Can I force delete an AWS CloudFormation stack that is In Progress of Rollback

Another common cause of blocked stack updates/rollbacks is errors in ECS::Service resource updates: it doesn't look like that is currently detected (in some cases?). Cloudformation is waiting for the service event for the service reaching a steady state, so simply updating the service to something that works (e.g. desired tasks to 0) will unblock it. Try to get the state back to what Cloudformation expects before sending more updates to avoid problems, though.


I guess your stack resources are changed or deleted by outside. You can find official guide as below.

Manually sync resources so that they match the original stack's template, and then continue rolling back the update. For example, if you manually deleted a resource that AWS CloudFormation is attempting to roll back to, you must manually create that resource with the same name and properties it had in the original stack.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed

or (as @talentedmrjones said)

To fix the stack, contact AWS customer support.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-nested-stacks-are-stuck

In my case, I can stop same situation via re-creating deleted resource.


In my case it is an EC2 security group that cannot be deleted because it is referenced from another EC2 security group.


When dealing with a custom resource it is possible to construct a mocked up version of the return url.

The easiest way to do this is to grab the url which was used during the create. If you can get your hands on it, replace the section after the last %2F with the "Client Request Token" which you can get from your event log for the cloudformation.

If not, then here's the format of the url you'll have to construct.

https://{region}.console.aws.amazon.com/cloudformation/home?region={region}#/stacks?filter=active&tab=events&stackId={stack arn}%2F{stack name}%2F{client request token}

Run that url as a get and it will cause the resource to fail rollback or delete.