What are different ways of protecting a

stage

such as

dev

staging

and

prod

from being used or changed by a developer besides separate aws accounts?

AWS doesn't make this easy which is why the recommended approach is separate AWS accounts. It gets tricky to create a role that only has access to specific cloudformation stacks + the resources they create

Having separated accounts for each env, and IAM perms.