Purpose of This Lesson

This lesson explains how AWS CloudFormation handles stack creation failures and update failures. The key assessment skill is recognizing which failure state a stack enters, whether resources remain available for troubleshooting, and how to return a failed update to a working state.

Key Concepts

• Stack creation failure: CloudFormation applies the configured OnFailure behavior when creation cannot complete.
• OnFailure behavior: The supported choices described in this lesson are:
• Do nothing: Leave the created resources in place so they can be inspected and troubleshot.
• Rollback: Remove the created resources and return the environment to its prior state.
• Delete: Delete the resources created for the failed stack.
• Stack update failure: CloudFormation attempts to roll the stack back to its previous known working state.
• UPDATE_ROLLBACK_FAILED: CloudFormation could not complete the rollback of all changes made during an update.
• Continue rollback: A stack in UPDATE_ROLLBACK_FAILED can be instructed to continue rolling back. A successful recovery returns it to UPDATE_ROLLBACK_COMPLETE.

CloudFormation Failure and Recovery Behavior

Stack Creation Failures

When stack creation fails, the default behavior is cleanup: the resources are removed. The OnFailure setting changes what happens next:

OnFailure choice	Result	Appropriate use
DO_NOTHING	Resources remain in place	Troubleshoot the failed deployment by inspecting the resources and their configuration
ROLLBACK	CloudFormation rolls the stack back and removes the created resources	Return to the original state after a failed creation
DELETE	The created resources are deleted	Remove the failed stack’s resources

The important operational distinction is that Do nothing preserves evidence, while rollback or delete removes the failed deployment’s resources. Choose the preservation option when investigation requires examining what was actually created.

Stack Update Failures

An update failure is handled differently from an initial creation failure. CloudFormation automatically attempts to return the stack to its previous known working state. If CloudFormation cannot roll back every change, the stack enters:

UPDATE_ROLLBACK_FAILED

A stack in this state is not available for normal updates. The required recovery path is to continue the rollback. If the rollback completes successfully, the stack reaches:

UPDATE_ROLLBACK_COMPLETE

After the stack returns to this working rollback-complete state, another update can be attempted. The sequence is:

1. An update fails.
2. CloudFormation attempts an automatic rollback.
3. The rollback cannot complete, so the stack enters UPDATE_ROLLBACK_FAILED.
4. Continue the rollback.
5. CloudFormation returns the stack to its prior working configuration and reaches UPDATE_ROLLBACK_COMPLETE.
6. Retry the update only after the stack has returned to a usable state.

Exam- or Assessment-Relevant Takeaways

• For a creation failure, identify the configured OnFailure behavior before deciding whether resources remain.
• Choose Do nothing when the scenario emphasizes troubleshooting or inspecting failed resources.
• Do not confuse creation failure handling with update failure recovery. An update failure triggers an attempted rollback to the previous known working state.
• UPDATE_ROLLBACK_FAILED means the automatic rollback itself was incomplete; it is not a normal update-ready state.
• You cannot update a stack while it is in UPDATE_ROLLBACK_FAILED.
• Use continue rollback to recover the stack, targeting UPDATE_ROLLBACK_COMPLETE as the successful recovery state.
• Do not retry an update immediately while rollback recovery is still incomplete.

Tool / Feature Decision Guide

Situation	Appropriate choice or action	Why
A new stack fails and the resources must be inspected	Set OnFailure to DO_NOTHING	The resources remain available for troubleshooting
A new stack fails and the environment should return to its prior state	Use rollback behavior	Created resources are removed as CloudFormation rolls back
A failed creation should have its resources deleted	Use delete behavior	The failed stack resources are deleted
An update fails but automatic rollback completes	Wait for the stack to return to its rollback-complete working state	The previous known working state has been restored
An update enters UPDATE_ROLLBACK_FAILED	Continue the rollback	The stack cannot be updated until rollback recovery completes

Common Traps / Misconceptions

• Assuming all failures behave the same: Creation failures use OnFailure; update failures invoke rollback toward the previous working state.
• Treating UPDATE_ROLLBACK_FAILED as update-ready: The stack cannot be updated in this state.
• Choosing rollback when troubleshooting requires the failed resources: Rollback removes the created resources, so use DO_NOTHING when preservation is needed for investigation.
• Confusing UPDATE_ROLLBACK_FAILED with successful recovery: The desired recovered state is UPDATE_ROLLBACK_COMPLETE.
• Retrying an update before recovery: First continue the rollback and verify that the stack has returned to a working state.
• Assuming an update failure permanently prevents future updates: Once rollback is successfully completed, the stack can be updated again.

Real-World Engineer / Analyst Notes

• Failure cleanup and failure diagnosis can require opposite choices. Automatic cleanup is useful for avoiding leftover resources, but preserving resources can provide the evidence needed to identify a configuration or dependency problem.
• Treat UPDATE_ROLLBACK_FAILED as a recovery incident rather than a routine deployment failure. Stabilize the stack first; only then attempt another change.
• When analyzing an incident, record whether the failure occurred during creation or update, the configured OnFailure behavior for creation, and the final CloudFormation stack status.
• A successful rollback does not fix the underlying cause of the failed update. Investigate and correct the problem before retrying the deployment.

Quick Reference Summary

• Creation failure: The OnFailure setting determines whether resources are preserved, rolled back, or deleted.
• Troubleshooting choice: DO_NOTHING leaves resources in place.
• Update failure: CloudFormation automatically attempts to return the stack to its previous known working state.
• Failed rollback state: UPDATE_ROLLBACK_FAILED.
• Recovery action: Continue the rollback.
• Successful recovery state: UPDATE_ROLLBACK_COMPLETE.
• Update restriction: A stack in UPDATE_ROLLBACK_FAILED cannot be updated.

Flashcards

Q: A newly created CloudFormation stack fails, and you need to inspect the resources that were created. Which OnFailure behavior should you choose?
A: Choose DO_NOTHING, because it leaves the resources in place for troubleshooting instead of removing them through rollback or deletion.

Q: What is the default high-level cleanup behavior when CloudFormation stack creation fails?
A: The failed stack’s resources are deleted through the default rollback/cleanup behavior described in the lesson.

Q: When should DO_NOTHING be preferred over rollback after a stack creation failure?
A: Use DO_NOTHING when preserving the failed resources is more important than immediate cleanup, such as when investigating the cause of the failure.

Q: How do rollback and delete differ as stack creation failure choices in this lesson?
A: Both remove resources, but rollback emphasizes returning the stack to its original state, while delete deletes the resources created for the failed stack.

Q: What does CloudFormation attempt to do automatically after a stack update fails?
A: It attempts to roll the stack back to the previous known working state.

Q: What does UPDATE_ROLLBACK_FAILED indicate?
A: It indicates that CloudFormation could not complete all rollback actions for a failed update.

Q: Can you update a CloudFormation stack while it is in UPDATE_ROLLBACK_FAILED?
A: No. The rollback must first be recovered successfully; the stack cannot be updated in that state.

Q: What action recovers a stack from UPDATE_ROLLBACK_FAILED?
A: Continue the rollback so CloudFormation can finish returning the stack to its previous working configuration.

Q: Which status indicates that rollback recovery completed successfully?
A: UPDATE_ROLLBACK_COMPLETE indicates that the stack has returned to a working rollback-complete state.

Q: A stack update failed and entered UPDATE_ROLLBACK_FAILED. Should you immediately retry the update?
A: No. Continue the rollback first and wait for successful recovery; only then investigate the original problem and retry the update.

Q: What is the key difference between a stack creation failure and a stack update failure?
A: Creation failure behavior is controlled by OnFailure, while an update failure automatically triggers an attempted rollback to the prior known working state.

Q: What is the operational tradeoff between preserving resources and cleaning them up after a failed creation?
A: Preserving resources supports diagnosis and inspection, while rollback or deletion reduces leftover failed infrastructure but removes evidence that may help troubleshooting.

Practice Questions

Question 1

A CloudFormation stack creation fails. The operations team wants to inspect the partially created resources to determine which dependency caused the failure. Which setting best supports this goal?

A. DO_NOTHING
B. ROLLBACK
C. DELETE
D. Continue rollback

Correct answer: A. DO_NOTHING

Explanation: DO_NOTHING leaves the resources in place. Rollback and delete remove resources, and continue rollback applies to update rollback recovery rather than initial creation troubleshooting.

Question 2

A stack update fails, and CloudFormation cannot undo all changes. The stack is now in UPDATE_ROLLBACK_FAILED. What should the engineer do before attempting another update?

A. Delete the stack immediately
B. Continue the rollback
C. Set OnFailure to DO_NOTHING
D. Retry the failed update

Correct answer: B. Continue the rollback

Explanation: A stack in UPDATE_ROLLBACK_FAILED cannot be updated. Continuing the rollback is the recovery action intended to return it to UPDATE_ROLLBACK_COMPLETE.

Question 3

Which state should an engineer expect after a successful recovery from UPDATE_ROLLBACK_FAILED?

A. CREATE_COMPLETE
B. UPDATE_IN_PROGRESS
C. UPDATE_ROLLBACK_COMPLETE
D. UPDATE_ROLLBACK_FAILED

Correct answer: C. UPDATE_ROLLBACK_COMPLETE

Explanation: Successful completion of the rollback returns the stack to UPDATE_ROLLBACK_COMPLETE, after which a new update can be attempted.

Question 4

A team wants failed stack creations to clean up all created resources rather than leave them available for investigation. Which failure-handling approach matches that requirement?

A. DO_NOTHING
B. Rollback or delete
C. Continue rollback
D. Leave the stack in UPDATE_ROLLBACK_FAILED

Correct answer: B. Rollback or delete

Explanation: Rollback returns the failed creation to its original state by removing created resources, while delete deletes the resources. DO_NOTHING preserves them, and the other choices concern update recovery.

WordPress Metadata

Suggested Slug:
aws-cloudformation-rollbacks-stack-creation-failures

Meta Description:
Understand AWS CloudFormation stack creation failure options, update rollback behavior, and how to recover stacks in UPDATE_ROLLBACK_FAILED.

Tags:
AWS CloudFormation, AWS Certified CloudOps Engineer, SOA-C03, stack creation failures, stack rollbacks, UPDATE_ROLLBACK_FAILED, infrastructure as code, deployment automation