ERROR REFERENCE
UPDATE_ROLLBACK_FAILED (the rollback itself failed)
A failed update tried to roll back to the last working state, and the rollback could not finish. The stack is frozen: no new deploy can start until the rollback is continued past — or deliberately skips — whatever refused to roll back.
WHAT IT MEANS
What this state means
Rollbacks re-apply the previous configuration, and that re-apply can
fail the same ways a deploy can: a resource changed outside
CloudFormation, a dependency was deleted, a permission was tightened
mid-flight. Unlike ROLLBACK_COMPLETE on a first create,
this state is recoverable in place - the stack does not need to be
deleted.
FIX
How to fix it
-
Find what refused to roll back (read-only):
aws cloudformation describe-stack-events --stack-name my-app \ --query 'StackEvents[?ResourceStatus==`UPDATE_ROLLBACK_FAILED` || contains(ResourceStatusReason, `Failed`)]|[:5]' -
Fix that resource's blocker if you can - restore
the out-of-band change, reattach the dependency - then:
aws cloudformation continue-update-rollback --stack-name my-app -
Skip only what genuinely cannot roll back:
--resources-to-skipleaves the named resource in its current state and out of sync with the template - a deliberate debt to reconcile in the next deploy, not a free pass. -
Wait for
UPDATE_ROLLBACK_COMPLETEbefore retrying the original update.
AUTOMATE THE TRIAGE
Diagnose this automatically
SAM Doctor recognizes the stuck-rollback refusal (high confidence) and keeps it distinct from the first-create dead end and from ordinary rollback progress. Runs locally; no AWS access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- Rollback could not delete an IAM role — the commonest specific cause of this state.
- ROLLBACK_COMPLETE and can not be updated — the first-create dead end this state is often confused with.
- Stack entered rollback — the healthy version of what failed here.