SAM Doctor

ERROR REFERENCE

CREATE_FAILED / UPDATE_FAILED (a resource, not the stack)

CREATE_FAILED is not one error — it is CloudFormation reporting that some specific resource failed for some specific reason, followed by a wall of rollback noise. The triage skill is finding the first failed resource and reading its status reason; everything after it is consequence.

WHAT IT MEANS

What this event means

Each failed event carries the three things that matter: the logical resource ID, the resource type, and a status reason - often with a nested Resource handler returned message: "..." quoting the actual service error. Once one resource fails, CloudFormation cancels the siblings (Resource creation cancelled) and rolls back the rest; those later events are noise wearing the same *_FAILED costume.

TRIAGE

How to triage it

  1. Read events oldest-first and stop at the first failure (read-only): 
    aws cloudformation describe-stack-events --stack-name my-app \
  --query 'reverse(StackEvents)[?contains(ResourceStatus, `FAILED`)] | [0]'
  2. Read the nested handler message first. The quoted service error ("already exists", "not authorized", "invalid request") names the real cause; the stabilization or cancellation wording around it is the wrapper.
  3. Fix the resource-level cause, then redeploy. If this was the stack's first deploy, expect ROLLBACK_COMPLETE to require a delete before the retry.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor orders findings by first matching line, so the root failure outranks the rollback noise it caused - and when the status reason matches a more specific rule (a taken bucket name, a missing capability), that rule reports instead of the generic one. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED