Organizations need to programmatically manage AWS access when providing developers with sandbox environments, but balancing innovation freedom with cost control requires building automated solutions beyond standard AWS Budgets alerts. Development teams need AWS resources to experiment and build, but without proper guardrails, sandbox accounts can generate unexpected expenses that spiral out of control. Traditional budget alerts notify administrators after spending exceeds thresholds, but manual intervention creates delays and requires constant oversight.

In this post, you’ll learn how to build a programmatic solution that automatically limits and revokes developer access when AWS Budgets thresholds are exceeded. You’ll create a “circuit breaker” that automatically prevents further resource creation while maintaining a clear audit trail. Although AWS Budgets natively supports Budgets Actions such as applying SCPs or stopping EC2 instances, this guidance shows how you can manage IAM Identity Center permission set assignments. This post expands on the remediation actions approach introduced in Automating Budget Management Across Multi-Account Environments, taking it further by implementing an automated IAM Identity Center permission set revocation, a capability not covered by native Budgets Actions

You’ll also learn how to implement automated cost protection that lets you provision developer sandbox environments without worrying about runaway costs. The solution provides automated cost protection through access revocation upon budget threshold breach, reduces manual monitoring overhead for AWS admin teams, and includes clear procedures for restoring access after budget resets. By the end of this walkthrough, you’ll have a scalable governance framework that works across multiple sandbox accounts in your AWS Organization.

Solution overview

This solution implements an automated cost protection mechanism for AWS sandbox environments using a “circuit breaker” pattern. When spending exceeds predefined budget thresholds, the system automatically revokes developer access to prevent further resource creation. The architecture combines four core AWS services in an event-driven workflow:

1. AWS Budgets monitors account spending
2. Amazon Simple Notification Service (SNS) provides event notification
3. AWS Lambda executes the revocation logic
4. AWS IAM Identity Center (successor to AWS Single Sign-On) manages centralized access control

Figure 1 below illustrates the solution:

Figure 1: Solution Architecture

The automation workflow operates through six sequential steps.

1. AWS Budgets monitors sandbox account spending against configured thresholds up to three times per day.
2. If spending reaches the defined threshold, AWS Budgets publishes a notification to a pre-configured SNS topic.
3. The SNS notification triggers a Lambda function that assumes an IAM execution role with permissions to call IAM Identity Center APIs.
4. The function then removes the user’s Permission Set assignment from the sandbox account using the AWS Software Development Kit (SDK).
5. Once the assignment is deleted or modified, the sandbox user loses access to AWS resources in that account once their session token expires (up to the configured session duration). User is either completely blocked from signing-in to the account or gets limited access with read-only restrictions.
6. Actions are logged to Amazon CloudWatch Logs and captured in IAM Identity Center audit trails for compliance tracking.

The solution deploys via AWS CloudFormation templates that provision the budget, SNS topic, Lambda function, and necessary IAM roles. Administrator(s) receive email notifications when the circuit breaker activates and removes the Permission Set of the sandbox accounts. Administrators can restore access through IAM Identity Center after budget periods reset or spending is reviewed.

Prerequisites

1. An AWS account with AWS Organizations enabled
2. Management account access to create budgets and deploy CloudFormation templates
3. At least one sandbox account within your AWS Organization
4. AWS IAM Identity Center configured with dedicated Group for sandbox users
5. Basic familiarity to concepts of IAM roles, Permission Sets, AWS Budgets actions

Deploying the solution

This walkthrough shows you how to launch the solution stack with AWS CloudFormation. You’ll create a system that automatically revokes IAM Identity Center access when budget thresholds are exceeded.

Navigate to the GitHub repository and follow the deployment steps. Replace the default values for the parameters in the CloudFormation Stack Deployment page as shown in Figure 2.

The core of this solution is the RevokeGroupPermissionSet Lambda function. When triggered by an SNS notification from AWS Budgets, it performs the following logic:

1. Validates that the incoming event is a legitimate AWS Budgets SNS notification.
2. Loads configuration from environment variables: the IAM Identity Center instance, target account IDs, target group names, and the chosen action mode.
3. For each target account and group, lists existing permission set assignments.
4. If the action mode is convert-to-read-only, grants the read-only permission set first — if this fails, it stops to avoid locking users out entirely.
5. Deletes all other permission set assignments for the group in that account.

The function supports two modes: revoke-full-access (removes all assignments, completely blocking access) and convert-to-read-only (grants a read-only permission set before removing others, preserving visibility without write access). See the full implementation in the GitHub repository.

Figure 2: CloudFormation Stack Parameters Page

Important: Make sure to launch this solution in the same AWS account and region as your AWS IAM Identity Center.

After deployment, navigate to the Outputs section of the CloudFormation console, which will display the resources created by the template for quick access as shown in Figure 3.

Figure 3: CloudFormation Output Page

Testing the solution

Now let’s validate that it works as expected by simulating a budget threshold action.

Simulate a budget alert

1. Navigate to the AWS Lambda console and select the RevokeGroupPermissionSet function created by the CloudFormation stack.
2. Choose the Test tab and create a new test event.
3. For Event name, enter BudgetThresholdTest.
4. Paste in the following JSON and click Save.

   {
     "Records": [
       {
         "EventSource": "aws:sns",
         "Sns": {
           "Message": "AWS Budget Notification Test"
         }
       }
     ]
   }
   

5. Choose Test to execute the function.

Verify the circuit breaker activated

1. Review the Execution results tab to confirm the function completed successfully without errors.
2. Open CloudWatch Logs (linked from the Lambda console) to examine detailed execution logs. An example output is featured in Figure 4. Log elements include:
   1. Which IAM Identity Center groups were processed
   2. Which sandbox accounts had access revoked
   3. API calls made to IAM Identity Center
3. Navigate to the IAM Identity Center console and verify that permission set assignments were removed for the configured groups in your test sandbox account.
4. (Optional) Attempt to access the sandbox account as a user in the revoked group to confirm access is blocked.

Figure 4: CloudWatch Logs for the Lambda function

Restore access after testing

To restore access after validation:

1. Open the IAM Identity Center console.
2. Navigate to AWS accounts and select your sandbox account.
3. Manually reassign the appropriate permission sets to the groups that were revoked during testing.

The circuit breaker is now validated and will automatically revoke access when actual budget thresholds are exceeded in production.

Estimated Cost of the Solution

This solution is designed to operate at minimal cost. For accounts eligible for the AWS Free Tier — available for 12 months after account creation — all resources stay well within free limits. AWS Lambda’s Free Tier includes 1 million requests per month, and Amazon SNS includes 1 million publishes per month; this solution generates only a few invocations per day per sandbox account, which is negligible against those limits. For accounts beyond Free Tier eligibility, or organizations managing many sandbox accounts where invocations aggregate, costs remain minimal (typically under $1/month) but are not zero. Review the Free Tier FAQs and individual service pricing pages to confirm current limits and eligibility before deploying.

Considerations

Before deploying this solution, keep the following in mind:

1. Active session persistence: Revoking a permission set assignment does not immediately terminate active sessions. Users already logged in may retain access until their session token expires, up to the configured session duration (default 1 hour).
2. Actual vs. forecasted budget thresholds: This solution uses actual spend thresholds, meaning the circuit breaker triggers only after spending has already occurred — it is reactive by nature. AWS Budgets also supports forecasted thresholds, which trigger based on projected spend before the limit is reached. For protecting against runaway costs, forecasted thresholds are more proactive, but also more prone to false positives, especially early in a billing period when AWS has limited data to project from.
3. Management account deployment: This solution deploys Lambda and SNS in your management account because both AWS Budgets (for cross-account spend monitoring) and IAM Identity Center’s organization instance reside there. While AWS best practice recommends minimizing workloads in the management account, a delegated administrator account cannot create cross-account budget alerts, making this trade-off necessary. To mitigate risk, the Lambda function’s IAM role follows least-privilege principles, scoped only to IAM Identity Center and CloudWatch Logs actions.

Cleanup

In a case when sandbox accounts are closed and/or budget monitoring is no longer required, remove the resources you created to avoid incurring potential ongoing charges.

Navigate to the CloudFormation console

1. Locate the CloudFormation stack used to launch this solution, select the radio button next to its name.
2. Choose the Delete button and confirm the action.

Conclusion

In this post, we showed how to implement an automated cost protection system that revokes AWS sandbox access when budget thresholds are exceeded. This lightweight solution combines AWS Budgets, Amazon SNS, AWS Lambda, and IAM Identity Center to create a “circuit breaker” that prevents runaway costs without requiring AWS Control Tower overhead.

To extend this solution, consider implementing automated access restoration after monthly budget resets, adding CloudWatch alarms for proactive monitoring, or deploying across multiple sandbox accounts using AWS Organizations service control policies.

For more information about the AWS services used in this solution, see:

• AWS Budgets
• AWS IAM Identity Center
• AWS Lambda 

Start protecting your sandbox environments today by deploying the CloudFormation template from our GitHub repository.