ERROR REFERENCE
Stack entered rollback (the consequence, not the cause)
ROLLBACK_IN_PROGRESS means CloudFormation is undoing a
deploy because something already failed. Debugging the rollback
itself is looking at the ambulance instead of the accident — the
question is always what failed before it started.
WHAT IT MEANS
Where each state leads
ROLLBACK_IN_PROGRESS— a first-deploy failure being undone; it ends inROLLBACK_COMPLETE, which requires deleting the stack before retrying.UPDATE_ROLLBACK_IN_PROGRESS— a failed update returning to the previous working state; usually ends inUPDATE_ROLLBACK_COMPLETEand the stack is fine.ROLLBACK_FAILED/UPDATE_ROLLBACK_FAILED— the rollback itself hit something it could not undo, and the stack needscontinue-update-rollbackor manual cleanup.
TRIAGE
How to triage it
-
Find the failure that triggered it — the first
CREATE_FAILED/UPDATE_FAILEDevent before the rollback began:aws cloudformation describe-stack-events --stack-name my-app \ --query 'reverse(StackEvents)[?contains(ResourceStatus, `FAILED`)] | [0]' - Fix that cause, not the rollback. The rollback events themselves rarely contain new information.
-
Then handle the landing state: delete and
recreate for
ROLLBACK_COMPLETE, redeploy normally afterUPDATE_ROLLBACK_COMPLETE, orcontinue-update-rollbackfor the failed-rollback states.
AUTOMATE THE TRIAGE
Diagnose this automatically
SAM Doctor reports the rollback state at medium confidence and the root failure above it at high confidence, in log order - so the first finding in the report is the one to fix. Runs locally; no AWS access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- CREATE_FAILED / UPDATE_FAILED — the accident this ambulance responds to.
- ROLLBACK_COMPLETE and can not be updated — where a first-deploy rollback lands.
- Rollback could not delete an IAM role — the commonest way a rollback itself fails.