[paranoidrobot]

> it's fairly straightforward to partition / reduce / sandbox environments in Linux.

Perhaps in some distros, but not so much elsewhere.

> Do you need to touch AWS infrastructure from the same account, host, vm as you read email or surf the web?

In short: Yes.

> do these environments need full, direct internet access?

Not sure what you mean by the environment, but in general, yeah - a whole bunch of tooling these days is basically unusable without internet access.