View a markdown version of this page

Architecture overview - Innovation Sandbox on AWS
Architecture diagram

Architecture overview

This section provides a reference implementation architecture diagram for the components deployed with this solution.

Architecture diagram

Deploying this solution with the default parameters builds the following environment in your AWS account.

Innovation Sandbox on AWS high-level architecture diagram
Innovation Sandbox on AWS architecture

The high-level process flow for the solution components deployed with the AWS CloudFormation templates is as follows:

  1. Users sign in to the solution through an Amazon Cognito user pool that federates to AWS IAM Identity Center using SAML 2.0. You can configure IAM Identity Center to use its built-in user store or integrate it with an external identity provider such as Okta or Microsoft Entra ID.

  2. The web User Interface (UI) is hosted in an Amazon CloudFront distribution backed by an Amazon Simple Storage Service (Amazon S3) bucket that serves the web frontend, including the HTML pages, CSS stylesheets, and JavaScript code. Amazon Cognito provides the authentication layer, issuing tokens that the web UI uses to obtain temporary IAM credentials.

  3. The web UI signs each API request with AWS Signature Version 4 (SigV4) using credentials from the Amazon Cognito identity pool, then calls Amazon API Gateway REST API resources. AWS WAF protects the API Gateway from common exploits, and API Gateway authorizes requests natively using IAM authorization. The backend AWS Lambda functions enforce role-based access based on identities assigned to user groups in IAM Identity Center.

  4. AWS Lambda functions handle API requests by reading and writing status and configuration data to Amazon DynamoDB tables. These tables store the solution’s global settings (lease preferences, account cleanup settings, email notification settings, maintenance mode) and all operational data (leases, accounts, templates, principals).

  5. AWS Lambda functions manage the lifecycle of accounts using the AWS Organizations API, moving them between organizational units (OUs) based on account status. Service control policies (SCPs) attached to OUs restrict which services and resources sandbox users can access.

  6. The solution’s backend includes an event-driven architecture built on Amazon EventBridge for routing domain events. The solution monitors sandbox account leases for breaches in configured budget and duration thresholds, and publishes events that trigger email notifications via Amazon Simple Email Service and invoke Lambda functions responsible for lease and account lifecycle management.

  7. AWS Step Functions orchestrates complex, multi-step workflows including blueprint deployment and assignment processing. Step Functions coordinates the sequencing, retries, and error handling for these long-running operations.

  8. A durable AWS Lambda function orchestrates account cleanup by invoking an AWS CodeBuild project that runs AWS Nuke to delete all user-created resources in sandbox accounts. After cleanup completes, the solution validates that the account is clean and either returns it to the available pool or moves it to quarantine for manual investigation.

  9. Amazon CloudWatch stores all compute logs with a 90-day retention. Logs are automatically archived to Amazon S3 for long-term retention following a multi-tier strategy (S3 Standard for one year, then S3 Glacier for additional years).

  10. AWS AppConfig stores the account cleanup configuration, including the AWS Nuke resource filter that AWS CodeBuild reads at the start of each cleanup run, and the post-cleanup validation exclusion list. Administrators manage these configurations through the AWS AppConfig console.

  11. Users access assigned sandbox accounts via the IAM Identity Center access portal console, or programmatically using credentials. The solution provides a direct link in the web UI to access the AWS account with Single Sign-On (SSO).