How do I delete a stack instance from a CloudFormation stack set in a closed or suspended AWS account?

Short description

When an account is closed or suspended, the CloudFormation StackSets administration role can no longer access the StacksSets execution role in that account. To delete stack instances for closed or suspended accounts, you must perform the DeleteStackInstances operation with the RetainStacks option set to true. This disconnects the stack instance from the stack set and doesn't delete the stack instance in the target account.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also make sure that you're using the most recent AWS CLI version.

To delete a stack instance from a closed or suspended AWS account, use either the CloudFormation console or the AWS CLI.

If you use the AWS CLI, then replace the following values with your values:

• YourStackSetName with your stack set's name
• YourStackInstanceAccount with the closed or suspended account's number
• YourStackInstanceRegion with your stack instance's AWS Region

Complete the resolution for your stack set's permission model.

Delete stack sets with self-managed permissions

CloudFormation console

Complete the following steps:

1. Open the CloudFormation console.
2. In the navigation pane, choose StackSets.
3. In the StackSet name column, select the stack set.
4. Choose Actions, and then choose Delete stacks from StackSets.
5. On the Set deployment options page, for Account numbers, enter the 12-digit account number of the account that's closed or suspended.
6. For Specify regions, choose your stack instance's Region.
7. For Deployment options, turn on Retain stacks, and then choose Next.
8. On the Review page, choose Submit.

AWS CLI

Run the delete-stack-instances command:

$ aws cloudformation delete-stack-instances --stack-set-name YourStackSetName --accounts YourStackInstanceAccount --regions YourStackInstanceRegion --retain-stacks

Delete stack sets with service-managed permissions

CloudFormation console

Note: If your account is closed, deleted, or suspended and you don't know your account's organizational unit ID (OU ID), use the root OU ID instead. Then, select AccountFilterType as an intersection.

Complete the following steps:

1. Open the CloudFormation console.
2. In the navigation pane, choose StackSets.
3. In the StackSet name column, select the stack set.
4. Choose Actions, and then choose Delete stacks from StackSets.
5. On the Set deployment options page, take the following actions:
   Enter the AWS Organizations unit ID that the target account is in.
   Select account filter type, then select intersection.
   Enter the target account number so that you can delete individual accounts in OUs rather than delete the entire AWS Organizations unit.
6. In the Specify regions section, choose your stack instance's AWS Region.
7. In the Deployment options section, turn on Retain stacks, and then choose Next.
8. On the Review page, choose Submit.

AWS CLI

Run the delete-stack-instances command:

$ aws cloudformation delete-stack-instances --stack-set-name YourStackSetName --deployment-targets Accounts=YourStackInstanceAccount,OrganizationalUnitIds=YourStackInstanceAccountOU,AccountFilterType=INTERSECTION --regions YourStackInstanceRegion --retain-stacks

Related information

Permission models for stack sets

StackSets status codes