Restrict the production Lambda function's execution role to only allow reading from the production S3 bucket.

Separate development and production into different AWS accounts and configure Lambda functions to only accept invocations from S3 buckets within the same account.

Implement a resource policy on the production Lambda to permit invocations exclusively from the production S3 bucket.

Enforce account separation for development and production, and update Lambda execution roles to interact only with S3 buckets in the respective accounts.