The development team at a company accesses resources across all AWS Regions. The management wants only the security team to have access to resources from all AWS Regions. Any access to members of the development team needs to be restricted to the resources in a single AWS Region ( us-west-2 ) except for the global AWS services. The development team is sized at 40 members, with all members being part of the developers IAM group. The company needs to implement this access restriction immediately. What is the optimal way to meet this requirement?