One thing that comes to mind (without knowing your plans, goals, or vendor for this project) is to have a separate VPC for your sandbox, perhaps under a separate account. It might even behoove you to have a separate cloud vendor for your sandbox.
One article that I've found lately is this one:
https://aws.amazon.com/blogs/mt/best-practices-creating-managing-sandbox-accounts-aws/------------------------------
Matthew Jennings
IT Security Architect
State of Arkansas - Administrative Office of the Courts
------------------------------
Original Message:
Sent: Aug 11, 2022 11:54:48 AM
From: Derrek Arce
Subject: Building a Cloud Sandbox
I have been tasked with securing a cloud sandbox for our organization that is in planning phases of development. I am trying to get some good references on what good guardrails would be to put in place to ensure the security and total separation of the environment from the rest of our cloud organization. I have found the link below, so any additional would help! Thank you!
Best practices for creating and managing sandbox accounts in AWS | Amazon Web Services
------------------------------
Derrek Arce
Senior Cloud Security Engineer
Arvest
------------------------------