Account Templates
Guide to create and update lease templates

What are account templates?
An Account Template  (also referred to as a Lease Template) is the blueprint that defines how a lease behaves and what the target AWS account looks like. Templates are configured ahead of time and referenced when creating leases. 
 An account template defines: 
 
 Lease constraints : Default and maximum duration, budget limits, and whether the lease can be shared. 
 Lease management : Who is allowed to manage (extend, revoke, ...), approve leases based on this template. 
 Account provisioning : The resources that should be deployed into the AWS account when the lease starts (e.g., VPCs, IAM roles, baseline infrastructure). 
 Access control: The IAM policies, permission boundaries, and roles that lease users receive within the account. This controls what users can and cannot do inside their sandbox. 
 
 Templates ensure consistency and governance across all leases. Administrators define the guardrails once, and every lease created from that template inherits them automatically.

Account template creation - Overview
To create a new account template: 
 
 Click on " Account Templates" on the left menu 
 Click on " Add Account Template " 
 
 
 
 Creating an account template is a 7-step process that can be done from scratch or use an existing template from Sandbox Studio. 
 
 In this documentation, we will create an account template from scratch. Using a prebuilt template is identical but has pre-defined values. 
 
 Each step of the process is explained as follows: 
 
 Basic details 
 Budget 
 Lease Duration 
 Account Permissions 
 Roles & Access 
 Launch Settings 
 Review

Account template creation - Basic Details
On the  Add a new Account Template  page, complete the required fields in the  Basic Details  section. 
 
 
 
 For  Name , enter a descriptive name for your lease template so that you can easily keep track of it. 
 
 
 (Optional)  For the description, specify the intended purpose of the account type. 
 
 Click on Change Icon if you want to change the icon associated with your template. 
 Click on the Colour Theme selector to choose the colour of the icon and template theme. 
 Lastly you have the option to add Tags , let's look at that in more detail below. 
 
 
 
   
 Tagging  accounts with parameters like "Department Name = Engineering" or "Cost Centre = M004" would enable users to gain granular insights into their AWS Sandbox Studio usage. This would allow for precise cost allocation and chargebacks to specific teams or projects, providing a clear understanding of spending patterns and resource consumption. It also facilitates better resource governance and optimisation by identifying areas of high expenditure or underutilised resources, leading to improved cost efficiency. 
 In the Tags section, users can either select from the options in the drop down, or create their own custom Tag names, by just typing into the Name (1) field. One you have selected or entered a name, you can type in or select a corresponding value (2) e.g. Department Name = Engineering 
 
 Sandbox Studio does not include any predefined tags. The dropdown list is populated with tags that already exist in your environment. 
   
 You can addd as many tags as needed to help you filter accounts as required. In the example below you can see 3 different tags 
 
 
 Having completed all the fields on the Basic Details page as needed, click on Next to move to  Account template creation - Budget

Account template creation - Budget
This step defines the budget limits for leases using this template. 
 
 
 Define if you want a maximum budget to be enforced for the leases. By default, this flag is optional (You can define templates with no budget limits) , but platform administrators can enforce this flag to be set to "Yes". (e.g: Enforce maximum budget) 
 Define the maximum budget amount . This value is in USD. 
 Define the action when the budget is reached. You can either:
 
 Wipe the account : This delete all resources and remove access to the users.
 
 Pros : Stop incurring cost 
 Cons : Some data may be lost as the resources will be deleted. 
 
 
 Lock account: Remove access to end users but keep the resources and data
 
 Pros : Data and resources remain. Administrators and managers can access the account. 
 Cons : Resources still incur cost in the AWS account. 
 
 
 
 
 Define the actions to take based on the thresholds you define. 
 
 Note: The maximum budget you can set is limited by the maximum budget set in the Global configuration set by the administrator of your Sandbox Studio environment.  
 
 Actions: 
 Sandbox Studio can perform automatic actions if some thresholds are met. You can define those thresholds and actions in the "Actions" section: 
 
 
 Having completed all the fields on the Budget page as needed, click on Next to  Account template cre ation - Duration

Account template creation - Duration
This step defines the maximum duration for leases using this template. 
 
 
 Define if you want a  maximum duration to be enforced for the leases. 
 If you select  Set an expiry date , enter a value in  Maximum Lease Duration (in Months, Days or Hours) . The duration configuration determines how long the account is available once leased to a user.

 
 Define the  action when the lease expires.  You can either:
 
 Wipe the account : This delete all resources and remove access to the users.
 
 Pros : Stop incurring cost 
 Cons : Some data may be lost as the resources will be deleted. 
 
 
 Lock account : Remove access to end users but keep the resources and data
 
 Pros : Data and resources remain. Administrators and managers can access the account. 
 Cons : Resources still incur cost in the AWS account. 
 
 
 
 
 Define the actions to take based on the thresholds you define. 
 
 The countdown for a lease starts when the lease is created. 
 
 Actions: 
 Sandbox Studio can perform automatic actions if some thresholds are met. You can define those thresholds and actions in the "Actions" section: 
 
   
 
 Important: The threshold’s actions are effectively a count down - and only trigger when a certain amount of time is left. e.g. 5 Days left, or 24 Hours to go or in the case of "Wipe" when the account has expired. 
   
 Having completed all the fields on the  Duration page as needed, click on Next to Account template creation - Permissions

Account template creation - Permissions
Using Permissions, you can configure what the end users can and cannot do in their accounts.  
 Sandbox Studio uses IAM Identity Center Permissions Sets for permissions. You can see more details explaining each of the sections of this page at https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html 
 
 Default permissions 
 By default, "Administrator Access" is provided to end users.  
 Service Control Policies (SCP) are still applied on the accounts and even with Administrator access, some resources and actions may be blocked by your Administrators. 
 If the default configuration suits your needs, proceed to the next step Account template creation - Roles & Access 
 
 Customise permissions 
 For more granular permissions configuration, you can customise the permissions you provide to the end users by selecting  No, I want to customise permissions: 
 
 
 The following sections can be configured: 
 
 
 AWS Managed Policies 
 
 By default, the Administrator Access policy is applied but you can select one or more policies from the list of AWS Managed policies. More details here about AWS Managed policies: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/about-managed-policy-reference.html 
 
 
 
 Customer Managed Policies 
 
 If you have pre-defined policies you manage, you can use them here. More details about Customer managed policies 
 
 
 
 Inline policy 
 
 Finally, you can use inline policy (define the access directly in the section). More details about inline policies. 
 Example: 
 
 
 Permission Boundary: 
 Finally, and following the same principles as previous options, you have the option to include  Permission boundaries. More details about Permission boundaries. 
 
 Note: Permission boundaries can only be "AWS managed policy" OR "Customer managed policy" (Not both). In addition, you can only select ONE policy to apply. 
 
 Having completed all the fields on the Permissions page as needed, click on  Next to move to Account template creation - Roles & Access 
 
 Example: 
 This example restricts users to only basic EC2 actions: 
 
  

Account template creation - Roles & Access
In this section, you define if leases can be shared, if they require approval, and who can manage and approves them. 
 
 
 Team sharing (1) 
 In the Team Sharing  section of the page. A simple toggle that once enabled will require the Manager or Administrator to provide the number of Users it can be shared with. A User will provide the additional Users that a lease can be shared with a the request. 
 
 
 
 Toggle the Enable team access  to being configuring the number of Users that a lease can be shared with. 
 Set the  Maximum team size  to the number of Users to permit per lease. 
 
 
 
 Team size is: Owner + Number of additional users 
 
 Approvals (2) 
 
 This section lets you define whether an approval is required to create new leases using this template. 
 We recommend requiring approval for leases with extended permissions or that will incur high costs. 
 
 Set " Approval required " to Yes if you want new lease to be approved by managers before being created. 
 
 If no approval is required, new leases are created immediately. 
 
 Users & Groups (3 & 4) 
 These sections are set to define who can Approve or Managed leases created for this template: 
 
 Approver : Users or groups of users who receive approval requests on lease creation and who can approve leases created with this template 
 Manager : Users or groups of users who can manage leases created with this template, that is:
 
 View the leases 
 Extend budget and duration 
 Terminate leases 
 Login to the AWS account 
 
 
 
 Administrators can both approve and manage leases, even if not in this list of users/groups 
 Groups are defined in IAM Identity Center. How to add groups to IAM Identity Center 
 
 Having completed all the fields on the Managers page as needed, click on  Next to Account template creation - Launch Settings

Account template creation - Launch Settings
Using launch templates, managers can define what resources need to be set up on new accounts creation. For instance, create S3 buckets, deploy Cloud Formation templates, etc. 
 Sandbox Studio uses  AWS Codebuild to set up resources. 
 
 Launch Settings (1) 
 Select " Run setup before account access " to enable launch templates. By ticking this item, you need to provide the script to create resources on account creation. 
 If no resource needs to be created on account creation, untick this box to provide an "empty" account to users. 
 
 Download files from S3 (2) 
 In some scenario, you may need to download files from S3 to create your resources. For example, download a Cloudformation template, download softwares, etc. 
 You need to provide an S3 path to a folder or a bucket (not to the object directly).  
 
 Sandbox Studio will run a sync command to fetch the folders and objects from S3 into the /tmp folder of the Codebuild instance. 
 Sandbox Studio does not require your bucket to be public! Follow the next steps to learn how to configure S3 access 
 Sandbox Studio requires your bucket to be accessible to the LaunchTemplateExternalAccessRole created in your environment. 
 You can click on "Configure S3 access" to display the S3 bucket policy to apply on your S3 bucket: 
 
 
 
 
 
 
 
 
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowSandboxStudioAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::<hub-account-number>:role/LaunchTemplateExternalAccessRole"
 },
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::your-bucket-name",
 "arn:aws:s3:::your-bucket-name/*"
 ]
 }
 ]
} 
 
 
 
 
 
 Pre-Launch script (3) 
 Pre-Launch script allows you to run a script before your actual launch script to, for example, install tools, packages, update the environment, etc.  
 The environment used to create the resources is based on Amazon Linux 2023 (x86_64) . ( aws/codebuild/amazonlinux-x86_64-standard:5.0) 
 
 Launch script (4) 
 Launch script is your actual script to create resources in your account.  
 The environment used to create the resources is based on Amazon Linux 2023 (x86_64) . ( aws/codebuild/amazonlinux-x86_64-standard:5.0) 
 Please refer to following section to return environment details to the Sandbox Studio interface. 
 Example of script to create a S3 bucket: 
 #!/bin/bash
BUCKET_NAME="sample-bucket-$(date +%s)" # Unique bucket name from current timestamp
REGION="us-east-1"

aws s3 mb --region $REGION s3://$BUCKET_NAME 
 
 How to set "Environment details" in Sandbox Studio? 
 Sandbox Studio allows you to display environment details from the launch template script. You can, for example, return URLs, passwords, environment variables, etc.  
 One interesting use case is to provide access to a VSCode environment: You can create a VSCode environment to your users and return the URL to the user. They don't need to login to the account and can directly access their VSCode with the information provided by the install script. 
 To set the environment details, you can use the pre-defined set-sandbox-output command: 
 VSCODE_URL="https://example.com"
PASSWORD="SuperStrongPassword"

set-sandbox-output --name "VSCodeServerUrl" --value "$VSCODE_URL"
set-sandbox-output --name "Password" --value "$PASSWORD" --is-secret 
 The tool takes 2 parameters (name and value). 
 For secret strings (i.e.: Password, API keys, etc.), add the parameter is-secret 
 
 Secrets variables are saved in AWS Secrets Manager and only displayed when the user clicks on the Display icon. 
 
 Having completed all the fields on the Launch Settings page as needed, click on  Next to Account template creation - Review

Account template creation - Review
Having completed all the steps, the final step is to Review the selected settings and one satisfied that everything is correct, click  Submit to create a new lease template. 
 Users can then request a lease with this new lease template. 
 
 
 The new lease template becomes available immediately: 
 
 And end users can start using it:

Update Account templates
To update an account template, go to "Account Templates" and open the template you want to modify: 
 
   
 Then edit any of the fields you want to update:

Duplicate Account Templates
To duplicate an account template, go to "Account Templates" and open the template you want to duplicate: 
 
   
 Click on the "Actions" button and choose "Duplicate account template": 
 
 This will redirect you to the Account template creation page with information pre-filled: