We are running AWS RDS PostgreSQL, with daily automatic snapshots, encrypted by AWS managed KMS key. My objective is to minimize risks and data loss, in the case when main AWS account (running RDS) got compromised or RDS is deleted/damaged in some way.
What we've implemented so far: RDS snapshots are shared with different (backup) accounts, periodically copied to the backup account and re-encrypted with the KMS key from the backup account, to make copies local, and independent from the main AWS account.
I'm wondering if there are better ways to minimize recovery time objective and recovery point objective in case of a disaster event?