Stack is in ROLLBACK_COMPLETE state and can not be updated

WHAT IT MEANS

What this error means

ROLLBACK_COMPLETE is a terminal state that only exists after a failed initial stack creation. There is no last-known-good version for CloudFormation to update from, so every subsequent sam deploy or aws cloudformation deploy against the same stack name fails with this message — regardless of whether you fixed the template.

Two separate problems are stacked here, and retry loops in CI make it easy to conflate them:

• The original failure. Some resource hit CREATE_FAILED on the first deploy. That root cause still exists and will fail the recreate too if you skip it.
• The stuck stack. The rolled-back stack occupies the stack name and blocks all updates until it is deleted.

FIX

How to fix it

1. Find the original failure first. List the stack events and locate the earliest CREATE_FAILED entry — that status reason is the actual root cause:

   aws cloudformation describe-stack-events --stack-name YOUR_STACK \
     --query "StackEvents[?ResourceStatus=='CREATE_FAILED'].[LogicalResourceId,ResourceStatusReason]" \
     --output table

2. Fix that root cause in the template, parameters, or permissions. Deleting and redeploying without this step reproduces the same failure.
3. Review what the failed stack holds, then delete it. A rolled-back initial create normally retains nothing valuable, but confirm before deleting — some resources (buckets, log groups) can be configured to be retained:

   aws cloudformation delete-stack --stack-name YOUR_STACK
   aws cloudformation wait stack-delete-complete --stack-name YOUR_STACK

4. Deploy again with the same stack name. With the root cause fixed and the name free, the create can proceed normally.
5. Optional, for iterating on new stacks: sam deploy --disable-rollback keeps successfully created resources on failure so you can fix forward during development instead of hitting this state repeatedly. Use it consciously — it leaves partial stacks behind.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes this state (high confidence), separates it from ordinary rollback noise, and points you at the first failed resource event instead of the end-of-stack symptom. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• DELETE_FAILED — the cleanup itself gets blocked by a non-empty bucket or attached network interface.
• InsufficientCapabilitiesException — a common root cause of the original CREATE_FAILED.
• Rate exceeded (Throttling) — transient API throttling that can fail an initial create.

Longer walkthrough: finding the first useful CloudFormation failure.