SAM Doctor

ERROR REFERENCE

Stack deletion blocked by termination protection

The delete was refused because someone deliberately armed termination protection on this stack. That refusal is the feature working — the only question is whether the protection is still supposed to be there.

WHAT IT MEANS

What this error means

ValidationError ... cannot be deleted while TerminationProtection is enabled is a stack-level setting, not a permissions problem — broader IAM policies will not change the answer. Protection is usually enabled on production stacks precisely so a scripted cleanup or a mistaken delete-stack stops here instead of succeeding.

FIX

How to fix it

  1. First decide whether the delete is right. Someone armed the protection; find out why before disarming it. If the stack is shared or production, that conversation is the fix.
  2. If the delete is genuinely intended, disable protection and delete in two deliberate steps: 
    aws cloudformation update-termination-protection \
  --stack-name my-app --no-enable-termination-protection
aws cloudformation delete-stack --stack-name my-app
  3. Check what the stack holds before deleting - stateful resources (databases, buckets with data) deserve a snapshot or retain policy first.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the refusal wording (high confidence) and its guidance keeps the disarm-then-delete order explicit. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED