In the past, I've usually had separate accounts for each region that I've worked in. These accounts had different IAM roles/etc, so there was very little chance I'd inadvertently mess up region A when working on region B and vice versa.
Recently, we deployed to another region within the same account. This means, without extra controls, just setting the default region differently on your CLI could have fairly disastrous consequences.
While IAM is global, is it generally recommended to have distinct uses per region / restrict which resources they can hit with policies, or is that overkill? Are there any good tools for helping you "not mess up" when running anything on the CLI? (including things like terraform)? Do you know any other "best practices" or good resources to learn about this particular area?