RosettaHub and AWS Innovation Sandbox¶
Sandbox accounts since 2016, governed end to end.
RosettaHub has run sandbox accounts for universities and research institutions since 2016, for a workshop, a course or a whole grant. If you are looking at Innovation Sandbox on AWS, this page sets out how the two compare.
What RosettaHub brings to sandbox accounts¶
| Budgets that hold | Cost tracked from resource events as they happen, Amazon Bedrock per call. At the limit, spending stops within a few minutes in every active Region, AI included, with the work kept wherever the service allows. Each account has its own start date, unused budget carries over, and transfers are logged. See Budgets and Enforcement |
| Control per role and per user | Regions, services, instance types, GPUs and AI models allowed per role and per user; quotas on machines, volumes and storage checked when resources are created; continuous compliance implemented with Cloud Custodian |
| Administration where it belongs | Nested organizations for faculties, departments, courses and research groups. Each administrator manages their own users, accounts, budgets and policies. See Organizations |
| Ready to work | Single sign-on with your institution's identity provider, then direct access to the AWS console and CLI, federated through IAM roles. Labs in one click in the browser. See AWS console access |
| FinOps built in | Real-time costs, alerts at 50, 70, 90 and 100%, daily reports, FOCUS 1.3 and CUR 2.0 data enriched per user and organization, idle clean-up and rightsizing |
| Accounts that last, then recycle | An account stays governed for as long as the course or project runs, then is fully cleaned and goes to its next user, with cost attributed to each holder for the exact period they held it. See Cloud Accounts |
Side by side¶
Every statement about Innovation Sandbox below comes from AWS's Innovation Sandbox on AWS implementation guide, version 1.3.5, read in October 2026. The solution is updated often; check the current version.
| Innovation Sandbox on AWS | RosettaHub | |
|---|---|---|
| Designed for | Disposable, short-lived environments, in AWS's words: classroom labs, tests, workshops | Accounts governed for as long as they are needed: courses, projects, research groups, departments |
| Budget tracking | Hourly checks against Cost Explorer data, which can be up to 24 hours old; AWS describes the checks as "best effort" | Costs tracked and stopped within a few minutes, AI included |
| At the budget limit | The lease is frozen and the user's access removed. AWS: "active resources will continue to incur costs" | New activity blocked, running services stopped in every active Region, data preserved wherever the service allows |
| Usage controls | One set of policies for all sandboxes: allowed services and Regions | Regions, services, instance types and AI models per role and per user; quotas checked when resources are created |
| Budgets | One total per lease, counted from approval; each new lease starts a new budget | A budget per account with its own start date; unused budget carries over; transfers are logged |
| Organization | Administrators, managers and users, across the whole deployment | Nested organizations and delegated administration; each manager sees only their own part |
| FinOps | A budget per lease and monthly cost reports | Real-time costs, alerts, daily reports, enriched FOCUS and CUR data, idle clean-up, rightsizing |
| Access to accounts | AWS console and CLI, through IAM Identity Center | Single sign-on with your identity provider; AWS console and CLI, federated through IAM roles |
| Ready-made labs | Not provided | Labs in one click in the browser: virtual machines, Jupyter, RStudio, VS Code, containers, clusters |
| Recycling accounts | AWS Nuke clean-up; AWS notes its check "cannot guarantee complete cleanup" | Full clean-up before an account goes to its next user, with cost attributed to each holder |
| Clouds | AWS | AWS, Azure, Google Cloud and Alibaba Cloud, through one API |
| Operation | Deployed, upgraded and operated by your team in your AWS organization | Multi-tenant SaaS operated by RosettaHub, or a platform dedicated to you |
Common questions¶
What is Innovation Sandbox on AWS?
An AWS Solution with no licence fee that lends temporary AWS accounts with a spending limit and cleans them for the next user. Your team deploys, patches, upgrades and operates it, and it runs on AWS infrastructure in your own AWS organization, which you pay for.
Can some accounts be monitored without being stopped?
Yes. Enforcement is chosen per account. Sandboxes, labs and experiments get hard stops, while production accounts can be monitored and alerted on without ever being stopped.
Does RosettaHub need administrative access to our accounts?
Yes, for accounts where it enforces budgets by stopping resources and recycles accounts, because both need those rights. Accounts that are only monitored need less, and the access you grant decides what RosettaHub can do in each one. See Account Access and Scopes.