A company uses AWS IAM Identity Center (AWS SSO) for federation. They need to grant developers read-only access to production accounts, but full access to development accounts. What is the BEST way to manage this?

Create IAM users in each account and assign policies.

Create Permission Sets in IAM Identity Center and assign them to the developer group for the respective accounts.

Use AWS Organizations SCPs to restrict developer access in production.

Create cross-account IAM roles and have developers assume them.