Sandbox Studio | Self-service AWS sandbox accounts, governed

Secure, self-service AWS environments

Secure, self-service AWS environments for developers, researchers, students, partners and business teams, without scaling risk, cost or platform overhead.

Book a demo See how it works

Deployed in your AWS account
Available in AWS Marketplace
Built natively for AWS

Your teams get governed AWS

You set the rules

Account templates
Guardrails & policies
Budgets & cost controls
Identity & SSO
Posture & compliance
Audit & observability

Sandbox Studio

Governs, automates and reports on every account

Governed distribution layer

EngineeringAccelerate development and testing
ProductPrototype and validate ideas faster
Data & AIExperiment and build AI solutions safely
PartnersCollaborate securely in isolated environments
StudentsLearn by building on real AWS
Non-technical teamsInnovate without AWS console expertise

You set the rules

Account templates
Guardrails & policies
Budgets & cost controls
Identity & SSO
Posture & compliance
Audit & observability

Sandbox Studio

Your teams get governed AWS

EngineeringAccelerate development and testing
ProductPrototype and validate ideas faster
Data & AIExperiment and build AI solutions safely
PartnersCollaborate securely in isolated environments
StudentsLearn by building on real AWS
Non-technical teamsInnovate without AWS console expertise

Trusted by innovators on AWS

Cevo

Just a taste of the customers and partners building with Sandbox Studio around the world.

Solutions

AI InnovationGive teams and AI agents a safe place to build and experiment.Learn more →

Software Dev & TestingOn-demand dev, QA and CI/CD environments.Learn more →

Events & EnablementHackathons, bootcamps and internal programmes.Learn more →

Education & ResearchHands-on AWS environments for learning at scale.Learn more →

Demos, PoCs & TrialsRepeatable environments for partners, sales and customers.Learn more →

Not sure where to start?See every solution side by side.Learn more →

Capabilities

Self-service with control

Teams pick an approved account template and get an AWS account within the limits you set.

Cost transparency

Live spend against every budget, with alerts and automatic actions.

Automate the lifecycle

Provision, track and clean up every account automatically.

Guardrails and policies

Only the AWS services each template allows, capped by a permission boundary.

Approvals in one place

Managers see who's asking, for what and why, then approve in a click.

Flexible sign-in

Offer whichever login methods suit your people. Staff, students and partners can each sign in with the account they already have.

The product

Admins govern, managers approve, users self-serve. All inside your own AWS Organisation. Click through it yourself.

One home for everyone: active accounts, spend and approvals at a glance.

Step 1 of 4

Everything at a glance

Each person sees their active AWS accounts, live spend and request history the moment they sign in.

Integrate and extend

From self-service and enterprise tools to APIs and AI, everyone can request AWS environments through the same governed platform, with consistent policies, controls and visibility.

Requests from anywhere

Self-service portal
ITSM (ServiceNow, Jira)
Internal & learning portals
CI/CD pipelines
REST API & webhooks
AI assistants via MCP

Sandbox Studio

Orchestration & governance

Account templates & guardrails
Approvals & identity
Budgets & cost controls
Lifecycle & cleanup

Governed AWS environments

Course sandbox200 students · 12 weeks
Dev sandboxPer branch · auto-expires
AI sandboxBedrock · $200 budget
Event sandbox48 teams · 2 days

Visibility & reportingSpend, usage and a full audit trail across every request, whichever door it came through.

Admins and agents work in natural language. The Sandbox Studio MCP server exposes templates, leases and reporting as tools.

you  Create a 14-day AI template with a $200 budget, Bedrock access
     and auto-wipe on expiry. Then lease one for the data team.

✓ sandbox-studio · create_account_template
✓ sandbox-studio · request_lease

claude  "AI Prototyping" is published. The data team's account is
        provisioning and will expire on 14 Nov.

Pipelines lease a fresh, governed account per branch or pull request and hand it back when the job ends.

# .github/workflows/preview.yml
- name: Lease a sandbox for this PR
  run: |
    LEASE=$(curl -s -X POST $SBS_URL/api/leases \
      -H "Authorization: Bearer $SBS_TOKEN" \
      -d '{"templateId":"dev-sandbox","comments":"PR #${{ github.event.number }}"}')
    echo "ACCOUNT_ID=$(echo $LEASE | jq -r .awsAccountId)" >> $GITHUB_ENV
- name: Deploy and test
  run: npx cdk deploy --all --require-approval never

Keep requests in the tools people already use. A catalogue item in ServiceNow or Jira creates the lease and posts the status back.

ServiceNow  RITM0041872 · "AWS sandbox for vendor evaluation"
   ↓ approved in ServiceNow
Sandbox Studio  POST /api/leases  →  201 Created
   ↓ lease.provisioned (SNS)
ServiceNow  RITM0041872 · Fulfilled · account 540128739465

Everything in the portal is available over an OAuth 2.0 REST API, with interactive docs built into the product.

POST /api/leases
Authorization: Bearer eyJhbGciOi…
{
  "templateId": "ai-prototyping",
  "userEmail": "priya@northwind.io",
  "comments": "Bedrock agent pilot"
}

201 Created  { "status": "PendingApproval", "leaseId": "7f3c…" }

Subscribe to lifecycle events on Amazon SNS to trigger your own automation: notify Slack, update a CMDB, start a pipeline.

{
  "entity": "lease",
  "event": "budget.threshold_reached",
  "leaseId": "7f3c2a9e",
  "template": "AI Prototyping",
  "spend": 150.00, "budget": 200,
  "action": "ALERT"
}

How it works

From request to recycled: every account is governed, budgeted and cleaned up automatically. Hover a stage to see it.

01
Requested
Wendy, a data scientist, picks the Data Science Sandbox template from the catalogue and requests an account.
02
Approved
The request goes to the managers who look after that template. One of them approves it in a click.
03
Provisioned
An account is taken from the pool, set up with SageMaker, storage and guardrails, and Wendy is given access.
04
Running
Wendy builds in her own AWS account. Spend and remaining time are tracked live.
05
Governed
Budget and time are monitored throughout. Wendy gets alerts as either runs low and can request an extension.
06
Recycled
When the lease ends the account is cleaned and goes back into the pool, ready for the next person.

Request an account

Users browse the templates published to them and request one in a click.

Developer SandboxGoverned sandboxCreate

AI PrototypingGoverned sandboxCreate

Data Science Sandbox$250 · 7 daysRequest

HackathonGoverned sandboxCreate

Request submitted for Data Science Sandbox

Routed to the managers of Data Science Sandbox

Each template has its own manager group, so teams handle their own approvals and templates.

Wendy WalshData Science Sandbox · $250 · 7 days"Churn model for the Q3 review"

AI & Data managers

Approved by Marcus

Taken from the pool and set up

A ready account is configured from the template, so there's no waiting on a ticket.

Available 32

071114

In use 45

02050912

Cleaning 1

Account 07Set up

SageMakerS3 dataJupyterGuardrails

Access grantedWendy can log in

Wendy is building

A real AWS account to work in, within the limits her template sets.

Wendy WalshData Science Sandbox · Active

Spend $96.40of $250

Time left 4 daysof 7

Jupyter notebook running on ml.t3.medium
S3: 2.3 GB of customer data loaded
SageMaker training job churn-v3 complete

Monitored the whole time

Alerts fire at the template's thresholds, and extensions go back to its managers.

Budget $190 of $250

Lease 1 day left

75% of budget used · Wendy notified

Lease expires tomorrow

Request 3-day extension

Extension approved · now 4 days left

Cleaned and back in the pool

Resources are removed automatically, so nothing lingers or keeps billing.

Wendy WalshLease ended

Available 23

In use 32

Cleaning 010

1114020507

Lease ended · cleaning account 07Account 07 is clean and available again

Account template library

Explore all templates →

Jupyter Notebook (Classic) on SageMaker

Jupyter notebook (Classic) on Amazon SageMaker

Jupyter Notebook on SageMaker Studio

JupyterLab on Amazon SageMaker Studio (new unified experience)

Apache Airflow DAG Factory

Deploy Amazon Managed Workflows for Apache Airflow (MWAA) with DAG Factory, VPC, Redshift Serverless, Glue, and EMR Serverless

Proof

90%

faster environment provisioning (up to)

80–95%

reduction in sandbox cost overruns

2–3×

increase in programme throughput

Your AWS

deployed inside your own AWS Organisation

Outcomes based on customer experience and internal benchmarks.

Proof in practice

From three weeks to under 12 hours.

PiP used Sandbox Studio to launch a governed AI innovation programme, producing four prototypes and progressing two towards production.

Read the story →

AI prototypes built

progressing towards production

3 weeks → 12 hrs

Architecture

Sandbox Studio installs into a governing account you own. Your identities, your data, your guardrails.

Your choice of identity providers for sign-in
Accounts cleaned and recycled automatically
AWS Foundational Technical Review completed

See the architecture →

Your AWS Organisation

Your Sandbox Studio governing account

One place to see and steer every sandbox: who has each account, what it's costing and when it comes back. It hands accounts out, enforces your rules and cleans them up, all from an account you own.

Managing 8 sandbox accounts

Sandbox accounts

Available

In use

Cleaning

0102030405060708

FAQ

What is Sandbox Studio?

Sandbox Studio is a platform for giving people self-service AWS sandbox accounts safely. Developers, researchers, students, partners and business teams request an account from a catalogue of account templates; Sandbox Studio sets it up with the right permissions and budget, tracks it while it's in use, then cleans it and returns it to a pool when the lease ends.

What is an AWS sandbox account?

A sandbox account is a separate AWS account where someone can build and experiment without affecting production or other teams. Because it's a real, isolated AWS account, people get genuine AWS access, while budgets, permissions and an expiry date keep the risk and cost contained.

Where does Sandbox Studio run?

Inside your own AWS Organisation. It installs into a governing account you own, and sandbox accounts live in a dedicated organisational unit. Your identities, data and guardrails stay in your environment. Sandbox Studio has completed the AWS Foundational Technical Review.

How does Sandbox Studio control AWS costs?

Each account template sets a budget, alert thresholds and what happens when the budget is reached, such as locking or wiping the account. Users and managers are notified as spend grows, and every sandbox has a lease that ends automatically.

What happens when a sandbox lease ends?

The account's resources are removed automatically and the account goes back into the pool, ready for the next person. Nothing is left running or billing, and nobody has to clean up by hand.

How do people sign in?

With the identity providers you already use, such as Microsoft Entra ID, Okta or Google Workspace. You can connect more than one, for example separate sign-ins for staff, students and partners.

How is Sandbox Studio priced?

Through AWS Marketplace, as an annual subscription per concurrent sandbox account rather than per named user. Licences are reused as accounts are recycled. There's a 30-day free trial for up to 3 concurrent accounts; AWS usage inside sandboxes is billed by AWS as normal.

Who uses Sandbox Studio?

Platform and cloud teams use it to give engineering, data and AI teams governed AWS access, and universities, training providers and AWS partners use it for courses, research, hackathons, workshops, demos and customer trials.

From the blog

View all posts →