AWS Temporary Permission Granting Tool for Account/Service "Firefights"
Create an IAM role in prod with all the permissions you'd like the devs to have.
When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group.
When it's time to revoke access, remove the sts:AssumeRole permission.

More details in my blog article here.