> Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device.

Is this correct?

Couldnt they just change the existing keys in AWS to be "write only" - and therefore allow a one way stream of data "in"?

That way, even with the keys, you cant actually get any existing videos, and only place new ones there?

I do this for my web application backups - my AWS keys on the server are "write only" (with no overwrite) to S3. Then, if my server was every compromised, my backups are NOT and are protected because the attackers cant get to them (to either overwrite or read the existing backup).