An error occurred (Throttling): Rate exceeded

WHAT IT MEANS

What this error means

CloudFormation's control-plane APIs (DescribeStacks, DescribeStackEvents, change-set calls) are rate-limited per account per Region. When the combined call rate from everything in the account crosses the limit, calls fail with Throttling: Rate exceeded. Your template and your permissions are fine. Typical contributors:

• CI fan-out. Matrix builds or monorepo pipelines deploying many stacks into the same account and Region at once — each deploy also polls stack events continuously.
• Background automation. Drift detection schedules, dashboards, or scripts polling DescribeStacks in a loop.
• Shared accounts. Another team's burst consumes the same per-account budget; your deploy is collateral.

The failure is bursty and unfair: whichever call happens to land during the burst loses, which is why a re-run often "just works".

FIX

How to fix it

1. Retry after a pause. For a one-off failure this is the whole fix. Do not change the template.
2. Make retries systematic, not manual. Raise the SDK retry budget for deploy jobs instead of wrapping the command in a sleep loop:

   # environment for the deploy step
   AWS_RETRY_MODE=adaptive
   AWS_MAX_ATTEMPTS=10

3. Reduce concurrency at the source. Serialize or batch stack operations that target the same account and Region — a concurrency group in GitHub Actions on the account/Region pair is often enough:

   concurrency:
     group: cfn-ACCOUNT-REGION
     cancel-in-progress: false

4. Find the noisy neighbor. If throttling recurs at quiet times, use CloudTrail to see which principal is hammering DescribeStacks/DescribeStackEvents — scheduled drift detection and monitoring dashboards are frequent culprits.
5. Request a quota increase only for genuine steady-state load. If the account legitimately runs this many concurrent stack operations, ask AWS Support to raise the CloudFormation throttling limits; otherwise the increase just moves the cliff.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes Throttling and Rate exceeded signals and labels them as transient capacity conditions, so nobody "fixes" a working template at 2 a.m. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• The security token included in the request is expired — the other classic transient deploy failure.
• ROLLBACK_COMPLETE state and can not be updated — what a throttled initial create can leave behind.
• DELETE_FAILED — cleanup failures that also tempt people into retry loops.