SAM Doctor

ERROR REFERENCE

Rollback could not delete an IAM role

The stack was rolling back, tried to delete a role it had created, and could not — leaving the stack in ROLLBACK_FAILED. Almost always, something outside the stack attached itself to the role after creation.

WHAT IT MEANS

What this error means

IAM refuses to delete a role that still has attached policies, instance-profile membership, or (depending on path) an active service-linked use. CloudFormation only knows about the attachments it made; a policy attached by hand, by another stack, or by an automation after the role existed is invisible to it — and fatal to the delete.

FIX

How to fix it

  1. See what is still attached (read-only): 
    aws iam list-attached-role-policies --role-name my-app-role
aws iam list-role-policies --role-name my-app-role
aws iam list-instance-profiles-for-role --role-name my-app-role
  2. Detach what the stack did not create — the out-of-band policy or instance profile — then continue the rollback: 
    aws cloudformation continue-update-rollback --stack-name my-app
  3. Use --resources-to-skip sparingly - only for a resource that genuinely cannot roll back, because a skipped resource stays orphaned and becomes the next deploy's surprise.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the failed-role-delete wording (medium confidence) inside rollback noise. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED