Sandbox accounts since 2016
Sandbox accounts,
governed end to end
RosettaHub has run sandbox accounts for universities and research institutions since 2016, for a workshop, a course or a whole grant. Budgets that stop spending within a few minutes, AI included; controls per role; administration delegated down the organisation; labs and direct console access; FinOps built in.
Looking at Innovation Sandbox on AWS? Below is how the two compare, using AWS’s own documentation.
- AWS accounts governed
- 20,000+
- With universities and research institutions
- Since 2016
- From budget reached to spending stopped, AI included
- Minutes
- Multi-tenant, nothing to deploy, or a platform dedicated to you
- SaaS
What RosettaHub brings
to sandbox accounts
Budgets that hold
Cost tracked from resource events as they happen, Amazon Bedrock per call. At the limit, spending stops within a few minutes in every active Region, AI included, with the work kept wherever the service allows. Each account has its own start date, unused budget carries over, and transfers are logged.
Learn more →Control per role and per user
Regions, services, instance types, GPUs and AI models allowed per role and per user. Quotas on machines, volumes and storage checked when resources are created. Continuous compliance against standards, implemented with Cloud Custodian.
Learn more →Administration where it belongs
Nested organisations for faculties, departments, courses and research groups, and a person can belong to several. Each administrator manages their own users, accounts, budgets and policies, and can see exactly what a user sees.
Ready to work
Single sign-on with your institution’s identity provider, then direct access to the AWS console and CLI, federated through IAM roles. Labs in one click in the browser: virtual machines, Jupyter, RStudio, VS Code, containers, clusters. Images, data and environments shared across projects and institutions.
Learn more →FinOps built in
Real-time costs, alerts at 50, 70, 90 and 100%, and daily reports. FOCUS 1.3 and CUR 2.0 data enriched per user and organisation, in your own account. Idle clean-up, rightsizing and Spot hibernation.
Learn more →Accounts that last, then recycle
An account stays governed for as long as the course or project runs. Afterwards it is fully cleaned and goes to its next user, with cost attributed to each holder for the exact period they held it.
Side by side
Every statement about Innovation Sandbox below comes from AWS’s own implementation guide.
| Innovation Sandbox on AWS | RosettaHub | |
|---|---|---|
| Designed for | Disposable, short-lived environments, in AWS’s words: classroom labs, tests, workshops | Accounts governed for as long as they are needed: courses, projects, research groups, departments |
| Budget tracking | Hourly checks against Cost Explorer data, which can be up to 24 hours old; AWS describes the checks as “best effort” | Costs tracked and stopped in real time, within a few minutes, AI included |
| At the budget limit | The lease is frozen and the user’s access removed. AWS: “active resources will continue to incur costs” | New activity blocked, running services stopped in every active Region, data preserved wherever the service allows |
| Usage controls | One set of policies for all sandboxes: allowed services and Regions | Regions, services, instance types and AI models per role and per user; quotas checked when resources are created |
| Budgets | One total per lease, counted from approval; each new lease starts a new budget | A budget per account with its own start date; unused budget carries over; transfers are logged |
| Organisation | Administrators, managers and users, across the whole deployment | Nested organisations and delegated administration; each manager sees only their own part |
| FinOps | A budget per lease and monthly cost reports | Real-time costs, alerts, daily reports, FOCUS 1.3 and CUR 2.0 data enriched per user, idle clean-up, rightsizing |
| Access to accounts | AWS console and CLI, through IAM Identity Center | Single sign-on with your identity provider; AWS console and CLI, federated through IAM roles |
| Ready-made labs | Not provided | Labs in one click in the browser: virtual machines, Jupyter, RStudio, VS Code, containers, clusters |
| Recycling accounts | AWS Nuke clean-up; AWS notes its check “cannot guarantee complete cleanup” | Full clean-up before an account goes to its next user, with cost attributed to each holder |
| Clouds | AWS | AWS, Azure and Google Cloud, through one API |
| Operation | Deployed, upgraded and operated by your team in your AWS organisation | Multi-tenant SaaS operated by RosettaHub, or a platform dedicated to you |
Statements about Innovation Sandbox refer to version 1.3.5 of the Innovation Sandbox on AWS implementation guide, read in October 2026. The solution is updated often; check the current version.
Common questions
What is Innovation Sandbox on AWS?
A free AWS Solution that lends temporary AWS accounts with a spending limit and cleans them for the next user. AWS describes it as a way to create disposable, short-lived environments such as classroom labs, tests and workshops. Your team deploys, upgrades and operates it in your own AWS organisation.
How quickly does RosettaHub stop spending at the budget limit?
Costs are tracked in real time from resource events, and Amazon Bedrock is tracked per call. When a budget is reached, spending is stopped within a few minutes, AI included, in every Region the account uses.
What happens to work and data when a budget is reached?
New activity is blocked and running services are stopped. Instances are stopped with their volumes kept, storage is untouched, and data is preserved wherever the service allows. When budget is added, the user carries on where they left off.
Can some accounts be monitored without being stopped?
Yes. Enforcement is chosen per account. Sandboxes, labs and experiments get hard stops, while production accounts can be monitored and alerted on without ever being stopped.
Does RosettaHub need administrative access to our accounts?
Yes, for accounts where it enforces budgets and cleans up, because stopping resources and recycling accounts both need those rights. Accounts that are only monitored need less, and the access you grant decides what RosettaHub can do in each one.
Can accounts be reused for the next course or project?
Yes. An account is fully cleaned before it goes to its next user, and its cost is attributed to each user for the exact period they held it.