To get around the IAM issue we deployed the lambda's with a naming convention like:

prod_lambda_name staging_lambda_name dev_lambda_name

Then the IAM's are written with resource access to prod_* staging_* etc.

It allows to give full permissions to the developer to create dev ones, modify the other ones, but the prod_ are all controlled by a smaller group of people.

It's a bit hacky but it works well enough.

Would be nicer to grant access by stages.