We can achieve this by defining tags on the test and production instances and then adding a condition to the IAM policy that allows access to specific tags.