Student Cloud Sandboxes with Budgets and Automatic Cleanup for University Labs
Build a system that gives every student in a cloud computing course their own sandbox on AWS, Azure or Google Cloud, with a budget, least-privilege access, required tags and nightly clean-up of anything left running, plus a lecturer dashboard. A beginner-to-intermediate cloud and DevOps final year project that solves a problem every university lab has: surprise bills and forgotten resources.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
6 to ship
4 optional extrasSuggested stack
What you should ship
- A sandbox vending flow: a lecturer uploads a class list and each student gets an isolated AWS account, Azure subscription or resource group, or Google Cloud project, created from Terraform
- Per-sandbox budgets with alerts at set thresholds to the student and the lecturer, and an automatic action that stops compute when a hard class limit is reached
- A least-privilege student role that allows the services the course uses in one region and denies expensive or risky ones, enforced by guardrail policies
- Required tags or labels (course, student, expiry) and a scheduled clean-up job that deletes expired or untagged resources after a warning email
- A lecturer dashboard showing spend per student, running resources, policy violations and clean-up history
- A report comparing spend and forgotten resources with and without the system over a few weeks of real or simulated lab use
If you have time left
- Support a second cloud through the same dashboard
- Lab templates: a lecturer picks an assignment and every sandbox gets the starting infrastructure pre-deployed
- An automatic checker that tests whether a student's deployed assignment meets the rubric
- Weekly cost tips to each student based on what they left running
The problem: students learn cloud, and bills learn them back
Cloud computing courses ask students to create real resources. Students leave virtual machines, NAT gateways, load balancers and databases running after the lab, share one account and one admin password, or push access keys to public GitHub repositories. Lecturers find out at the end of the month, when the credit is gone or a card has been charged. In Pakistan and India, where many students use their own card or a shared department account, one forgotten resource can end a course's cloud access for everyone.
What already exists and the gap
- AWS Academy Learner Lab gives students in member institutions a sandboxed AWS environment with credits, but only for institutions in the programme and only with the services and limits AWS sets.
- Azure for Students gives individual students credit without a card, but each student manages their own subscription with no lecturer view. Azure Lab Services, which many universities used for classroom VMs, stopped accepting new customers in July 2024 and retires on 28 June 2027.
- Google Skills (formerly Google Cloud Skills Boost) labs run in temporary projects that are deleted afterwards, which is great for guided labs but not for a semester project.
- Open-source clean-up tools such as aws-nuke and cloud-nuke delete resources, but they are command-line tools for engineers, with no budgets, roles, tags or lecturer dashboard.
The gap is a small, open system a lecturer can run on the university's own cloud account: one sandbox per student, guardrails, budgets, clean-up and a view of the whole class.
Inspiration
Many universities run cloud computing and DevOps courses on donated credits or a single department account. Real companies solve the same problem with "account vending" and landing zones: every team gets its own isolated account or project with guardrails from day one. This project brings that pattern to a classroom.
What you build
Pick one cloud for the core project. On AWS, sandboxes are accounts in an AWS Organizations organisational unit with a service control policy. On Azure, they are subscriptions or resource groups under a management group with Azure Policy and RBAC. On Google Cloud, they are projects in a folder with organisation policies and IAM. Terraform creates each sandbox, its budget, its student role and its tags. A scheduled function scans for expired or untagged resources, warns the student, then deletes them. A web dashboard shows the class at a glance.
The technically interesting part
Designing the guardrails. You must decide which services and regions students may use, how to deny expensive instance sizes, how to stop compute when a budget is exceeded (budgets alert but do not stop anything on their own), and how to delete resources safely in the right dependency order without touching anything shared.
How you will evaluate it
Run a pilot with a few classmates for two to four weeks, or simulate a lab with scripted students who forget resources. Measure resources left running overnight, spend per student, time for a lecturer to set up a class, and any false deletions. Compare with a baseline week without the system.
Path to a product
Universities, bootcamps and corporate training teams all run hands-on cloud labs. A hosted version could charge per seat per course, with templates for popular courses and certification labs. Start by running it for one department free in return for feedback, then package the Terraform modules and dashboard so other lecturers can install it.
Scope warning
Do not try to support all three clouds or every service. One cloud, one region, a short list of allowed services and a working clean-up loop is a strong project. Never test clean-up on an account that holds anything real.
Learn what you need on Sefism
- Cloud engineering roadmap: pick AWS, Azure or Google Cloud and work through identity, compute, storage, networking, cost and infrastructure as code in order.
- Cloud engineering cheat sheet: the service name map across the three clouds, IAM policy anatomy, budgets, cost traps and Terraform basics in a line or two each.
- Terraform Tutorials: the get-started collections for AWS, Azure and Google Cloud.
- AWS Documentation, Azure documentation and Google Cloud Documentation: the organisation, policy, budgets and IAM pages for your cloud.
- FinOps Framework: vocabulary for the cost side of your report.
Get help with this idea
The risk with this project is a clean-up job that deletes the wrong thing, or guardrails so strict students cannot finish their labs. Tauseef can help you cut the scope to one semester, choose the cloud and services, and plan an evaluation your supervisor will accept. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.