Choosing your region(s)

When setting up Sandbox Studio, choosing the correct AWS Regions is an important step. The regions you select determine where the solution is deployed, which regions users can access, and how accounts are cleaned up.

1. Identify Your Home Region

In an AWS Organisation setup, IAM Identity Center (IDC) is enabled in one specific Region.
This Region becomes your home Region and must be used for deploying Sandbox Studio:

• Organisation Management Account – deploy into this Region.

• Hub Account – deploy into this same Region.

All core solution stacks (AccountPool, IDC, Network, Data, SES, Compute, API) must be deployed in the same home region.

2. Select Managed Regions

During installation, you specify which AWS Regions Sandbox Studio will manage. This has two main effects:

a. Service Control Policies (SCPs)

• SCPs are applied at the Organisational Unit (OU) level.

• They restrict users to the Regions you whitelist.

• Users cannot deploy resources into Regions outside of this list.

• Some AWS services (e.g. IAM, CloudFront) are considered global services and are not restricted by SCPs.

b. Account Clean-Up

• When a sandbox account expires, a clean-up job is triggered.

• This job scans only the whitelisted Regions.

• More Regions = longer scan and clean-up time.

• Limiting Regions speeds up recycling while maintaining governance.

Best Practices

• Keep your managed Regions list small – choose only the Regions your teams genuinely need.

• Consider compliance requirements – some organisations must restrict usage to specific Regions (e.g. EU-only).

• Balance flexibility with efficiency – more Regions provide flexibility but increase clean-up time.

Available Regions

Sandbox Studio on AWS is available in the following AWS Regions. Learn more about enabling regions.