A developer uses S3 Event Notifications to invoke Lambda functions for image processing. In the same AWS account there is a development S3 bucket and Lambda, and a production S3 bucket and Lambda. Uploads to the development bucket are incorrectly invoking the production Lambda. The developer must prevent development uploads from affecting production with the least disruption. What should the developer do?

The most secure and robust solution for preventing cross-environment interference is to isolate development and production into separate AWS accounts. This provides strong isolation boundaries. Within each account, adding resource-based policies to the Lambda functions ensures that only S3 buckets within that specific account can invoke them. This prevents the development S3 bucket from inadvertently triggering the production Lambda, even if an event notification misconfiguration were to occur. Modifying the production Lambda's execution role to restrict S3 read access is insufficient because the issue is about invocation, not read permissions. The Lambda is being invoked by the wrong source. Adding or updating S3 bucket policies to control Lambda invocation is a valid approach for same-account isolation, but it's less robust than account separation and relies heavily on correct policy configuration, which can be prone to human error. Moving to separate accounts and updating Lambda execution roles for read access doesn't address the invocation issue; the problem is who can invoke the Lambda, not what the Lambda can read.