm?):

Either:

1. Implement Object Locking in governance mode
2. Explicitly Deny s3:BypassGovernanceRetention and s3:GetBucketObjectLockConfiguration
3. Enable detective measures to undo these configurations.
4. Prevent the root account from being used

OR:

1. Explicitly deny s3:DeleteObject, s3:DeleteObjectVersion, and s3:PutLifecycleConfiguration
2. Enable Versioning (to prevent overwrite)
3. Enable detective measures to undo these configurations.
4. Prevent the root account from being used

OR:

1. Store a redundant copy of the object in a backup bucket and protect accordingly.
2. Restrict IAM access completely to backup copy
3. Enable detective measures to undo these configurations.
4. Prevent the root account from being used