CloudFormation Stack Update Rollback Failure: Troubleshooting Steps for DevOps Engineers
A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)
Quick Answer
The correct answer involves three key steps: checking the CloudFormation stack events for error messages, reviewing the specific resource status in the console, and using the `--retain-resources` parameter to preserve resources that failed to delete during rollback. When a stack update enters `UPDATE_ROLLBACK_IN_PROGRESS`, CloudFormation automatically attempts to revert changes, but a rollback itself can fail if a resource cannot be deleted or reverted—this is where stack events become critical, as they log the exact resource and reason for the failure. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your ability to differentiate between troubleshooting tools: change sets are for previewing updates, not diagnosing failures, and `DescribeStackResource` gives resource-level details but not the root cause. A common trap is confusing rollback failure investigation with update previewing. Memory tip: think "Events first, retain last"—always start with stack events to pinpoint the error, then use `--retain-resources` to save stuck resources during rollback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the CloudFormation console to identify which resource failed.
Options C, D, and E are correct. Option C: Reviewing the CloudFormation console directly shows which resource failed, enabling targeted investigation. Option D: Using '--retain-resources' preserves resources that failed to delete during rollback, allowing further analysis. Option E: Stack events contain detailed error messages and status updates that pinpoint the failure cause. Option A is incorrect because change sets are used to preview changes before execution, not for troubleshooting failures. Option B is incorrect because 'describe-stack-resource' returns details for a specific resource but does not provide the overall failure context and is not a primary troubleshooting step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a change set to see what changes were attempted.
Why it's wrong here
Change sets are for previewing changes, not for troubleshooting failures.
- ✗
Use the 'describe-stack-resource' AWS CLI command to get the resource status.
Why it's wrong here
This provides resource status but not the root cause of the failure.
- ✓
Review the CloudFormation console to identify which resource failed.
Why this is correct
The console highlights the failed resource.
- ✓
Use the '--retain-resources' option to preserve resources that failed to delete.
Why this is correct
This can be used to retain resources during rollback to prevent data loss.
- ✓
Check the CloudFormation stack events for error messages.
Why this is correct
Stack events contain the error details for the failed resource.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudFormation to manage infrastructure. During a deployment, a stack update fails and the stack is in ROLLBACK_IN_PROGRESS state. The DevOps engineer needs to investigate the failure while preserving the resources that were created before the failure. What should the engineer do?
medium- A.Delete the stack to start fresh.
- B.Use the 'describe-stack-events' API to view the error and then manually fix the issue.
- C.Call the 'cancel-update' API to stop the rollback and keep the current state.
- ✓ D.Use the 'continue-update-rollback' API with the 'resources-to-skip' parameter to skip the failing resource.
Why D: Using 'continue update rollback' with the 'resources to skip' parameter allows the engineer to skip specific resources and preserve them while continuing the rollback for others. Option A is wrong because deleting the stack removes all resources. Option B is wrong because 'describe stack events' provides information but does not prevent the rollback from continuing. Option C is wrong because 'cancel update' is not a valid operation; CloudFormation does not support canceling a rollback.
Variation 2. A company uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with the error 'The following resource(s) failed to create: [AWS::RDS::DBInstance]'. Which AWS service should the engineer use to view detailed error messages for the failed resource creation?
easy- A.AWS Config timeline
- ✓ B.AWS CloudFormation console Events tab
- C.AWS Service Catalog
- D.AWS CloudTrail event history
Why B: The correct option is B: the CloudFormation console Events tab displays detailed error messages for each resource event, including creation failures. This is the most direct way to view error details for failed resource creation. Option A (AWS Config timeline) is used for configuration history and compliance, not for resource creation errors. Option C (AWS Service Catalog) manages product portfolios and provisioning, not stack troubleshooting. Option D (AWS CloudTrail event history) records API calls but does not surface CloudFormation-specific resource-level error messages.
Variation 3. A company uses AWS CloudFormation to manage infrastructure. An engineer notices that a stack update has failed, leaving the stack in a ROLLBACK_IN_PROGRESS state. Which TWO actions should the engineer take to investigate and resolve the issue?
medium- A.Manually stop the rollback and continue with the update
- B.Re-launch the stack with the same template
- ✓ C.View the stack events in the CloudFormation console to see the specific error message
- D.Delete the stack and re-launch it
- ✓ E.Review the change set that was applied during the update
Why C: When a CloudFormation stack update fails and enters ROLLBACK_IN_PROGRESS, the engineer should first view the stack events (option C) to identify the specific error message that caused the failure. This provides insight into what went wrong. Then, reviewing the change set (option E) helps understand the intended changes and diagnose the issue. Option A is incorrect because manually stopping the rollback is not a standard action and could leave resources in an inconsistent state. Option B is incorrect because re-launching the stack with the same template would likely repeat the same error without addressing the root cause. Option D is incorrect because deleting and re-launching the stack would lose existing resources and is an extreme measure not needed for investigation.
Variation 4. A company uses AWS CloudFormation to manage infrastructure. A stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The DevOps engineer needs to investigate the failure. Which TWO actions should the engineer take?
easy- A.Review AWS CloudTrail logs for the 'UpdateStack' API call.
- ✓ B.Review the 'Stack Events' tab in the CloudFormation console to see the specific error messages.
- C.Check the 'Rollback triggers' configuration for the stack.
- ✓ D.Examine the stack's 'Template' and 'Parameters' to ensure they are correct.
- E.Create a Change Set to see the proposed changes before re-attempting the update.
Why B: To investigate a CloudFormation stack update failure, the DevOps engineer should review the 'Stack Events' tab (Option B), which provides detailed error messages for each resource, helping identify the root cause. Additionally, examining the stack's 'Template' and 'Parameters' (Option D) can reveal misconfigurations that may have caused the failure. Option A is incorrect because CloudTrail logs record API calls but not the specific resource-level errors from the stack update. Option C is incorrect because 'Rollback triggers' are used to monitor stack status and initiate rollback, not to diagnose failures. Option E is incorrect because Change Sets are for previewing changes before execution, not for debugging a failed update.
Variation 5. A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed with the error 'UPDATE_ROLLBACK_FAILED'. The stack is now in a 'UPDATE_ROLLBACK_FAILED' state, and the engineer needs to fix the stack. What is the correct course of action?
hard- A.Contact AWS Support to fix the stack
- B.Delete the stack and recreate it
- C.Submit another stack update with the desired configuration
- ✓ D.Continue the rollback using the 'ContinueUpdateRollback' API
Why D: The 'ContinueUpdateRollback' API allows you to resume the rollback of a stack that is in a 'UPDATE_ROLLBACK_FAILED' state. This action attempts to roll back the remaining resources that failed during the initial rollback, potentially skipping resources that cannot be rolled back. Option A is incorrect because AWS Support cannot fix the stack state; you need to take action yourself. Option B is incorrect because deleting a stack in 'UPDATE_ROLLBACK_FAILED' state may not succeed; you first need to continue the rollback or fix the underlying issues. Option C is incorrect because you cannot submit a new stack update while the stack is in a failed rollback state; you must first resolve the rollback failure.
Variation 6. An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?
hard- ✓ A.Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.
- B.Create a new stack from the same template and migrate resources.
- C.Manually correct the resource configuration that caused the failure, then perform a stack update.
- D.Delete the stack and then recreate it from the same template.
Why A: The 'ContinueUpdateRollback' API is the best approach because it allows the stack to resume the rollback process, skipping the resource that caused the failure, and bringing the stack to a consistent 'UPDATE_ROLLBACK_COMPLETE' state without manual intervention or data loss. This API is specifically designed for the 'UPDATE_ROLLBACK_FAILED' status, enabling you to skip resources that cannot be rolled back (e.g., due to a non-reversible change) while preserving the rest of the stack's state.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.