If you segment production instances from develop/staging you can use IAM rules to grant specific privileges based on the entire region, instead of by tag (which

If you segment production instances from develop/staging you can use IAM rules to grant specific privileges based on the entire region, instead of by tag (which is fragile). Additionally, it is less error prone when you are making manual changes in the console as it requires switching regions between production and develop/staging.