View a markdown version of this page

Step 1: Deploy the AccountPool stack - Innovation Sandbox on AWS

Step 1: Deploy the AccountPool stack

In this step, you deploy the resources required to set up Organizational Units (OUs), Service Control Policies (SCPs), roles, and Regions.

Important

Ensure that you log into the Org Management account for deploying the AccountPool stack.

Note

Refer to Supported AWS Regions for a list of supported AWS Regions.

  1. Sign in to the AWS Management Console and choose the button to launch the AccountPool stack CloudFormation template.

Launch Stack

The template launches in the US East (N.Virginia) Region by default. To launch the solution in a different AWS Region, use the Region selector in the console navigation bar.

  1. On the Create stack page, verify that the correct template URL is in the Amazon S3 URL text box, and choose Next.

  2. On the Specify stack details page, enter a stack name for your solution stack. For information about naming character limitations, see IAM and AWS STS quotas, name requirements, and character limits in the AWS Identity and Access Management User Guide.

  3. Under Parameters, review the parameters for this solution template and modify them as necessary. This solution uses the following default values.

    Parameter Default Description

    Namespace

    myisb

    The namespace for this deployment of Innovation Sandbox (must be the same for all member stacks). For example, myisb.

    Hub Account Id

    <Requires input>

    The AWS Account Id where the Innovation Sandbox Hub application (Data and Compute stacks) is (to be) deployed. This refers to the Hub account you have identified in the Prerequisites section.

    Parent OU Id

    <Requires input>

    Provide the Root id or organization unit id where Innovation Sandbox OUs will be created. To find the OU Id, navigate to AWS Organizations to view the details of the OU that you would like to use.

    ISB Managed Regions

    <Requires input>

    Provide a comma-separated list of AWS Regions to limit sandbox usage to specific regions. Always include us-east-1 to enable global services. Example: us-east-1,eu-west-1

    Additional Allowed Services

    <Empty>

    Optional comma-separated list of additional AWS service actions to allow in sandbox accounts. Format: service:action (for example, sts:*,support:*,tag:*). CloudFormation appends these actions to the solution’s default allowed services list, and they persist across upgrades. Actions that overlap with the default list appear as duplicates in the SCP, which has no effect. The parameter rejects bare wildcards ( : ). For the full list of services allowed by default, refer to Allowed services in sandbox accounts.

    Additional Principal Exceptions

    <Empty>

    Optional comma-separated list of IAM role ARN patterns to exclude from SCP restrictions in sandbox accounts. Supports wildcard ( ) at the end of role names (for example, arn:aws:iam::). CloudFormation appends these patterns to the principal exception list in the Allowed Services, Restrictions, and Region Limit SCPs. The Protect ISB Resources SCP is excluded from principal exceptions to prevent modification of solution infrastructure. The parameter rejects bare wildcards (arn:aws:iam::*:role/*).

    Bedrock Inference Profile Patterns

    <Empty>

    Optional comma-separated list of Bedrock inference profile ARN patterns to exempt from the region deny SCP. By default (empty), the region restriction SCP blocks all cross-region Bedrock calls. To allow cross-region inference, provide one or more patterns — for example, arn:aws:bedrock:*:*:inference-profile/ for all profiles or arn:aws:bedrock: for US profiles only.

  4. Choose Next.

  5. On the Configure stack options page, review and choose to acknowledge the messages under Capabilities and transforms, and choose Next.

  6. On the Review and create page, review and confirm the settings.

  7. Choose Submit to deploy the stack.

You can view the status of the stack in the AWS CloudFormation Console in the Status column. You should receive a CREATE_COMPLETE status in approximately 60 minutes.

Note

Always include us-east-1 as an ISB Managed Region to enable AWS global services. For example, if you want to enable eu-west-1, the parameter value should be us-east-1,eu-west-1.