Leases

What are leases?
A Lease is the core concept in Sandbox Studio. It represents a time-bound  and/or budget-bound  grant of access to a temporary AWS account for one or more users. 
 When a lease is created, Sandbox Studio provisions access to a short-lived AWS account. When the lease ends — whether through expiry, budget exhaustion, or manual revocation — that access is automatically removed. 
 
 Key Characteristics 
 
 
 Temporary: Every lease has a defined start time. It may also have an expiry date, but this is optional. A lease ends when its expiry date is reached, its budget is exhausted, or it is manually revoked — whichever comes first. 
 Scoped to an AWS account : Each lease maps to a single temporary AWS account. 
 Shareable : A lease can be assigned to a single user or shared across a group of users. All users on a shared lease access the same AWS account. 
 Budget-controlled : A lease can have a spending budget. If the account's costs hit the budget threshold, the lease is automatically terminated. 
 Automated : Lease creation, access provisioning, and cleanup are fully automated. No manual account handoff required.

Listing leases
As a Manager, you can see and manage leases. To have management access to leases, you need to: 
 
 Have Manager access in Sandbox Studio 
 Be granted management permissions on the account template that the leases use 
 
 Note: Administrators have full permissions and can see all leases. 
 To access leases, click on the "Leases" link in the left menu: 
 
 This displays the list of leases that are currently being used (Status Active, Locked, or Pending Approval):

Filtering leases
Filter by lease status 
 From the leases page, you can select the status of the leases you want to display. Example, only showing " Pending Approval " leases: 
 
 Filter by other fields 
 You can also filter by all the fields displayed in the table. This allows, for example, to filter on a particular event, budget, or account template. To access this filter, click on the filter icon at the top of the table: 
 
 The list of filters will appear. 
 For example, filter leases having their current cost between $10 and $50: 
 
 
 For fields with finite values (i.e. "Account template"), a searchable dropdown will be displayed: 
 If you close the Filter menu, but still have some filters applied, an icon will be displayed on the columns being filtered:

Lease details
This page describes the different sections of the lease details page: 
 
 
 Account Summary 
 Account summary contains the basic information about the lease and its associated account: 
 
 
 The Status of the lease. See lease status here 
 Lease ID . This is the unique identifier of the lease.  
 AWS Account ID : When a lease is active, an AWS account is associated to it. This is the AWS account ID for the current lease. 
 Account template used for this lease. 
 User who has requested the lease . The lease owner may be different than the requester as managers and administrators can request leases on behalf of other users. 
 Approved by : Shows the user who has approved (or rejected the lease). For account templates that do not require approval, the lease it auto approved. 
 Login to the AWS account using AWS Identity Center. 
 
 Note: When a manager or administrator requests an account for an account template he/she can approve, the lease will be automatically approved. 
 
 Account Timeline 
 The timeline shows you the different stages an account (lease) can go through. It also shows you what current state the account is in. 
 
 
 Team members 
 This sections shows the users who can access this account. If the account template allows team sharing, then the owner (or a manager/admin) can share the account with other users.  
 The "Status" columns indicates if the share is active (The other user can see and access the lease) or if the account is being shared (Status = " Sharing... "). 
 By clicking on "Update", managers and administrators can share or un-share the account with other users. Refer to How to share an account  for more details. 
 
 Budget & Duration 
 Account limits versus Account templates limits: 
 It is important to understand how duration and budget work: 
 
 The initial budget/duration of an account (or lease) is set on account creation, based on the account template used.
 
 i.e: If the account template has a budget of $50, then the account created will have a default budget of $50. 
 The expiration date is calculated on account creation/start. This is particularly important for accounts related to events: The duration countdown will only start when the event (and therefore the lease) actually start, not when it's created. 
 
 
 During the account lifetime, managers and administrators can update the budget/expiration, independently from the account template. They can, for instance, extend the budget or prolongate the lifetime for a particular account without having to change the account template. 
 
 Budget 
 The budget card shows the maximum budget for the account and the current spend. 
 In this example, the maximum budget for this account is $50 and so far, $4.26 have been spent. Managers and Administrators can extend (or reduce) the budget by clicking on the "Update" button. 
 Duration 
 The duration card shows when this account will expire. 
 The expiration date is calculated on account creation/start. This is particularly important for accounts related to events: The duration countdown will only start when the event (and therefore the lease) actually start, not when it's created. 
 In this example, the account has been running for 8 days and will expire in 20 days and 6 hours. Managers and Administrators can extend (or reduce) the lifespan of the account by clicking on the "Update" button.

Approving & rejecting leases
Accessing approvals 
 When setting up the Account Templates, the Manager or Admins can set an account to require approval, before it is issued to a user.  When a user requests such an account, Managers or Admins need to approve the request for the user to be granted access to the  lease. 
 
 Managers or Admins will be alerted to the fact that an Account Request needs approval on their email and in the Sandbox Studio UI on the left menu with a notifications on Approvals (1).   From the left, select  Approvals (1) to view your approval requests. 
 
 
 
 
 This opens the  Approvals page: 
 
 
 
 
 
 By default, this page only shows the pending approvals, but you can change the filter to display All , Pending , Approved , Denied or Withdrawn requests. 
 Click on the user's name to display more details about the request 
 Or you can directly Approve or Reject the request from this page. 
 
 
 
 
 Request details 
 
 If you want to access more details about the request or you need to update some parameters of the request, you can open it by clicking on the username of the requestor (Step 2 in the previous screenshot). The following page is then displayed: 
 
 From there, you can: 
 
 Approve the request 
 Deny the request 
 See the current status of the request 
 See requestor's comments 
 Update budget for this lease. (This overrides the account template default details) 
 Update duration of this lease. (This overrides the account template default details) 
 
 
 Once approved, the lease will go through the setup process, which could take a few minutes depending on the resources being created in the account. Once finished, the account will be marked as " Active " (1) and will be available to the requestor. 
 
 
 Bulk Approval 
 When managing multiple leases at once, we recommend using the Events features, but in certain scenarios, you may need to bulk approve/denied leases. This is possible by going to the Approval page, select the requests to Approve/Deny, click on the Actions buttons and Approve/Reject the requests:

Locking & unlocking an account
Managers and Administrators can lock (and unlock) accounts. Accounts can be locked if they are over budget or if they have expired.  
 Once locked, the account is not accessible anymore to the end user, but remains active and accessible to the managers and administrators. 
 Accounts that are locked keep on incurring cost as existing resources are not stopped. 
 Lock an account 
 From the lease details page, click on the Actions button and select "Lock account": 
 
 Confirm the action by clicking on "Lock": 
 
 The account status changes to "Account locked" and name of the user who locked the account is shown: 
 
 The account owner will be notified by e-mail that the account has been locked. 
 
 Unlock an account 
 From the lease details page, click on the Actions button and select "Unlock account": 
 
 Confirm the action by clicking on "Unlock": 
 
 
 The account status return to its previous state: 
 
 The account owner will be notified by e-mail that the account has been unlocked. 
 
 Lock/Unlock accounts in bulk: 
 From the leases page, select the accounts you want to lock/unlock and click on the "Actions" button and select "Lock account"/"Unlock accounts":

Extend budget or duration
Account limits versus Account templates limits: 
 It is important to understand how duration and budget work: 
 
 The initial budget/duration of an account  (or lease)  is set on account creation, based on the account template used.
 
 i.e: If the account template has a budget of $50, then the account created will have a default budget of $50. 
 The expiration date is calculated on account creation/start. This is particularly important for accounts related to events: The duration countdown will only start when the event (and therefore the lease) actually start, not when it's created. 
 
 
 During the account lifetime, managers and administrators can update the budget/expiration, independently from the account template. They can, for instance, extend the budget or prolongate the lifetime for a particular account without having to change the account template. 
 
   
 Extend account limits 
 The procedure being identical for budget or duration, this document will only cover the "Budget" update. The same exact steps are to be performed for the duration update. 
 Open the lease you want to extend the budget of by clicking on "Leases" on the left menu and open up the lease: 
 
 Scroll down to the "Budget" section and click on "Update": 
 Update the maximum budget, actions and threshold for this lease and click on "Update lease" to finish: 
 
 The lease budget gets immediately updated: