There's a bucket into which some users may write their data for backup purposes.

They use s3cmd to put new files into their bucket.

I'd like to enforce a non-destruction policy on these buckets - meaning, it should be impossible for users to destroy data, they should only be able to add data.

How can I create a bucket policy that only lets a certain user put a file if it doesn't already exist, and doesn't let him do anything else with the bucket.