I personally use this Ansible role [1] to deploy restic and then just configure my buckets with the ACLs described in the README and a lifecycle policy so that an override of a file creates a new version instead. Currently I have it so old versions expire on their own, and no one except the account admin can delete them.

[0] https://ruderich.org/simon/notes/append-only-backups-with-re... [1] https://gitlab.com/byh0ki-org/infra/ansible/roles/restic/