aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Unexpected stack update rollback failures with status UPDATE_ROLLBACK_FAILED if AWS::CloudFormation::StackSet TemplateURL is used without S3 object version details

Open
#983 2 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::CloudFormation::StackSet

### Resource Name

_No response_

### Issue Description

When your stack contains a resource of type AWS::CloudFormation::StackSet with TemplateURL set to use an object from your S3 bucket, and if the rollback fails after an update failure, one of the possible causes can be if your bucket has more than 1 versions of the specified template file in TemplateURL and if that template has any conflicting issues. This is because, CloudFormation uses the current version of the template file at the time from S3 and not the version that worked previously before the update failure. This can cause rollback failures if the current template version at the time has any issues.

### Expected Behavior

CloudFormation uses the previously worked template version for rollback instead of the current version at the time in the S3 bucket.

### Observed Behavior

CloudFormation uses the current template version at the time in the S3 bucket for stack rollback instead of the previously worked template version.

### Test Cases

1. Use the following in AWS::CloudFormation::StackSet resource:

TemplateURL: 'https\://test-bucket.s3.amazonaws.com/mytemplate.yaml'

2. Upload another version of the same template ( same file name ) with an obvious error in the file for visibility during rollback. Now, this version will become the current version in the S3 bucket.

3. Use a different TemplateURL to trigger an update to the stack and make sure it fails.

Once the update fails, the stack rollback should fail as well reporting about the error that was intentionally added in step 2 and this indicates that CloudFormation used the current version of the template at the time from S3 bucket and not the previous one which worked ( that is not current at the time ).

### Other Details

As a workaround, specified the intended S3 object version in property TemplateURL before performing an update so that CloudFormation knows which version to rollback to upon an update failure and not choose the current version at the time:

TemplateURL: 'https\://test-bucket.s3.amazonaws.com/mytemplate-version.yaml?versionId=wkRa43xZyvPSOXfv7NEPPvRjon2TR669'

Contributor guide

Open the contributing guide

Research direction

Reproduce the AWS::CloudFormation::StackSet update and rollback sequence using TemplateURL, S3 object versioning, and the intentionally invalid current template described in the issue. Compare rollback behavior with an unversioned URL and with the versionId workaround; done means rollback uses the previously working template version without requiring an explicit object version.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.