Access Your AWS Sandbox Account

How to request and access a temporary AWS sandbox account via the Elite Academy Innovation Sandbox portal.

What is the AWS Sandbox?

The Elite Academy AWS Sandbox is powered by Innovation Sandbox on AWS (ISB) — an AWS Solution that provides managed, temporary AWS accounts. You get a real AWS account with budget limits and a time-based lease. When your lease expires, the account is automatically cleaned up.

Prerequisites

• You are a registered participant in an Elite Academy program
• Your email has been added to IAM Identity Center by your administrator
• You have set your password via the password reset email

1 Open the Sandbox Portal

Go to the Innovation Sandbox portal:

https://aws-sandbox.eliteacademy.id

Sign in with your IAM Identity Center credentials (same email and password as Kiro login).

2 Check for Assigned Leases

Your administrator may have already assigned a lease to you. After logging in, check the dashboard:

1. Look for an "Active Leases" or "My Leases" section on the dashboard
2. If you see an active lease with status "Active", you already have access — skip to Step 4
3. If no lease is assigned, proceed to Step 3 to request one

Lease Status Meanings

Status	Meaning	Action
Active	Account is ready to use	Click "Access Account"
Pending	Waiting for admin approval	Wait for notification
Frozen	Budget or time limit reached — read-only	Contact admin for extension
Expired	Lease ended, account being cleaned up	Request a new lease

3 Request a New Lease (If Needed)

If you don't have an assigned lease, request one:

1. Click "Request Lease" or "New Lease"
2. Select a lease template (your admin may have pre-configured options like "Bedrock Lab" or "General Sandbox")
3. Review the budget limit and duration
4. Accept the terms of use
5. Click "Submit"

4 Access Your AWS Account

Once your lease is approved and active:

Option A: AWS Console (Browser)

1. In the sandbox portal, find your active lease
2. Click "Access Account"
3. This opens the AWS Console via SSO — you're logged in automatically

Option B: CLI Credentials (Programmatic Access)

1. In the sandbox portal, click your active lease
2. Look for "CLI Credentials" or "Programmatic Access"
3. Copy the three values:

export AWS_ACCESS_KEY_ID="ASIA..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_SESSION_TOKEN="..."

Option C: AWS SSO Portal (Direct)

You can also access your sandbox account directly via the SSO portal:

https://eliteacademy.awsapps.com/start

1. Sign in with your email and password
2. You'll see your assigned AWS account(s)
3. Click the account → choose "Management console" or "Command line or programmatic access"

5 Verify Your Access

Once in the AWS Console:

1. Check the region in the top right — it should say Singapore (ap-southeast-1)
2. Try opening a service like S3 or Lambda to confirm access works
3. If you need Bedrock, go to Amazon Bedrock → Model access and check which models are enabled

What You Can Do in the Sandbox

Allowed	Restricted
Create Lambda functions	Create IAM users (use existing roles)
Create S3 buckets	Modify organization settings
Use Amazon Bedrock (if enabled)	Launch expensive instances (p4d, etc.)
Create API Gateway APIs	Create VPN/Direct Connect
Deploy CloudFormation stacks	Exceed budget limit
Use DynamoDB, SQS, SNS	Access other accounts

Monitor Your Lease

In the sandbox portal, your lease shows:

• Time remaining — how long until your lease expires
• Budget used — current spend vs. your limit
• Account status — Active, Frozen, or Expired

Using Sandbox Credentials with GitHub Actions

If you're deploying via GitHub Actions (e.g., the PartyRock tutorial), add these as GitHub secrets:

Secret Name	Value
AWS_ACCESS_KEY_ID	From CLI credentials (starts with ASIA)
AWS_SECRET_ACCESS_KEY	From CLI credentials
AWS_SESSION_TOKEN	From CLI credentials (very long string)
SAM_DEPLOY_BUCKET	Create one in S3, or use a pre-existing bucket

Troubleshooting

Issue	Solution
"Access Denied" in console	Your lease may have expired or been frozen. Check the sandbox portal.
ExpiredTokenException	Get fresh CLI credentials from the sandbox portal.
Can't create IAM roles	SCPs restrict this. Use the pre-existing execution role provided by the sandbox.
Bedrock models not available	Ask your admin to enable model access for the sandbox OU.
"Budget exceeded"	Your spend hit the limit. Ask admin to increase or wait for a new lease.
Account shows "Frozen"	Budget or time limit reached. You can view but not modify resources.
Can't access certain regions	SCPs may restrict regions. Use ap-southeast-1 (Singapore).

Quick Reference

Need Help?

Type	Contact
Lease approval / budget increase	Contact your program administrator
Password reset	Ask admin to resend from IAM Identity Center
Technical issues	Contact your program's technical coach