Administrator Guide

This section describes the various actions an Administrator can perform using the web UI.

Adding new accounts to the account pool

As an Administrator, you can add new AWS accounts to your account pool using the web UI. Adding new accounts will increase the number of accounts you can lease to your end users, allowing them to work with temporary AWS accounts. After you add new accounts to the account pool, you can lease these accounts to users.

Resolving Account Cleanup Failures

During the account registration process the sandbox accounts go through an initial cleanup process. In some cases the account may fail cleanup and be placed into the Quarantine status. In most cases the cleanup failure is due to resources created by services that integrate with AWS Organizations that you may have enabled such as AWS CloudTrail, AWS Security Hub, or Amazon GuardDuty.

In the event that the cleanup process fails in your deployment when registering accounts you will need to modify the AWS Nuke configuration file to filter out the protected resources.

First we must discover the resources that should be ignored for your environment:

Now we must update the AWS Nuke configuration file to ignore these resources:

Assuming you have appropriately modified the filters for your environment you can now retry the cleanup process:

This will reinvoke the cleanup process on the account with the new AWS Nuke configurations.

Account states in Innovation Sandbox

This table explains the various states the account can be in at any given time. Administrators (or anyone) cannot change these states manually.

Account lifecycle in Innovation Sandbox

For more information, refer to the Account lifecycle section.

Managing existing accounts

As an Administrator, you can manage any existing accounts. This allows you to manually perform account lifecycle actions such as removing accounts from the pool, and retrying the clean-up process.

Account management options

To manage accounts:

Registering and managing blueprints

As an Administrator, you can register CloudFormation StackSets as blueprints to provide pre-configured infrastructure to sandbox accounts. Blueprints enable users to receive accounts with ready-to-use resources, reducing manual setup.

Creating self-managed StackSets

Before registering blueprints, create self-managed CloudFormation StackSets in your hub account (the AWS account where Innovation Sandbox is deployed).

Prerequisites:

Example: Create a StackSet using AWS CLI

aws cloudformation create-stack-set \
  --stack-set-name my-blueprint-stackset \
  --template-url https://s3.us-east-1.amazonaws.com/my-bucket/my-template.yaml \
  --administration-role-arn arn:aws:iam::{ACCOUNT-ID}:role/InnovationSandbox-{NAMESPACE}-IntermediateRole \
  --execution-role-name InnovationSandbox-{NAMESPACE}-SandboxAccountRole \
  --managed-execution Active=true \
  --capabilities CAPABILITY_IAM \
  --description "My blueprint infrastructure"

Replace {ACCOUNT-ID} with your hub account ID and {NAMESPACE} with your solution namespace.

Blueprint prerequisites

Before registering blueprints, ensure you meet these requirements:

StackSet Requirements: * StackSet must use SELF_MANAGED permission model * StackSet must be in ACTIVE status * StackSet template must be valid and tested

Template Validation: * Test StackSet deployment to a test account before registration * Verify template completes within your desired timeframe * Ensure template is idempotent (can be deployed multiple times safely) * Validate template works across all target regions

To validate your StackSet before registration:

Registering a new blueprint

To register a blueprint using the registration wizard:

After registration completes, a success message confirms the blueprint is available. Managers can now associate it with lease templates.

To verify successful registration:

Monitoring blueprint health

To view blueprint health and deployment history:

Blueprint details page

The blueprint details page shows:

Use this information to assess blueprint reliability and troubleshoot deployment issues.

Updating blueprint metadata

To update a blueprint:

Unregistering a blueprint

To unregister a blueprint:

Viewing or modifying Innovation Sandbox settings

You can view your Innovation Sandbox settings in the Settings section of the Administrator dropdown.

To view the current settings, access the AWS AppConfig console in the Hub account, or use the Settings section in the web UI.

Innovation Sandbox AppConfig application overview

You cannot modify any settings directly using the web UI. To modify these settings, this solution uses AWS AppConfig accessible from within the Hub account.

You can manage these three configuration profiles from the AWS AppConfig console in the Hub account:

Configuration profile overview

Modify configuration

To modify any configuration:

This will create and deploy a new version of your configuration. Note that all hosted configurations are versioned. You can roll back to a previous version by starting a new deployment and selecting a previous version.

Global configuration settings

The following table includes all of the global configuration settings you can set or modify in Innovation Sandbox.

Cost report configuration settings

The following table includes the cost report configuration settings you can set or modify in Innovation Sandbox for cost attribution and reporting.