Yep, AWS doesn't seem to have any time-lock delete mechanisms as far as I know, which is a shame. I still have to research this, but as far as I can tell the best practice seems to be using MFA delete:

https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.h...

And then keeping root user credentials on a cold storage laptop.

Vault lock seems to be for Glacier, but it'd still be worth looking into for cold storage backups. More layers of defense are always good.