aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Unexpected stack update rollback failures with status UPDATE_ROLLBACK_FAILED if AWS::CloudFormation::StackSet TemplateURL is used without S3 object version details
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::CloudFormation::StackSet
### Resource Name
_No response_
### Issue Description
When your stack contains a resource of type AWS::CloudFormation::StackSet with TemplateURL set to use an object from your S3 bucket, and if the rollback fails after an update failure, one of the possible causes can be if your bucket has more than 1 versions of the specified template file in TemplateURL and if that template has any conflicting issues. This is because, CloudFormation uses the current version of the template file at the time from S3 and not the version that worked previously before the update failure. This can cause rollback failures if the current template version at the time has any issues.
### Expected Behavior
CloudFormation uses the previously worked template version for rollback instead of the current version at the time in the S3 bucket.
### Observed Behavior
CloudFormation uses the current template version at the time in the S3 bucket for stack rollback instead of the previously worked template version.
### Test Cases
1. Use the following in AWS::CloudFormation::StackSet resource:
TemplateURL: 'https\://test-bucket.s3.amazonaws.com/mytemplate.yaml'
2. Upload another version of the same template ( same file name ) with an obvious error in the file for visibility during rollback. Now, this version will become the current version in the S3 bucket.
3. Use a different TemplateURL to trigger an update to the stack and make sure it fails.
Once the update fails, the stack rollback should fail as well reporting about the error that was intentionally added in step 2 and this indicates that CloudFormation used the current version of the template at the time from S3 bucket and not the previous one which worked ( that is not current at the time ).
### Other Details
As a workaround, specified the intended S3 object version in property TemplateURL before performing an update so that CloudFormation knows which version to rollback to upon an update failure and not choose the current version at the time:
TemplateURL: 'https\://test-bucket.s3.amazonaws.com/mytemplate-version.yaml?versionId=wkRa43xZyvPSOXfv7NEPPvRjon2TR669'
Contributor guide
Research direction
Reproduce the AWS::CloudFormation::StackSet update and rollback sequence using TemplateURL, S3 object versioning, and the intentionally invalid current template described in the issue. Compare rollback behavior with an unversioned URL and with the versionId workaround; done means rollback uses the previously working template version without requiring an explicit object version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100