Administrator Guide

This section describes the various actions an Administrator can perform using the web UI.

Adding new accounts to the account pool

As an Administrator, you can add new AWS accounts to your account pool using the web UI. Adding new accounts will increase the number of accounts you can lease to your end users, allowing them to work with temporary AWS accounts. After you add new accounts to the account pool, you can lease these accounts to users.

Resolving Account Cleanup Failures

During the account registration process the sandbox accounts go through an initial cleanup process. In some cases the account may fail cleanup and be placed into the Quarantine status. In most cases the cleanup failure is due to resources created by services that integrate with AWS Organizations that you may have enabled such as AWS CloudTrail, AWS Security Hub, or Amazon GuardDuty.

In the event that the cleanup process fails in your deployment when registering accounts you will need to modify the AWS Nuke configuration file to filter out the protected resources.

First we must discover the resources that should be ignored for your environment:

Now we must update the AWS Nuke configuration file to ignore these resources:

Assuming you have appropriately modified the filters for your environment you can now retry the cleanup process:

This will reinvoke the cleanup process on the account with the new AWS Nuke configurations.

Account states in Innovation Sandbox

This table explains the various states the account can be in at any given time. Most state transitions happen automatically. The exception is the Quarantine state: an Administrator can manually move an account in the Available, Active, or Frozen state into Quarantine using the Quarantine account action. For more information, refer to Manually quarantining accounts.

Account lifecycle in Innovation Sandbox

For more information, refer to the Account lifecycle section.

Managing existing accounts

As an Administrator, you can manage any existing accounts. This allows you to manually perform account lifecycle actions such as removing accounts from the pool, and retrying the cleanup process.

Account management options

To manage accounts:

Viewing cleanup details

The Accounts list page displays the current cleanup status inline in the Status column for any account undergoing cleanup (for example, "Clean Up (Nuke Phase 1)" or "Clean Up (Validating)"). Accounts not in active cleanup display "Clean Up" without a sub-status.

To view detailed cleanup information for a specific account, choose the account ID link in the Accounts list. The account details page shows:

Skipping account cooldown

When an account is in a post-cleanup cooldown (status shows "Clean Up (Cooling Down)"), Administrators and Managers can skip the remaining cooldown to return the account to the Available pool immediately.

To skip a cooldown:

The account returns to the Available pool within a few seconds.

Manually quarantining accounts

As an Administrator, you can manually quarantine an account to temporarily remove it from circulation while preserving the ability to restore it later. Common reasons to manually quarantine an account include exhausted service quotas, suspected compromise or unusual activity on the account, or a policy violation that needs review before the account is returned to use.

Quarantining an account immediately:

To manually quarantine an account:

Registering and managing blueprints

As an Administrator, you can register CloudFormation StackSets as blueprints to provide pre-configured infrastructure to sandbox accounts. Blueprints enable users to receive accounts with ready-to-use resources, reducing manual setup.

Creating self-managed StackSets

Before registering blueprints, create self-managed CloudFormation StackSets in your hub account (the AWS account where Innovation Sandbox is deployed).

Prerequisites:

Example: Create a StackSet using AWS CLI

aws cloudformation create-stack-set \
  --stack-set-name my-blueprint-stackset \
  --template-url https://s3.us-east-1.amazonaws.com/my-bucket/my-template.yaml \
  --administration-role-arn arn:aws:iam::{ACCOUNT-ID}:role/InnovationSandbox-{NAMESPACE}-IntermediateRole \
  --execution-role-name InnovationSandbox-{NAMESPACE}-SandboxAccountRole \
  --managed-execution Active=true \
  --capabilities CAPABILITY_IAM \
  --description "My blueprint infrastructure"

Replace {ACCOUNT-ID} with your hub account ID and {NAMESPACE} with your solution namespace.

Blueprint prerequisites

Before registering blueprints, ensure you meet these requirements:

StackSet Requirements: * StackSet must use SELF_MANAGED permission model * StackSet must be in ACTIVE status * StackSet template must be valid and tested

Template Validation: * Test StackSet deployment to a test account before registration * Verify template completes within your desired timeframe * Ensure template is idempotent (can be deployed multiple times safely) * Validate template works across all target regions

To validate your StackSet before registration:

Registering a new blueprint

To register a blueprint using the registration wizard:

After registration completes, a success message confirms the blueprint is available. Managers can now associate it with lease templates.

To verify successful registration:

Monitoring blueprint health

To view blueprint health and deployment history:

Blueprint details page

The blueprint details page shows:

Use this information to assess blueprint reliability and troubleshoot deployment issues.

Updating blueprint metadata

To update a blueprint:

Unregistering a blueprint

To unregister a blueprint:

Viewing or modifying Innovation Sandbox settings

You can view and modify your Innovation Sandbox settings on the Settings page. From the left navigation pane, choose Settings. Administrators can edit every section; Managers see a read-only view of the same sections; sandbox users cannot access the Settings page.

Innovation Sandbox Settings page

As an Administrator, you can modify all global settings directly on the Settings page. Managers can open the Settings page to view the current values, but cannot change them.

Modify configuration

Settings are organized into four tabs: Leases & Cost, Cleanup, General, and Read-only. Each configuration section has its own Save button, so saving one section does not affect any other section.

To modify a setting:

Completing initial setup

Every configuration section starts with built-in default values. Until you save each section for the first time, the Settings item in the left navigation pane displays a badge. The badge shows how many sections have not yet been saved. Each unsaved section on the Settings page displays a Using default values alert. (The Maintenance Mode section shows a maintenance-specific warning instead. For more information, see Managing maintenance mode.) If every section is still unsaved, the Settings page also shows an Initial setup required banner. Innovation Sandbox is fully operational with the default values in the meantime.

Review each section and choose Save to apply it to your deployment. You can save a section with its default values unchanged; doing so removes it from the count of sections needing attention.

Managing maintenance mode

Maintenance mode temporarily restricts the solution to Administrators. When maintenance mode is on, Managers and sandbox users lose access to the Innovation Sandbox web application. A maintenance banner displays on every page of the web UI. Their existing sandbox accounts are unaffected, and Administrators retain full access. Use maintenance mode when performing sensitive maintenance work, such as initial setup, troubleshooting, or upgrading the solution.

Maintenance Mode section on the General tab

To turn maintenance mode on or off:

Global configuration settings

The following tables list the global configuration settings you can view or modify on the Settings page, grouped by section. For the cost reporting settings, see Cost report configuration settings.

Lease Policies (Leases & Cost tab)

Cleanup (Cleanup tab)

General (General tab)

Cost report configuration settings

The following table includes the Cost Reporting settings you can view or modify on the Leases & Cost tab of the Settings page. Use these settings for cost attribution and reporting.