SAM ROLLBACK_COMPLETE state can't be updated

Question

Issue: Stack stuck in ROLLBACK_COMPLETE state due to insufficient SQS permissions during initial SAM deploy.

Steps:
1. Ran `sam deploy` to create an S3 bucket and an SQS queue.
2. IAM role did not have `sqs:CreateQueue` permission initially.
3. Deployment failed and stack went to `ROLLBACK_COMPLETE`.
4. After adding necessary permissions, re-running `sam deploy` gives:
   "An error occurred (ValidationError) when calling the CreateChangeSet operation: Stack is in ROLLBACK_COMPLETE state and cannot be updated."

Expected: I want to recover this stack or redeploy without renaming or deleting manually.

Previously, I was using the Serverless Framework v3 and never encountered this issue. How did they used to handle this?

re:Post Agent · Answer

When a CloudFormation stack is in the ROLLBACK_COMPLETE state, it indicates that the initial creation of the stack failed and all resources have been rolled back. Unfortunately, a stack in this state cannot be updated directly.

Here are your options to resolve this situation:

1. **Delete and recreate the stack**: The most straightforward approach is to delete the existing stack and deploy it again with the correct permissions. You can use:
```
aws cloudformation delete-stack --stack-name your-stack-name
```
And then run `sam deploy` again.

2. **Use a different stack name**: If you want to avoid deleting the current stack, you can deploy with a new stack name by using the `--stack-name` parameter:
```
sam deploy --stack-name new-stack-name
```

3. **Use the `--on-failure` option**: For future deployments, you can use the `--on-failure` parameter with `sam deploy` to specify what action to take when a stack fails to create. Options include:
- `ROLLBACK`: Rolls back to a previous known good state (default)
- `DELETE`: Deletes the stack if it fails
- `DO_NOTHING`: Neither rolls back nor deletes the stack

The key difference between SAM CLI and Serverless Framework is in how they handle failed deployments. Serverless Framework might have been configured to automatically delete failed stacks or use a different approach to stack management, which is why you didn't encounter this issue before.

Unfortunately, there's no direct way to update a stack in the ROLLBACK_COMPLETE state - you must either delete it first or create a new stack with a different name.  
**Sources**  
[Stack status of UPDATE_ROLLBACK_COMPLETE but unable to update stack | AWS re:Post](https://repost.aws/questions/QUzsPkiUKPTYCUjhMt6dOPSw/stack-status-of-update-rollback-complete-but-unable-to-update-stack)  
[sam deploy - AWS Serverless Application Model](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-cli-command-reference-sam-deploy.html)

SAM ROLLBACK_COMPLETE state can't be updated

Add your answer

Relevant content