← AWS Podcast
AWS Podcast
#737: Accelerate your GenAI innovation journey on AWS with Innovation Sandbox solution
00:31:50
In this episode, we will dive deep into Innovation Sandbox on AWS, a new AWS solution offering that
Loading summary
Transcript71 lines
- [00:00]
A
This is episode 737 of the AWS podcast, released on September 15th, 2025.
- [00:09]
B
Hello, everyone.
- [00:09]
C
Welcome back to the AWS Podcast. I'm Lee Shuwithi. Great to have you back. And I'm joined by not one, not two, but three very special guests to talk about the new Innovation Sandbox. Now this is a very cool thing, so that's why we have three people to talk about it, because it will help us unpack. Firstly, Rakshana Balakrishnan, who's a senior Product Manager here at aws. Welcome to the podcast, Rakshana.
- [00:30]
A
Hey, Simon, it's great to be here. I'm so excited to talk about Innovation Sandbox on aws, which is the latest product we launched as part of the AWS Solutions portfolio. And the solution helps customers to accelerate their cloud innovation journey with secure, cost effective and recyclable sandbox environments.
- [00:50]
C
Yeah, it's going to be cool. We're going to get into all the use cases, et cetera. We're also joined by Katie Williamson, who is business development lead here for the Innovation Sandbox. G', day, Katie. How you doing?
- [01:01]
D
I'm great. Thanks for having me.
- [01:02]
C
That's good to have you here. And finally by Todd Groot, who's a senior solutions architect as well for the solution. Todd, welcome to the podcast.
- [01:10]
B
Thank you so much, Simon. Just wanted to say I've been at aws, I think about five and a half years now, and on the solutions team for about three years. And by far the level of excitement from customers and even internally at AWS for the solution is more, more than anything I've ever seen. So excited to be here.
- [01:29]
C
Yeah, it's a pretty important topic and I guess if I can unpack it for folks for a moment, a lot of customers are like, yep, I want to use the cloud, I want to use aws. Or they're already big AWS users, but they only want certain teams to have certain capabilities, but they want to explore new things. There's always this tension, if you like, between what's currently acceptable within governance and what they might want to do and how you can experiment. And it really created a gap. And maybe, Katie, if you want to step back and help us understand firstly what your team saw in the gap, but also more broadly what AWS Solutions even is, because this is not a service that you click on the dropdown, but it's kind of a building block on top of that.
- [02:14]
D
Absolutely, yeah. AWS solutions are software packages and they're ready to deploy as infrastructure, as code, essentially. Cloudformation templates and they help fulfill technical and business use cases out of the box by orchestrating workflows across AWS services. These solutions are supported and maintained by AWS and they help customers across multiple domains and industries.
- [02:40]
C
Yeah, they're pretty cool because they're sort of the case where it's often the case of something a customer would want to build for themselves. But so many customers want to build it for themselves. We kind of say, well, let's devoted team to go ahead and build the cloud formation, the documentation, think about the architecture and then as a user you just go in and click. Which I like. It's like click, wait 60 minutes, come back profit.
- [03:02]
D
That's right.
- [03:04]
C
That's a good thing. So Todd, let's dive into the details of this particular thing. I mean, why don't I just set up a new AWS account? Why do I need a sandbox? What's the point?
- [03:14]
B
Yeah, that's, that's a great question. And just like you said, Simon, there is a desire across customers. We've been pushing the best practice of having some type of sandbox or innovation account for as long as I've been at aws. And customers want that. They need to upskill their teams. They want sandbox environments. Many of the customers I work with, whether small customers, all the way to very highly regulated customers, often try to build sandbox or do build sandbox capabilities or solutions at their site. But they hit some struggles, there's some difficulties and some challenges that creates that friction that you were talking about. One of them is cost. There's a huge concern about runaway cost and the other one is really around security. If we have a sandbox environment, there's always a risk of leaking company data or possibly breaking something in a production environment. So these are limits that we see on customers that we've tried to work around, or at least I've tried to work with customers to solve and it's a difficult challenge to solve.
- [04:22]
C
Yeah, there's a lot of tensions there and I guess the best way to understand the breakdown of that is to speak with customers and to learn from that. And Rakshana, that's been something you've been doing for a while now on this topic. What have customers been telling you? What is you and the team hearing in terms of the challenges around this?
- [04:39]
A
Yeah, absolutely. So that has been the first thing that we did as part of the zero to one journey for innovation sandbox on AWS product. And we spoke to hundreds of customers and they all unanimously voiced, I would say challenges across three different themes and Todd did cover some of them. But I would like to go into a little more detail. The first is security and governance. So sandbox environments need to be isolated from production and admins need to always ensure that only the right set of users get the right level of access to these environments and only for the required duration. And if you think about it at scale, it gets super complex because you're talking about hundreds of accounts and thousands of users when you grow your sandbox environment. So ultimately sandbox users need that flexibility to experiment. But one of the biggest concerns for admins is that if you grant broad access, it result in misconfigurations, data leaks and unauthorized access. So that's always top of mind for them. The theme for the second concern is cost and resource management. So when sandbox users run these experiments, you may have heard of over provisioning resources or that some of the users simply forget about the resources at the end of its use, resulting in runaway costs. So the customers that we have spoken to have asked for a better way to establish visibility into the sandbox accounts and implement any sort of spend limiting mechanisms. So I spoke about security and governance being number one, number two being cost and resource management. The third big challenge is operational overhead, which is typically associated with creating new sandbox accounts and then closing the accounts and at the end of its use. But if you think about it, sandbox environments are only required for a short period of time. It's typically for a few weeks or like a month at best.
- [06:42]
C
But they shouldn't become production.
- [06:45]
A
Absolutely, yeah. And admins need to ensure that even for the short duration, they need to create these accounts every time provided for sandbox experiments and then close the accounts at the end of its use, resulting in more operational overhead and spending weeks of administration time trying to provision, configure and eventually close these accounts. So they just ask for a simple way to recycle and reuse existing accounts.
- [07:14]
C
And so really that's where we come into the innovation sandbox, which is this is the solution designed to meet that particular use case, isn't it? It's that automation piece that, that governance and that, that recycle piece as well.
- [07:26]
A
Yeah, absolutely. And there are several specific customer examples that we would like to share to paint the picture. So there was a fintech company that we spoke to who said that each of their development teams wanted sandbox accounts but they weren't able to configure the appropriate security and governance policies. And after a point they had to block several aws accounts from Sandbox innovation experiments because of cost spikes. And as a result, this fintech company had to completely pause on all the technological innovation, which was hurting them in the long term. Like they needed to stay ahead of the curve.
- [08:06]
C
Yeah, they need to move forward, especially.
- [08:07]
A
The Gen AI curve. Yeah. So this, they said this is going to be a game changer for them with Innovation Sandbox on aws. There's also another customer, a large manufacturing customer, who mentioned that they started creating hundreds of sandbox accounts and they provided it for their users. But later, few months out, they realized that 50% of these accounts were unused and they weren't even able to relocate these accounts, let alone go and delete the resources. So it resulted in additional operational overhead, which is exactly some of the areas that we were talking about.
- [08:43]
C
Yeah, yeah, exactly. So, Todd, let me come to you. What are you seeing in terms of, I guess the patterns out there, that of customer use? Yeah.
- [08:52]
B
So we have the solutions library. We talked about what AWS solutions were before. We have them broken down by industry. Many of our AWS solutions solve for specific industry needs. One of the interesting things about Innovation Sandbox is it spans across all industries. And I mentioned before the level of excitement I've seen. I think that's part of the reason is we have every single industry and every different size of customer has shown interest in in this solution. But there are three specific areas or industries that we see specific use cases for. One is education, where professors want to grant their their students access, where they're running workshops or running class. So they give each student a sandbox account in highly regulated spaces. We hear from developers that they don't have the access. They're not provided the access to test out new features or services on AWS with an innovation Sandbox or in Sandbox in general. That gives them the opportunity to do that. And then the third is software and tech companies often run demos within their AWS environment. And we've heard this multiple times, where the demo environments start to drift from where they started from. And the demo environments either become a cost overrun, they get abandoned, or they don't work for demos. So using Innovation Sandbox, the goal is to have repeatable, consistent demo environments across those three use cases as well as all customers. The top use cases, specific use cases we see is number one over the last few months is experimentation with Gen AI with agentic coding exploding, there's a desire from customers to leverage Gen AI to enhance their building, but there's fear that that could break something in their environment. Yeah, the second.
- [10:45]
C
So they want to try it, they want to try it, but they want to be safe in trying it. And they don't let everyone have access to it. But it's like, but we need some people to have access to it to be able to do this.
- [10:54]
B
That's exactly right. They want to see what is possible and try to stay in tune with what's happening because it's all moving so fast. The second is, and somewhat related is developer experiments. But even without Gen AI being able to understand how to develop architectures, it is absolutely imperative to have their hands on the keyboard working with the different services and solutions. And this is only possible in safe environments.
- [11:22]
C
Well, and I think a great example of that is something like, let's say you're an enterprise and you've only ever used relational databases, but you decide, hey, we're scaling, we want to be more cloud native, want to use DynamoDB, but none of your team has deep experience with DynamoDB or you're trying to say, well, could we migrate this particular workload to using DynamoDB? And the best way to answer that question is let's try it and see. But again, we're not necessarily letting everyone use DynamoDB for everything, we just want to restrict it. Again, a developer experiment space is important. So the reason why I call that is often we think about development experiments as being really cutting edge stuff, but it kind of depends where your environment is. A lot of environments are quite stagnant in the old technologies they've had to use. And so even, you know, changing a database type, maybe moving from SQL Server to postgres is a big deal. So you want an experimental place to do that.
- [12:17]
B
That's absolutely right. And another thing to add to that, Simon, that we see often, or I see with customers is the developers will have to request specific permissions in order to build a project or build their workload, and they will request those specific permissions. They're granted those permissions, which is a lot of effort. There's a manual process involved, manual approval, they'll get the permissions and then it turns out that those permissions are not adequate and then that that request process starts all over again to increase permissions. So having an environment where they can determine this is exactly what I need because it's working in this environment is necessary. And many customers in the commercial or enterprise space, as you said, their developers don't have access in order to build the working thing, the prototype, before they actually build it in their development environments.
- [13:09]
C
Yeah, I think it's it's, it's a real challenge. And there was a third area around skills you were talking about.
- [13:13]
B
Yeah, the third area, and this one is again across all customers, is upskilling workforce. Whether we talk about gen AI or just AWS in general, what we hear from leaders across the industry is a desire to upskill their workforce in order to take advantage of the cloud and now also agentic AI. In order to do that, they need to upskill their, their workforce.
- [13:39]
C
So let's get into the guts here, Todd. How does this thing work?
- [13:42]
B
Yeah, that's a great question. So we're going to need your help with this, Simon. We're going to do a little bit of role play.
- [13:47]
C
Awesome.
- [13:48]
B
So we're going to, we're going to walk through an actual customer example and in order to do that, the solution itself has three different types of users or we call them Personas. There's an admin Persona who's responsible for managing the solution and the accounts within the solution. That's going to be played by me, the manager who's responsible for managing the actual sandbox usage. That's going to be Rakshama and then sandbox users, the end users of the solution. That's going to be played by Katie. So you can keep us on track, Simon.
- [14:21]
C
Awesome. We'll keep, we'll keep you on. So Todd, you're, you're the admin, you rock up to work, you've clicked the solution button, you've gone away and had a coffee with a colleague for an hour because it takes about an hour to spin up and you've come back to the desk and you're ready to go. What is your job?
- [14:36]
B
It's right at that point, it's rocking and rolling. However, we don't have any sandbox to sandboxes to provision out. The solution uses the concept of an account pool which, which means I'm going to pre create a certain number of accounts. I have customers that are creating two accounts in their account pool. We have a customer that's planning on doing 3,000 accounts in the account pool. So these are pre provisioned, pre created accounts that we add into the solution that are used as part of this recycle process for, for the solution. So once I had my, did I have coffee or tea? Simon?
- [15:13]
C
I think you had coffee but you could be tea depending on, you know, where you live.
- [15:17]
B
I'm going to go with coffee. So I had my coffee sat down. I'm going to onboard the accounts that I created. Let's say I created 10 accounts to put in the account pool. We're going to start small and then because we can grow this account pool over time, we're going to start at 10 and, and maybe we have a hackathon. In a few months we can add another hundred accounts for the hackathon. The once I have those accounts created, the next thing I'm going to address is permissions. The the solution uses IAM Identity center for access to the user interface as well as the AWS accounts. And this works whether I'm using Entra or Okta or any other third party provider that integrates with IAM Identity Center. I'm going to have to define who is a sandbox user, who's an admin, and who is the managers or what, which teams fit into each one of these areas. And I'm going to add them to the groups that the solution created. Once I have that in place, I'm going to go into the user interface, I'm going to onboard the accounts from the user interface from the solution itself. And now we'll have an account pool. Those accounts will go through a cleanup process and will be made available with within 10 to 15 minutes. So now we have a solution that's ready to go and then I would pass it over to the manager for the next steps.
- [16:38]
C
So as we can see, we've got a robust process and I think an important element here is the recycling of accounts. This is not like the unending stream of accounts. We're actually being intelligent with how we use them, but now we're getting to the point where we actually want to get them ready to be used. So Rakshana, you're the, you're the manager of a team or you're a professor in a computer science machine learning course. You're the one who wants to allow people to use this stuff. What do you do?
- [17:02]
A
Yeah, so. So let's assume I'm a manager of an engineering team in this case. So I would be responsible for all aspects of the sandbox lease. And let me pause here and explain about what a lease is with Innovation Sandbox. On aws you can lease an AWS account to sandbox users for a predefined spend limit, which is a budget or a time duration, which is the least duration. So as a manager, I would be creating these lease templates where I can select these various lease specifications. So when I open up the UI, after of course, Todd gives me access to the ui, I would be creating a lease template with first the budget and then the total lease duration. And whether approval is needed or not. Because when I specify that a sandbox user can request a lease of an account, and then if I say approval is needed every time they request a lease, I get the power to review it and approve those leases. But if I want to be quick about it, and if I know that this specific set of users can automatically get the accounts when they request for it, I can disable it and say approval is not needed. So that's another lever I can specify in the lease template. And the other aspect about the lease template includes threshold actions. So I mentioned previously about the budget and the lease duration. So threshold actions include all the actions that you can take when usage approaches either the spend limit or the lease duration. So it could be either sending notifications or if there is a higher threshold, freezing the accounts, in which case the user will no longer have access to the account, but the state of the resources running in that account will, will be preserved. This is usually the case for a university scenario where they would want to grade the assignments at the end of the duration, but they do not want the users to be in the account. Or another threshold action that I could take would be, it's the ultimate action, which is the cleanup action. So that triggers the recycle. Because let's say I set a hundred dollar budget and a 20 day lease duration, which when either the $100 budget or the 20 day lease duration is hit, whichever hits first, if I specify that it should be cleaned up, the solution is going to automatically clean up that account and terminate the resources and put it back into the account pool that Todd was mentioning earlier. Now, a great thing about lease templates is that you can create multiple lease templates for various different use cases. And we mentioned, we spoke about how the hackathon use case or the other aspect could be Genai innovation experiments. You can create a specific lease template with a specific budget and time duration for a Genai experiment. Or if you want to say onboard your developers or just give them training, you can set a specific threshold limit for that. One other use case that we see for lease templates is sales demos. So you just want a quick sales demo. It's usually required only for a period of a week. You can create those lease templates. So if you have say 10 use cases, you can create 10 different lease templates. And one of the powerful parts about the product is that it allows for multiple manager Personas to reuse the same template. So what that means is, let's say I'm the engineering manager here, right so if I create a lease template for a Genai innovation experiment with all the lease specific specifications, another engineering manager from another team could also reuse that same template for another lease.
- [20:56]
C
So there's a lot of commonality here. You're seeing the framework, you're setting the boundaries, you're seeing the behaviors. But let's get to where the rubber hits the road here, which is the actual user, developer, student, what have you. Katie, you're the sandbox user. You actually want to use stuff on the cloud. What do you do?
- [21:15]
D
That's right. Well, as a sandbox user I just want to start learning and innovating on aws. So let's say in this case I want to start experimenting with Genai and I need a sandbox account. So I'm going to start by logging into the solution using the single sign on and then I'll be able to see all the lease templates that Rakshana has created for me and I'm going to request a Genai sandbox account. And for this account approval is not needed in this case. So I'm immediately granted access to start building with Genai.
- [21:49]
C
So it's really just roll up, click the pre approved lease type and away you go. There's no waiting, et cetera. And I guess this is the benefit of the fact that this is taking leases on existing accounts. We're not actually vending a net new account. The account is ready, you just, you just go, right?
- [22:07]
A
Yes.
- [22:08]
C
So if we think about then obviously we're going to have a whole lot of users using this stuff. There's some, some monitoring to be done. We don't want just this to go off off in its own, own world. As the manager you're probably happy that you've got a lot of users, but what do you also need to think about?
- [22:24]
A
Yeah, that's one of the top use cases for wanting to use innovation sandbox. Right. Because customers want to see all the leases in one place. And let's say in this case we have one KD running the Genai experiment and of course I trust KD that she'll not exceed the spend and the time limit. But imagine if I have thousand KD's in my organization, how am I going to make sure that everyone uses the sandbox experiment within the right set of prescribed limits. So that's where as a manager I get the superpower to see all the sandbox leases in one place and see which sandbox lease has been assigned to which user. How much are they spending in these accounts? And what is the total duration that is remaining as part of their lease. And I also have the superpower to freeze the lease at any given point of time if they exceed any of the limits, or terminate the lease if any of the limits again are closer to getting reached. And I can also increase the lease duration as well as a spend limit.
- [23:34]
C
Yeah, someone comes to you and says, hi, I'm really on a roll here. My lease is coming up, but I don't lose all my work as the manager. You can go, hey, yeah, it sounds great, go for it.
- [23:43]
A
Yeah, I give you another month, you can go experiment or another $500.
- [23:49]
C
That's really cool.
- [23:50]
B
So this, you know, one thing to add to that, as well as the admin Persona and the manager Persona, one additional superpower, as Roxana said, that we have, is the ability to log into the sandbox accounts at any time. One single sandbox user is granted access per account, but the managers and admins are able to log in, whether that's to look at what the work that's being done or maybe even capture it. If somebody builds something and we want to keep that, we're able to log in and see that without any of the restrictions that might apply to a sandbox user.
- [24:22]
C
That's super useful. I can imagine. Also in an educational setting, that would be really useful too, if the, you know, the professor wants to jump in and have a look at what folks are doing, maybe critique their work, what have you. They can, they can do that really easily. So. So we've had obviously a number of customers working with you on this. Do you want to tell us a few stories about, you know, what you've seen, maybe? Todd, I know you work with some, some really highly regulated customers. What, what have you seen in terms of their experience here?
- [24:47]
B
I do. I was actually a couple of weeks ago working with a highly regulated. It was actually a security company and the security team from that company, they have an onboarding process for all of their services or features within a service. And what that means. This is actually common across enterprise customers, but especially so in highly regulated customers, where the security team will do a review of an AWS service or even features within a service, and they have to approve it with a specific configuration before their developers are able to use it. And this particular company was taking them between one to two months to onboard a particular service to go through all of their testing to define the configurations, and they had a lot of requests from their developers that wanted to use all these new services and features and what they found was they would go through this process based on the first, first request or the highest requested service. And once they approve the service, they would release it to the wild, let the developers use it. And they found a lot of these services that they were approving. Once the developers actually got their hands on them, they wouldn't use the service because it didn't actually fit their needs that they thought it did. So they wanted the Sandbox solution isb, in order to give their developers a full chance to test out these new services or features and make sure it's exactly what they wanted.
- [26:12]
C
Yeah, I think try before you buy is always a useful thing. Speaking of which, we've touched on demos. Katie, tell us a little bit about more what you're seeing in terms of our partners who are doing a lot of demos for their customers.
- [26:25]
D
Yeah, we've seen multiple partners who have offerings on AWS and they're able to present those to their customers. And they've been telling us that they are having drift in their demo environments and that's just a constant struggle for them. So, for example, when running, you know, regular demos, it's common to make changes during the demo, but that leads to the drift in the environment and then it actually can become a new.
- [26:53]
C
It leaves a messy world for the next poor person to come and do a demo with.
- [26:57]
D
Exactly. So. Oh, sorry, yeah.
- [27:00]
B
No, to add a little bit of color to that. A little ironic color. I've been demoing Innovation Sandbox for the last two months. We have three or four demo environments that we use at aws. And exactly what we're solving for here happens within the Innovation Sandbox. We'll have different people demoing and they make some changes and over time it starts to fall apart.
- [27:22]
C
So you need to put a sandbox in your sandbox.
- [27:27]
A
Absolutely.
- [27:28]
D
So these customers are planning or telling us they're planning to use Innovation Sandbox to create that consistent temporary demo environment.
- [27:38]
C
Nice. And Rakshan, you've got a couple of customers who've been doing some stuff, in some cases at scale too. Tell us about those.
- [27:44]
A
Yeah, yeah. I have a healthcare customer and an education customer. So it truly paints the picture about the full spectrum of all the industries that Innovation Sandbox can cater to. For the pharmaceutical company's use case, they wanted to conduct a genai hackathon with 15 participants to build groundbreaking agentic AI solutions across key business areas such as drug discovery, genomics and clinical trials. And they wanted this at short notice. They wanted to quickly spin up accounts and set up the environment as well as all the policies and controls in place so that they can confidently empower the 15 participants to try out these experiments with Innovation Sandbox. They mentioned that they were able to reduce their setup and administration time from what would have taken weeks to just a few hours. And they were able to establish these cost controls and automatically clean up these accounts at the end of the one week hackathon period. And they were able to clean up over thousands of resources all in one go. Instead of trying to locate these resources.
- [28:57]
C
And stuff, they're not playing whack a mole, they just press the button and stuff happen.
- [29:01]
A
Absolutely, yeah. And in the second scenario with the education customer, we are talking about a top public educational institution which has served over 40,000 students in their history with Genai picking up steam. What this university wanted to do was to introduce a new computer science and gen AI course and they wanted to embed cloud technologies into their module designs as well as give their students practical experience with these advanced Genai AWS services. But the central IT team had some concerns with how they were going to implement it. They did not want to compromise security and they did not want to increase their operational burden. Well, that's where Innovation Sandbox on AWS came into the picture and it essentially helped this customer to manage over 330/sandbox accounts for their 330/students and effectively give them a safe environment to run their experiments as well as to learn and innovate on aws.
- [30:11]
C
That's very cool. There's lots to this. I'm sure a lot of our listeners work in organizations that could benefit from this. We're going to link in the show notes. Obviously the sandbox itself, the access to it, the instructions, how to get it up and running, it's not hard to do, but it's great to have it available to you. Rakshana, some great insights there. I think this is a great next step for customers. I know the team will be listening for feedback too to continue to iterate on this.
- [30:37]
A
Yeah, absolutely. And the one sort of key message that I want to deliver about the Innovation Sandbox product is that it helps customers to manage temporary sandbox environments. And if you want to learn, experiment and innovate with your internal teams, forget about the technical heavy lifting and the operational overhead. We are here to take care of it. And you can leverage Innovation Sandbox on AWS and get out of the box security policies, cost control mechanisms and account recycling processes so that you are empowered to innovate better on aws.
- [31:19]
C
That's great. Katie, thanks also for you to come on board and tell us all about. I'm sure you're excited to see how customers continue to use this.
- [31:26]
D
I definitely am, and thank you for giving us the time.
- [31:29]
C
No worries. And Todd, thanks for sharing us the insights of what you're seeing with customers and how this thing got built.
- [31:35]
B
Absolutely appreciate it, Sam.
- [31:37]
C
And thanks everyone for listening. We do love to get your feedback. AWspodcastmozon.com is the place to do it. And until next time, keep on.