I’m surprised this answer is so far down. Production machines write to an S3 bucket with a lambda trigger. As soon as the upload is finished, the lambda either lifts the file to another location or changes the acl so the production machines can no longer access it.