How would you architect a secure clickops friendly sandbox account?

[nitrocode]

Developers want to experiment and PoC apps and don't want to use terraform or even yaml. Trying to convince them of that approach is an uphill battle even if you spend cycles to make their life easier. This also comes up in annual hackathons.

I thought perhaps a sandbox would be fitting.

1. Special RCP on sandbox to prevent data sharing to any other accounts using resource policies
2. Special RCP for all other accounts to prevent sharing to sandbox
3. Normal protections (securityhub, guardduty, macie / dspm, cnapp, service control policies, cloudtrail, etc) for the rest of the org
4. Ban sensitive data like PII and PHI so all data would need to be contrived
5. Everyone gets PowerUserAccess and iam changes still need to be in terraform
6. Temporary resources - TTL tag that removes resources using aws-nuke in some pipeline
7. Basics setup in the account (vpc, igw, nat, route53 zone, wildcard acm record, etc)

What are your thoughts? How can we create a frictionless sandbox for ephemeral resources so users can experiment without shooting the company in the foot?

[milldr]

We helped a few customers set up similar sandbox accounts. The idea is that developers or a team of developers has their own sandbox account(s) where they have full control.

1. The account is isolated from the private network for the rest of the org, so they can really do whatever they want in that protected account.
2. Typically they would have PowerUser in that account, but you can tweak their permission if necessary.
3. You can still impose organizational policies for some level of protection, install compliance and security tools if required, or set up budgets.
4. You can run a scheduled workflow with either cloud-nuke or AWS nuke to reset the account regularly.

We have a bit more on account-level boundary design here as well.

[milldr]

Also most importantly, they need to able to access that account quickly! Chaining IAM roles with the AWS Teams & Team Roles architecture is far too complex and not user friendly for clickops usage. So in this case we almost always deploy a Permission Set with AWS IAM Identity Center to allow direct access into the account without chaining