Restrict the production Lambda function's execution role to only allow reading from the production S3 bucket.

Separate development and production into different AWS accounts and configure Lambda functions to only accept invocations from S3 buckets within the same account.

Enforce account separation for development and production, and update Lambda execution roles to interact only with S3 buckets in the respective accounts.