Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

CloudFormation Stack stuck in post update cleanup

0

Wondering if someone has encountered this before. I am in the process of setting up an OpenSearch domain via CloudFormation. When the stack was first created, the OpenSearch domain had a custom endpoint which created an certificate for use with that domain. I then updated the stack removing the custom endpoint, which went through fine, however the stack is now stuck in UPDATE_COMPLETE_CLEANUP_IN_PROGRESS. The cleanup that it's waiting for is deletion of the certificate that was initially created, it waits for 2 hours, fails with "ResourceInUseException" and tries again. I have tried to delete the certificate myself, but get an error that it is associated with a LoadBalancer. Problem is, the LB ARN in the error, doesn't match any of the LB in my account. So currently I'm stuck with a Stack that I can't use and can't delete.

Any ideas?

Topics
Management & GovernanceSecurity, Identity, & Compliance
Tags
AWS Certificate ManagerAWS CloudFormation
Language
English

asked 2 years ago2.9K views

2 Answers
0
Accepted Answer

Hi,

You may want to follow this guidance to fix your problem: https://repost.aws/knowledge-center/cloudformation-stack-cleanup-stuck

Best,

Didier

EXPERT

answered 2 years ago

  • Ovi
    2 years ago

    Hi Didier

    I did see that before posting, but it is of no help. Like I mentioned in my post, the dependency that is preventing the delete doesn't exist in my account, so there is no way to resolve the dependency issue as described in the article

  • Didier Durand EXPERT
    2 years ago

    Hi Ovi, from your own answer, it seems that you finally solved it through the patience of waiting 6 hours. I am glad for that. Thanks for accepting my answer! Didier

0

In case anyone stumbles upon this, I ended up solving it. The KB article @Didier posted does say that CloudFront will give up after 3 tries, in my case that was over 6 hours of waiting. Once it gave up I was able to manually delete the OpenSearch domain and once that was done, I was suddenly able to delete the certificate as well. I am assuming when an OpenSearch domain is created, AWS creates a hidden LB to balance traffic between the nodes. Once the domain was gone, so was the invisible LB and the certificate. I was then able to delete the rest of the stack from CloudFront.

P.S. It sucks having to pay for 6 hours of resources that are unusable. AWS need a better solution.

answered 2 years ago

  • Oscar Dabula
    a year ago

    I found that after updating my cdk bootstrap template, the new template had included a lifecycle configuration rule of cleaning up objects older than 30 days for the staging bucket, which resulted in UPDATE_COMPLETE_CLEANUP_IN_PROGRESS that took quite a while, when running my bootstrap stack. Once I manually emptied my staging bucket of old objects (had over 16gb), then the bootstrap stack completed successfully. It was clearly the lifecycle configuration rule that was taking a while to cleanup the staging bucket, during the bootstrap stack update.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content