In a scenario where an organization wants to allow developers to access resources in a production account from a development account, what is the best practice?