#737: Accelerate your GenAI innovation journey on AWS with Innovation Sandbox solution

0:00This is episode 737 of the AWS podcast, released on September 15th, 2025. Hello, everyone. Welcome back to the AWS Podcast. I'm Alicia. Really great to have you back. And I'm joined by not one, not two, but three very special guests to talk about the new Innovation Sandbox. Now, this is a very cool thing. So that's why we have three people to talk about it because it will help us unpack. Firstly, Rakshana Balakrishnan, who's a senior product manager here at AWS. Welcome to the podcast, Rakshana. Hey, Simon. It's great to be here. I'm so excited to talk about Innovation Sandbox on AWS, which is the latest product we launched as part of the AWS Solutions portfolio.

0:40And the solution helps customers to accelerate their cloud innovation journey with secure, cost-effective, and recyclable sandbox environments. Yeah, it's going to be cool. We're going to get into all the use cases, et cetera. We're also joined by Katie Williamson, who is business development lead here for the Innovation Sandbox. G'day, Katie. How are you doing? I'm great. Thanks for having me. That's good to have you here. And finally, by Todd Gruit, who's a senior solutions architect as well for The Solution. Todd, welcome to the podcast. Thank you so much, Simon. Just wanted to say I've been at AWS, I think, about five and a half years now, and on the solutions team for about three years.

1:19And by far, the level of excitement from customers and even internally at AWS for The Solution is more than anything I've ever seen. So excited to be here. Yeah, it's a pretty important topic. And I guess if I can unpack it for folks for a moment, a lot of customers are like, yep, I want to use the cloud, I want to use AWS, or they're already big AWS users, but they only want certain teams to have certain capabilities, but they want to explore new things. There's always this tension, if you like, between what's currently acceptable within governance and what they might want to do and how you can experiment.

1:56And it really created a gap. and maybe, Katie, if you want to step back and help us understand, firstly, what your team saw in the gap, but also more broadly what AWS Solutions even is, because this is not a service that you click on the dropdown, but it's kind of a building block on top of that. Absolutely. Yeah, AWS Solutions are software packages, and they're ready to deploy as infrastructure is code, essentially CloudFormation templates. And they help fulfill technical and business use cases out of the box by orchestrating workflows across AWS services. These solutions are supported and maintained by AWS, and they help customers across multiple domains and industries.

2:39Yeah, they're pretty cool because they're sort of the case where it's often the case of something a customer would want to build for themselves, but so many customers want to build it for themselves, we kind of say, well, let's devote a team to go ahead and build the cloud formation, the documentation, think about the architecture. And then as a user, you just go in and click. which I like. It's like click, wait 60 minutes, come back, profit. That's right. That's a good thing. So Todd, let's dive into the details of this particular thing. I mean, why don't I just set up a new AWS account? And why do I need a sandbox?

3:12What's the point? Yeah, that's a great question. And just like you said, Simon, there is a desire across customers. We've been pushing the best practice of having some type of sandbox or innovation account for as long as I've been at AWS. And customers want that. They need to upskill their teams. They want sandbox environments. Many of the customers I work with, whether small customers all the way to very highly regulated customers, often try to build sandbox or do build sandbox capabilities or solutions at their site. But they hit some struggles. There's some difficulties and some challenges that creates that friction that you were talking about.

3:55One of them is cost. There's a huge concern about runaway costs. And the other one is really around security. If we have a sandbox environment, there's always a risk of leaking company data or possibly breaking something in a production environment. So these are limits that we see on customers that we've tried to work around, or at least I've tried to work with customers to solve. And it's a difficult challenge to solve. Yeah, there's a lot of tensions there. And I guess the best way to understand the breakdown of that is to speak with customers and to learn from that. And Rakshana, that's been something you've been doing for a while now on this topic.

4:32What have customers been telling you? What were you and the team hearing in terms of the challenges around this? Yeah, absolutely. So that has been the first thing that we did as part of the zero to one journey for Innovation Sandbox on AWS product. And we spoke to hundreds of customers, and they all unanimously voiced, I would say, challenges across three different themes. And Todd did cover some of them, but I would like to go into a little more detail. The first is security and governance. So sandbox environments need to be isolated from production, and admins need to always ensure that only the right set of users get the right level of access to these environments and only for the required duration.

5:18And if you think about it at scale, it gets super complex because you're talking about hundreds of accounts and thousands of users when you grow your sandbox environment. So ultimately, sandbox users need that flexibility to experiment. But one of the biggest concerns for admins is that if you grant broad access, it result in misconfigurations, data leaks, and unauthorized access. So that's always top of mind for them. The theme for the second concern is cost and resource management. So when Sandbox users run these experiments, you may have heard of over-provisioning resources or that some of the users simply forget about the resources at the end of its use, resulting in runaway costs.

6:04So the customers that we have spoken to have asked for a better way to establish visibility into the sandbox accounts and implement any sort of spend limiting mechanisms. So I spoke about security and governance being number one, number two being cost and resource management. The third big challenge is operational overhead, which is typically associated with creating new sandbox accounts and then closing the accounts at the end of its use. But if you think about it, a sandbox environments are only required for a short period of time. It's typically for a few weeks or like a month at best. But that shouldn't become production.

6:44Absolutely, yeah. And admins need to ensure that even for the short duration, they need to create these accounts every time, provided for sandbox experiments, and then close the accounts at the end of its use, resulting in more operational overhead and spending weeks of administration time trying to provision, configure, and eventually close these accounts. So they just asked for a simple way to recycle and reuse existing accounts. And so really that's where we come into the innovation sandbox, which is this is a solution designed to meet that particular use case, isn't it? It's that automation piece, that governance and that recycle piece as well.

7:26Yeah, absolutely. And there are several specific customer examples that we would like to share to paint the picture. So there was a fintech company that we spoke to who said that each of their development teams wanted sandbox accounts, but they weren't able to configure the appropriate security and governance policies. And after a point, they had to block several AWS accounts from sandbox innovation experiments because of cost spikes. And as a result, this fintech company had to completely pause on all the technological innovation, which was hurting them in the long term. Like they needed to stay ahead of the curve, especially the GNI curve.

8:08Yeah. So they said this is going to be a game changer for them with Innovation Sandbox on AWS. There's also another customer, a large manufacturing customer, who mentioned that they started creating hundreds of sandbox accounts and they provided it for their users. but later, a few months out, they realized that 50 % of these accounts were unused and they weren't even able to relocate these accounts, let alone go and delete the resources. So it resulted in additional operational overhead, which is exactly some of the areas that we were talking about. Yeah, yeah, exactly. So Todd, let me come to you.

8:46What are you seeing in terms of, I guess, the patterns out there of customer use? Yeah, so we have the solutions library. We talked about what AWS solutions were before. We have them broken down by industry. Many of our AWS solutions solve for specific industry needs. One of the interesting things about Innovation Sandbox is it spans across all industries. And I mentioned before the level of excitement I've seen. I think that's part of the reason is we have every single industry and every different size of customer has shown interest in this solution. But there are three specific areas or industries that we see specific use cases for.

9:27One is education, where professors want to grant their students access, where they're running workshops or running class. So they give each student a sandbox account. In highly regulated spaces, we hear from developers that they don't have the access, They're not provided the access to test out new features or services on AWS with an innovation sandbox or sandbox in general that gives them the opportunity to do that. And then the third is software and tech companies often run demos within their AWS environment. And we've heard this multiple times where the demo environments start to drift from where they started from.

10:08And the demo environments either become a cost overrun, they get abandoned, or they don't work for demos. So using Innovation Sandbox, the goal is to have repeatable, consistent demo environments. Across those three use cases, as well as all customers, the top use cases, specific use cases we see is number one over the last few months is experimentation with Gen.AI. with agentic coding exploding. There's a desire from customers to leverage Gen AI to enhance their building, but there's fear that that could break something in their environment. Yeah. So they want to try it, but they want to be safe in trying it.

10:48And they don't let everyone have access to it, but it's like, but we need some people to have access to it to be able to do this. That's exactly right. They want to see what is possible and try to stay in tune with what's happening because it's all moving so fast. The second is, and somewhat related, is developer experiments. But even without Gen.ai, being able to understand how to develop architectures, it is absolutely imperative to have their hands on the keyboard, working with the different services and solutions. And this is only possible in safe environments. Well, and I think a great example of that is something like, let's say you're an enterprise and you've only ever used relational databases.

11:28But you decide, hey, we're scaling. We want to be more cloud native. want to use DynamoDB. But none of your team has deep experience with DynamoDB or you're trying to say, well, could we migrate this particular workload to using DynamoDB? And the best way to answer that question is let's try and see. But again, we're not necessarily letting everyone use DynamoDB for everything. We just want to restrict it. Again, a developer experiment space is important. So the reason why I call that out is often we think about development experiments as being really cutting edge stuff, but it kind of depends where your environment is.

12:01A lot of environments are quite stagnant in the old technologies they've had to use. And so even changing a database type, maybe moving from SQL Server to Postgres is a big deal. So you want an experimental place to do that. That's absolutely right. And another thing to add to that, Simon, that we see often, or I see with customers, is the developers will have to request specific permissions in order to build a project or build their workload. And they will request those specific permissions. They're granted those permissions, which is a lot of effort. There's a manual process involved, manual approval.

12:40They'll get the permissions. And then it turns out that those permissions are not adequate. And then that request process starts all over again to increase permissions. So having an environment where they can determine this is exactly what I need because it's working in this environment is necessary. And many customers in the commercial or enterprise space, as you said, their developers don't have access in order to build the working thing, the prototype, before they actually build it in their development environments. Yeah, I think it's a real challenge. And there was a third area around skills you were talking about.

13:13Yeah, the third area, and this one is, again, across all customers, is upskilling workforce. Whether we talk about Gen AI or just AWS in general, what we hear from leaders across the industry is a desire to upskill their workforce in order to take advantage of the cloud and now also agentic AI. In order to do that, they need to upskill their workforce. So let's get into the guts here. Todd, how does this thing work? Yeah, that's a great question. So we're going to need your help with this, Simon. We're going to do a little bit of role play. Awesome. So we're going to walk through an actual customer example.

13:52And in order to do that, the solution itself has three different types of users, or we call them personas. There's an admin persona who's responsible for managing the solution and the accounts within the solution. That's going to be played by me. The manager who's responsible for managing the actual sandbox usage. That's going to be Rakshama. and then sandbox users, the end users of the solution, that's going to be played by Katie. So you can keep us on track, Simon. Awesome. We'll keep you on us. So Todd, you're the admin. You rock up to work. You've clicked the solution button. You've gone away and had a coffee with a colleague for an hour because it takes about an hour to spin up.

14:31And you've come back to the desk and you're ready to go. What is your job? It's right. At that point, it's rocking and rolling. However, we don't have any sandboxes sandboxes to provision out. The solution uses the concept of an account pool, which means I'm going to pre-create a certain number of accounts. I have customers that are creating two accounts in their account pool. We have a customer that's planning on doing 3 ,000 accounts in the account pool. So these are pre-provisioned, pre-created accounts that we add into the solution that are used as part of this recycle process for the solution.

15:09So once I had my, did I have coffee or tea, Simon? I think you had coffee, but you could be tea depending on, you know, I'm going to go with coffee. So I had my coffee, sat down, I'm going to onboard the accounts that I created. Let's say I created 10 accounts to put in the account pool. We're going to start small. And then because we can grow this account pool over time, we're going to start at 10 and maybe we have a hackathon in a few months, we can add another 100 accounts for the hackathon. The once I have those accounts created, the next thing I'm going to address is permissions. The solution uses IAM Identity Center for access to the user interface, as well as the AWS accounts.

15:51And this works whether I'm using Entro or Okta or any other third party provider that integrates with IAM Identity Center. I'm going to have to define who is the sandbox user, who's an admin, and who is the managers or which teams fit into each one of these areas. And I'm going to add them to the groups that the solution created. Once I have that in place, I'm going to go into the user interface. I'm going to onboard the accounts from the user interface from the solution itself. And now we'll have an account pool. Those accounts will go through a cleanup process and will be made available within 10 to 15 minutes.

16:30So now we have a solution that's ready to go and then I would pass it over to the manager for the next steps. So as we can see, we've got a robust process and I think an important element here is the recycling of accounts. This is not like the unending stream of accounts for actually being intelligent with how we use them, but now we're getting to the point where we actually want to get them ready to be used. So Raksana, you're the manager of a team or you're a professor in a computer science machine learning course, you're the one who wants to allow people to use this stuff. What do you do? Yeah.

17:02So let's assume I'm a manager of an engineering team in this case. So I would be responsible for all aspects of the sandbox lease. And let me pause here and explain about what a lease is. With Innovation Sandbox on AWS, you can lease an AWS account to sandbox users for a predefined spend limit, which is a budget, or a time duration, which is the lease duration. So as a manager, I would be creating these lease templates where I can select these various lease specifications. So when I open up the UI, after, of course, Todd gives me access to the UI, I would be creating a lease template with first the budget and then the total lease duration and whether approval is needed or not.

17:53Because when I specify that, a sandbox user can request a lease of an account. And then if I say approval is needed, every time they request a lease, I get the power to review it and approve those leases. But if I want to be quick about it, and if I know that this specific set of users can automatically get the accounts when they request for it, I can disable it and say approval is not needed. So that's another lever I can specify in the lease template. And the other aspect about the lease template includes threshold actions. So I mentioned previously about the budget and the lease duration. So threshold actions include all the actions that you can take when usage approaches either the spend limit or the lease duration.

18:38So it could be either sending notifications or if there is a higher threshold, freezing the accounts. in which case the user will no longer have access to the account, but the state of the resources running in that account will be preserved. This is usually the case for a university scenario where they would want to grade the assignments at the end of the duration, but they do not want the users to be in the account. Or another threshold action that I could take would be, it's the ultimate action, which is the cleanup action. So that triggers the recycle. because let's say I set a$100 budget and a 20-day lease duration.

19:19When either the$100 budget or the 20-day lease duration is hit, whichever hits first, if I specify that it should be cleaned up, the solution is going to automatically clean up that account and terminate the resources and put it back into the account pool that Todd was mentioning earlier. Now, a great thing about lease templates is that you can create multiple lease templates for various different use cases. And we mentioned, we spoke about the hackathon use case, or the other aspect could be Gen.AI innovation experiments. You can create a specific lease template with a specific budget and time duration for a Gen.AI experiment.

20:00Or if you want to, say, onboard your developers or just give them training, you can set a specific threshold limit for that. One other use case that we see for lease templates is sales demos. So you just want a quick sales demo. It's usually requiring you for a period of a week. You can create those lease templates. So if you have, say, 10 use cases, you can create 10 different lease templates. And one of the powerful parts about the product is that it allows for multiple manager personas to reuse the same template. So what that means is, let's say I'm the engineering manager here, right? So if I create a lease template for a Gen AI innovation experiment with all the lease specifications, another engineering manager from another team could also reuse that same template for another lease.

20:56So there's a lot of commonality here. You're setting the framework, you're setting the boundaries, you're setting the behaviors. But let's get to where the rubber hits the road here, which is the actual user, developer, student, what have you. Katie, you're the sandbox user. You actually want to use stuff on the cloud. What do you do? That's right. Well, as the sandbox user, I just want to start learning and innovating on AWS. So let's say in this case, I want to start experimenting with Gen AI and I need a sandbox account. So I'm going to start by logging into this solution using the single sign-on.

21:32And then I'll be able to see all the lease templates that Rakshana has created for me. And I'm going to request a Gen.ai Sandbox account. And for this account, approval is not needed in this case. So I'm immediately granted access to start building with Gen.ai. So it's really just roll up, click the pre-approved lease type, and away you go. There's no waiting, etc. I guess this is the benefit of the fact that this is taking leases on existing accounts. We're not actually vending a net new account. The account is ready. You just go. Right? Yes. So if we think about then, obviously, we're going to have a whole lot of users using this stuff.

22:12There's some monitoring to be done. We don't want just this to go off in its own world. As the manager, you're probably happy that you've got a lot of users, but what do you also need to think about? Yeah, that's one of the top. use cases for wanting to use Innovation Sandbox, right? Because customers want to see all the leases in one place. And let's say in this case, we have one KD running the JNI experiment. And of course, I trust KD that she'll not exceed the spend and the time limit. But imagine if I have 1 ,000 KDs in my organization, how am I going to make sure that everyone uses the Sandbox experiment within the right set of prescribed limits?

22:52So that's where, as a manager, I get the superpower to see all the sandbox leases in one place and see which sandbox lease has been assigned to which user, how much are they spending in these accounts, and what is the total duration that is remaining as part of their lease. And I also have the superpower to freeze the lease at any given point of time if they exceed any of the limits or terminate the lease if any of the limits again are closer to getting reached. And I can also increase the lease duration as well as the spend limit. So if someone comes to you and says, hey, I'm really on a roll here.

23:36My lease is coming up, but I don't want to lose all my work. As the manager, you can go, hey, yeah, it sounds great. Go for it. Yeah. I give you another month. You can go experiment or another$500. daughters. That's really cool. So this, you know, one thing to add to that as well, as the admin persona and the manager persona, one additional superpower, as Raksana said, that we have is the ability to log into the sandbox accounts at any time. One single sandbox user is granted access per account, but the managers and admins are able to log in, whether that's to look at what the work that's being done, or maybe even capture it if somebody builds something and we want to keep that, we're able to log in and see that without any of the restrictions that might apply to a sandbox user.

24:22That's super useful. I can imagine also in an educational setting, that would be really useful too. If the professor wants to jump in and have a look at what folks are doing, maybe critique their work, what have you, they can do that really easily. So we've had obviously a number of customers working with you on this. Do you want to tell us a few stories about what you've seen? Maybe, Todd, I know you work with some really highly regulated customers. What have you seen in terms of their experience here? I do. I was actually a couple of weeks ago working with a highly regulated, it was actually a security company.

24:55And the security team from that company, they have an onboarding process for all of their services or features within a service. And what that means, this is actually common across enterprise customers, but especially so in highly regulated customers, where the security team will do a review of an AWS service or even features within a service, and they have to approve it with a specific configuration before their developers are able to use it. And this particular company was taking them between one to two months to onboard a particular service, to go through all of their testing, to define the configurations.

25:33And they had a lot of requests from their developers that wanted to use all these new services and features. And what they found was they would go through this process based on the first request or the highest requested service. And once they approved the service, they would release it to the wild, let the developers use it. And they found a lot of these services that they were approving. Once the developers actually got their hands on them, they wouldn't use the service because it didn't actually fit their needs that they thought it did. So they wanted the sandbox solution, ISB, in order to give their developers a full chance to test out these new services or features and make sure it's exactly what they wanted.

26:12Yeah, I think try before you buy is always a useful thing. Speaking of which, we're touched on demos. Katie, tell us a little bit about more what you're seeing in terms of our partners who are doing a lot of demos for their customers. Yeah, we've seen multiple partners who have offerings on AWS and they're able to present those to their customers. And they've been telling us that they are having drift in their demo environments, and that's just a constant struggle for them. So, for example, when running regular demos, it's common to make changes during the demo, but that leads to the drift in the environment, and then it actually can become unusable.